collin/browser-terminal-extension · ea0845f8

Add install/activation, omnibar navigation, and touch scrolling

Collin Richards · 2026-08-17 14:03 UTC · ea0845f8f1bbbfee8d4d3888ce10ee78e7fbe73b · parent b9b5b120 · browse files

modified.gitignore+4 −0

addedCLAUDE.md+74 −0

modifiedREADME.md+209 −30

modifiedTODO.md+9 −1

modifiedbuild.sh+1 −1

modifieddaemon/Cargo.lock+44 −44

modifieddaemon/Cargo.toml+2 −2

addeddaemon/src/activation.rs+128 −0

modifieddaemon/src/agents.rs+18 −6

modifieddaemon/src/control.rs+5 −2

addeddaemon/src/install.rs+446 −0

modifieddaemon/src/lib.rs+9 −1

modifieddaemon/src/main.rs+99 −21

modifieddaemon/src/paths.rs+158 −4

addeddaemon/src/project.rs+286 −0

modifieddaemon/src/pty.rs+87 −7

modifieddaemon/src/server.rs+1309 −29

addeddaemon/src/ssh.rs+344 −0

modifieddaemon/src/status.rs+379 −70

modifieddaemon/src/tls.rs+11 −7

addeddaemon/tests/activation.rs+130 −0

modifieddaemon/tests/pty_e2e.rs+328 −11

modifieddaemon/tests/security.rs+52 −15

modifieddaemon/tests/tls.rs+24 −10

modifiedextension/jsconfig.sw.json+8 −1

modifiedextension/lib/shot.js+50 −6

addedextension/lib/split.js+127 −0

addedextension/lib/split.test.js+128 −0

modifiedextension/lib/theme.js+2 −0

modifiedextension/manifest.chrome.json+22 −0

modifiedextension/manifest.firefox.json+13 −0

addedextension/mock.html+199 −0

modifiedextension/picker.js+3 −0

modifiedextension/sidebar.css+976 −99

modifiedextension/sidebar.html+197 −26

modifiedextension/sidebar.js+3936 −445

modifiedextension/sw.js+270 −14

modifiedextension/types/globals.d.ts+172 −9

1	1		node_modules/
2	2		dist/
	3	+
	4	+	# Leftovers from patch/merge tools, never source.
	5	+	*.orig
	6	+	*.rej

1	+	# CLAUDE.md
2	+
3	+	A tmux sidebar for Chrome and Firefox. Two halves that ship separately:
4	+
5	+	- `extension/` is the browser extension (named terminal). Plain files, no
6	+	bundler: the browser loads the `.js`/`.css`/`.html` on disk as they are.
7	+	- `daemon/` is `termbridge`, a Rust CLI that serves a WebSocket on
8	+	`127.0.0.1:7681`, spawns a pty, and runs tmux inside it. tmux, not the daemon,
9	+	is the persistence layer.
10	+
11	+	See `README.md` for protocol, pairing, TLS, and the systemd socket activation
12	+	story. This file is the build and edit loop.
13	+
14	+	## Build
15	+
16	+	```sh
17	+	./build.sh # extension -> dist/chrome and dist/firefox
18	+	./run.sh # daemon: cargo build --release, then `termbridge serve`
19	+	```
20	+
21	+	`build.sh` copies files into `dist/`. The browser loads `dist/chrome` (or
22	+	`dist/firefox`), never `extension/`. So an edit under `extension/` has no effect
23	+	until `./build.sh` runs and the sidebar (or the extension) is reloaded. This is
24	+	the most common reason a change "didn't work".
25	+
26	+	`build.sh` copies an explicit list of files. A new file under `extension/` or
27	+	`extension/lib/` will not reach `dist/` until it is added to that list.
28	+	`extension/mock.html` is deliberately excluded: it renders the sidebar header in
29	+	a plain tab for layout work, outside the extension.
30	+
31	+	## Checks
32	+
33	+	```sh
34	+	npm test # node --test over extension/lib/*.test.js
35	+	npm run check # tsc over both jsconfig projects, noEmit
36	+	cd daemon && cargo test
37	+	```
38	+
39	+	`npm run check` is type checking only, never a build step. The extension files
40	+	are classic scripts sharing one global scope (`sidebar.js` reaches `Themes`,
41	+	`Sanitize`, `tbPickElement` with no imports), so nothing under `extension/` may
42	+	introduce `import`/`export` syntax. There are two tsconfig projects because
43	+	there are two global scopes: `jsconfig.json` (sidebar document) and
44	+	`jsconfig.sw.json` (service worker), both extending `jsconfig.base.json`.
45	+
46	+	Daemon tests use `/bin/sh` rather than tmux where they can, and skip themselves
47	+	when tmux is missing; the tmux ones use a private socket so they never touch
48	+	your real sessions.
49	+
50	+	## Daemon edit loop
51	+
52	+	If the daemon is installed as a user service (`termbridge install`), a rebuilt
53	+	binary is picked up on the next activation, but only once the running one exits:
54	+
55	+	```sh
56	+	cd daemon && cargo build --release
57	+	termbridge reload
58	+	```
59	+
60	+	Re-run `termbridge install` instead when the change affects what the unit
61	+	encodes (port, idle timeout, pinned session, binary path).
62	+
63	+	## Conventions
64	+
65	+	- Both manifests (`manifest.chrome.json`, `manifest.firefox.json`) are hand
66	+	maintained. A permission or file change usually has to land in both.
67	+	- `extension/lib/theme.js` is the single source of truth for both palettes: the
68	+	`ui` block becomes CSS custom properties, the `xterm` block goes to
69	+	`term.options.theme`. Do not hardcode colors in `sidebar.css`; use the
70	+	variables.
71	+	- `sidebar.css` carries long comments explaining why a rule exists (the tab
72	+	silhouette, the separators, the seam the active tab covers). Keep that style
73	+	when editing it, and read the surrounding comment before changing a value.
74	+	- `extension/vendor/` is vendored xterm.js. Do not edit it.

1		-	- when opening and disconnected in the browser extension, the extension should display to the user the command they need to run to start the service in their terminal
	1	+	- [ ] Idea: pull off a tab out side of the browser and it puts it within your default terminal emulator
	2	+	- [ ] TODO: get working well on unconfigured tmux
	3	+	- [ ] TODO: investigate chrome wterm and vercel wterm
	4	+	- [ ] Idea: pinned tab / session mode
	5	+	- [ ] send to claude should auto name window using llm
	6	+	- [ ] typing cd in omnibar should have a ui for selecting dir
	7	+	- this will change the directory of the current tmux session
	8	+	- [ ] be able to talk to claude about anything on the page
	9	+	- [ ] I notice that ctrl-shift-l focuses our omni bar properly when used within our extension, but when the page is focused, using ctrl-shift-l doesn't properly select the text in our omnibar

⋯ 6 unchanged lines
7	7		out="dist/$browser"
8	8		rm -rf "$out"; mkdir -p "$out"
9	9		cp extension/sidebar.html extension/sidebar.js extension/sidebar.css extension/picker.js "$out/"
10		-	mkdir -p "$out/lib" && cp extension/lib/sanitize.js extension/lib/theme.js extension/lib/shot.js "$out/lib/"
	10	+	mkdir -p "$out/lib" && cp extension/lib/sanitize.js extension/lib/theme.js extension/lib/shot.js extension/lib/split.js "$out/lib/"
11	11		cp -r extension/vendor extension/icons "$out/"
12	12		cp "extension/manifest.$browser.json" "$out/manifest.json"
13	13		cp extension/sw.js "$out/" # both browsers now run a background script
⋯ 11 unchanged lines

⋯ 3 unchanged lines
4	4		edition = "2024"
5	5
6	6		[dependencies]
7		-	futures-util = { version = "0.3.33", default-features = false, features = ["std", "sink"] }
	7	+	futures-util = { version = "0.3.34", default-features = false, features = ["std", "sink"] }
8	8		getrandom = "0.4.3"
9	9		portable-pty = "0.9.0"
10		-	rcgen = { version = "0.14.8", default-features = false, features = ["pem", "ring"] }
	10	+	rcgen = { version = "0.14.9", default-features = false, features = ["pem", "ring"] }
11	11		serde = { version = "1.0.229", features = ["derive"] }
12	12		serde_json = "1.0.151"
13	13		sha2 = "0.11.0"
⋯ 7 unchanged lines

⋯ 13 unchanged lines
14	14		│ ─── {"type":"auth","token":"…"} ──────▶ │ origin + host + token
15	15		│ ◀── {"type":"ok"} ───────────────────── │
16	16		│ ─── {"type":"open","cols":80,…} ──────▶ │ spawn pty
17		-	│ ═══ binary frames (raw bytes) ════════▶ │ ──▶ tmux new-session -A -s browser
	17	+	│ ═══ binary frames (raw bytes) ════════▶ │ ──▶ tmux new-session -A -s default
18	18		│ ◀══ binary frames (raw bytes) ═════════ │
19	19		│ ─── {"type":"resize","cols":…} ───────▶ │ TIOCSWINSZ
20	20		```
⋯ 37 unchanged lines
58	58		regenerated on each temporary install, so you'll re-pair each time until the
59	59		add-on is signed.
60	60
	61	+	## Starting the daemon on demand
	62	+
	63	+	Remembering to run `termbridge serve` before opening the sidebar is the worst
	64	+	part of the setup above. Hand it to the service manager instead:
	65	+
	66	+	```sh
	67	+	termbridge install # then never think about it again
	68	+	```
	69	+
	70	+	On Linux that is socket activation, not an always-on service. systemd binds
	71	+	`127.0.0.1:7681` at login and holds it; the daemon is only exec'd when the
	72	+	sidebar actually connects, inheriting the already-bound socket as fd 3. Fifteen
	73	+	minutes after the last client disconnects the daemon exits again, and the next
	74	+	connection starts a fresh one. So at rest there is no process, only a socket.
	75	+
	76	+	That is safe only because tmux, not the daemon, is the persistence layer.
	77	+	Exiting drops no session state, which is the same property that lets you close
	78	+	the sidebar and reattach later. If tmux is unavailable and the daemon falls back
	79	+	to a plain shell, do not install with an idle timeout — the fallback shell dies
	80	+	with the daemon.
	81	+
	82	+	```sh
	83	+	termbridge install --idle-timeout 0 # stay resident once started
	84	+	termbridge install --port 7999 --session work
	85	+	termbridge reload # restart the daemon after a rebuild
	86	+	termbridge uninstall
	87	+	systemctl --user status termbridge.service
	88	+	journalctl --user -u termbridge.service -f
	89	+	```
	90	+
	91	+	### Updating the daemon
	92	+
	93	+	The unit points at the binary by absolute path, so a rebuild is picked up by the
	94	+	next activation — but only once the daemon holding the old code goes away:
	95	+
	96	+	```sh
	97	+	cargo build --release
	98	+	termbridge reload # socket keeps listening
	99	+	```
	100	+
	101	+	The next sidebar connection starts the new binary. Nothing else is needed, and
	102	+	if you can wait out the idle timeout you don't even need the reload.
	103	+
	104	+	`reload` is `systemctl --user daemon-reload`, `stop termbridge.service`,
	105	+	`restart termbridge.socket` and an `import-environment PATH`, in that order, and
	106	+	nothing else — it never rewrites a unit, so a port, idle timeout or pinned
	107	+	session you set at install time survives it. On macOS it is `launchctl kickstart
	108	+	-k` against the login agent. Either way tmux is not involved: the sessions and
	109	+	everything running in them belong to the tmux server, so all a reload costs is
	110	+	the moment the sidebar takes to reconnect.
	111	+
	112	+	If you changed anything the unit encodes (port, idle timeout, session, or
	113	+	where the binary lives), re-run `termbridge install` instead. It rewrites both
	114	+	units, stops the running daemon, and restarts the socket, in that order. The
	115	+	order is the whole trick: `enable --now` is a no-op on an already-active socket,
	116	+	so a reinstall without the restart leaves the old configuration listening while
	117	+	systemd logs "Unit configuration changed while unit was running ... Unit not
	118	+	functional until restarted" and the port quietly stops accepting. And the socket
	119	+	cannot be restarted before the daemon is stopped, because the daemon is still
	120	+	holding the port.
	121	+
	122	+	`systemctl stop` prints "Stopping termbridge.service, but its triggering units
	123	+	are still active" every time. That is systemd describing socket activation back
	124	+	to you, not a problem.
	125	+
	126	+	The units land in `~/.config/systemd/user/`, and re-running `install` overwrites
	127	+	them, so edit freely and expect to lose it on upgrade. `install` also runs
	128	+	`systemctl --user import-environment PATH`, because a user service otherwise
	129	+	inherits the manager's PATH rather than your shell's, and the usual symptom is
	130	+	the daemon reporting "tmux not found" while `tmux` works fine in every terminal
	131	+	you have open.
	132	+
	133	+	On macOS `install` writes a launchd agent that runs at login and stays resident.
	134	+	launchd can do socket activation too, but only through
	135	+	`launch_activate_socket(3)`, so the on-demand half is Linux-only for now.
	136	+
	137	+	Nothing about this changes the protocol: `termbridge serve` by hand still works
	138	+	and still binds its own socket. `--systemd-socket` is what switches it to the
	139	+	inherited one, and it's an error rather than a fallback if no socket arrives —
	140	+	binding a second port would leave the sidebar talking to a daemon nobody dialed.
	141	+
61	142		## Theme
62	143
63	144		The ◐ button in the header cycles follow system → light → dark, and the ⚙
⋯ 27 unchanged lines
91	172		By default the sidebar joins the tmux session you already have running, when
92	173		there is exactly one — no point starting a second session beside the only one
93	174		you are using. With none, or with several, it attaches to a session called
94		-	`browser` and creates it if needed. The check happens per connection, so it
	175	+	`default` and creates it if needed. The check happens per connection, so it
95	176		reflects what tmux holds when the sidebar connects, not when the daemon
96	177		started.
97	178
⋯ 3 unchanged lines
101	182		termbridge serve --session my-existing-work
102	183		```
103	184
104		-	Or pick it live: the dropdown at the left of the header lists every session on
105		-	the server. Choosing one runs `switch-client` on the sidebar's own tmux client
106		-	— the WebSocket stays up, no second pty is spawned, and whatever is running in
107		-	the session you left keeps running. The ⚙ panel's tmux session field is the
108		-	way to reach a session that doesn't exist yet: it creates-or-attaches and
109		-	switches to it.
	185	+	Or pick it live: the header's top row is one tab per session on the server.
	186	+	Clicking one runs `switch-client` on the sidebar's own tmux client — the
	187	+	WebSocket stays up, no second pty is spawned, and whatever is running in the
	188	+	session you left keeps running. + names a new one inline (`new-session -A`,
	189	+	so an existing name attaches instead of failing), and the ⚙ panel's **tmux
	190	+	session** field does the same from settings.
	191	+
	192	+	A session tab carries the number of windows behind it, and in its favicon slot
	193	+	the loudest thing Claude Code is doing anywhere inside it — a Claude waiting on
	194	+	you in a session you are not looking at still gets a light. That is what the
	195	+	daemon's whole-server status frames are for.
110	196
111		-	The dropdown shows the session you are actually on, not the one you asked
	197	+	The selected tab is the session you are actually on, not the one you asked
112	198		for, so a `switch-client`, `choose-tree` or prefix-`(`/`)` typed in the terminal
113		-	updates it too.
	199	+	moves it too.
114	200
115	201		Both names are validated server-side — see the security notes below.
116	202
117	203		## Window tabs
118	204
119		-	The rest of the header is a browser-style tab bar, one tab per window in the
120		-	attached session — the same windows `prefix 2` selects and the tmux status line
121		-	lists. Clicking one runs `select-window`, and + runs `new-window`. Neither
122		-	touches the connection: the pty, the session and everything running in it stay
123		-	exactly as they were.
	205	+	The header's second row is a browser-style tab bar nested under the session
	206	+	tabs: one tab per window of the selected session — the same windows
	207	+	`prefix 2` selects and the tmux status line lists. Clicking one runs
	208	+	`select-window`, and + runs `new-window`. Neither touches the connection:
	209	+	the pty, the session and everything running in it stay exactly as they were.
124	210
125	211		Selecting a window deliberately moves every client watching that session, not
126	212		just the sidebar — a window belongs to the session, so this behaves the same as
⋯ 1 unchanged line
128	214
129	215		The active tab is drawn in the terminal's own background so the two read as one
130	216		surface. The dot in its favicon slot is what Claude Code is doing in that
131		-	window — amber and pulsing for working, blue for waiting on you — and stays
	217	+	window — amber and cycling for working, blue for waiting on you, green for
	218	+	finished with something you have not read — and stays
132	219		empty for a window that is just a shell, rather than lighting up a status
133	220		indicator with no status to report. A background window that has produced
134	221		output since you last looked wears tmux's activity flag as a bolder name.
⋯ 46 unchanged lines
181	268
182	269		`read-only` governs keys, not commands, so the same channel carries the
183	270		sidebar's requests. Those are a closed allowlist — switch to a session,
184		-	create-and-switch, focus a pane, select a window, open a window, close a window
185		-	— expressed as an enum, not a command string. The wire protocol cannot name a
	271	+	create-and-switch, focus a pane, select a window, go to a window in another
	272	+	session, open a window, move a window, close a window, rename a session, set a
	273	+	session's colour —
	274	+	expressed as an enum, not a command string. The wire protocol cannot name a
186	275		tmux command, and every argument is validated (`valid_session_name`,
187		-	`valid_pane_id`, `valid_window_id`) before it is quoted into a command line.
	276	+	`valid_pane_id`, `valid_window_id`, `valid_group_color`) before it is quoted
	277	+	into a command line.
	278	+
	279	+	The colour is the one piece of the panel's own state kept on the server rather
	280	+	than in the browser. It goes in a tmux user option, `@termbridge_color`, set on
	281	+	the session and read back as one more field of the `list-sessions` format the
	282	+	status frame is already built from — so it costs no extra round trip. Keeping it
	283	+	there rather than in extension storage means it follows a session through a
	284	+	rename, every panel on the server agrees on it, and it dies with the session.
	285	+	The value is a hue in degrees or `-1` for grey, and nothing else parses.
188	286
	287	+	The channel also sets one option on each session the sidebar's client lands on.
	288	+	tmux's default is `detach-on-destroy on`: exit the last shell of a session and
	289	+	every client attached to it is detached too. For a terminal emulator that just
	290	+	closes the window, but here it is EOF on the pty, so the socket closes and the
	291	+	whole panel goes dead even though other sessions are still running. The daemon
	292	+	switches it to `off`, which moves the client to another session instead and only
	293	+	falls back to detaching when there is nothing left to show. Only tmux's own
	294	+	default is overridden — `no-detached` and `previous` are deliberate choices with
	295	+	the same effect, and are left alone.
	296	+
189	297		Exactly one of them destroys anything, `kill-window`, and it can only ever name
190	298		one window: a window id is `@` plus digits, so `-a` (which would kill every
191	299		window but the target) and `session:` targets do not parse. There is no
⋯ 8 unchanged lines
200	308		\| Glyph \| Meaning \|
201	309		\|---\|---\|
202	310		\| amber, cycling `· ✢ ✳ ∗ ✻ ✽` \| working \|
203		-	\| blue `✳` \| waiting on you \|
	311	+	\| blue `✳`, pulsing \| waiting on you \|
	312	+	\| green `✻`, pulsing \| done, and you haven't looked yet \|
204	313		\| grey `✻` \| idle at the prompt \|
205	314		\| faded `·` \| Claude is there, but no hooks are installed for it \|
206	315		\| nothing \| no Claude in this window \|
207	316
208	317		One timer drives the whole strip and only runs while something is working, so
209		-	an idle panel is not repainting forever. `prefers-reduced-motion` parks the
210		-	glyph on a single frame rather than dropping the indicator.
	318	+	an idle panel is not repainting forever. `prefers-reduced-motion` drops the
	319	+	pulse and parks the spinner on a single frame rather than dropping the
	320	+	indicator; the colours, which are what carry the meaning, stay.
211	321
212	322		Joined on the tmux window id, so a window shows the loudest state in it —
213		-	waiting beats working. The tab's tooltip carries the detail the dot can't: the
214		-	tool in flight, or what Claude is blocked on.
	323	+	waiting beats done, and both beat working. The tab's tooltip carries the detail
	324	+	the dot can't: the tool in flight, or what Claude is blocked on.
	325	+
	326	+	### Action required
	327	+
	328	+	Green and grey are the same thing to Claude Code — a session sitting at its
	329	+	prompt. What separates them is whether that pane has been in front of you since
	330	+	it went quiet, which no hook can report: nothing in Claude's process knows which
	331	+	tmux pane a person is looking at. tmux does, so the daemon is where the two are
	332	+	put together.
	333	+
	334	+	The rules, in full:
215	335
	336	+	- Lit for any Claude at rest in a pane that is not on screen. On screen
	337	+	means the active pane, of the active window, of the session this daemon's
	338	+	client is attached to — a tab in the strip is not a pane on screen.
	339	+	- Cleared by looking. Selecting the window clears it within the second, and
	340	+	a pane you are already on never lights up in the first place.
	341	+	- Re-armed by the next turn. Sending a prompt puts the pane back to
	342	+	`working`, and the rest after that is news again.
	343	+
	344	+	It is a stamp per pane, not a flag: what is remembered is the `updated` time of
	345	+	the record you were shown, so any later hook event stops matching it and the
	346	+	pane goes back to unseen on its own. A pane id tmux recycles into a new pane
	347	+	can't inherit a stale mark for the same reason.
	348	+
	349	+	The state lives in the daemon, so it is shared by every panel on that tmux
	350	+	server and survives a panel reload — but not a daemon restart, after which
	351	+	everything at rest reads as ready once. The tmux status line (below) doesn't
	352	+	take part: it runs as its own short-lived process with no view of the daemon's
	353	+	memory, and shows plain `idle`.
	354	+
216	355		There used to be a second row of per-pane chips under the header saying the
217	356		same thing at more length. It was costing a terminal line to repeat what the
218	357		tabs already show, so it's gone; the trade is that a window whose tab is
⋯ 50 unchanged lines
269	408		The only command this issues is `set-option -w @tb_claude`. It cannot rename a
270	409		window, change a layout, or send a key.
271	410
	411	+	## Opening and focusing the terminal
	412	+
	413	+	Alt+Shift+T is one key for the whole cycle, and what it does depends on
	414	+	where the keyboard is:
	415	+
	416	+	\| Sidebar state \| What the key does \|
	417	+	\|---\|---\|
	418	+	\| Closed \| Opens it \|
	419	+	\| Open, focus is on the page \| Focuses the terminal \|
	420	+	\| Open, focus is in the terminal \| Closes it \|
	421	+
	422	+	So it is hold-to-glance from the page and press-twice to dismiss, without ever
	423	+	reaching for the mouse. Rebindable in the same place as the picker shortcut:
	424	+	`chrome://extensions/shortcuts`, or `about:addons` → gear → Manage Extension
	425	+	Shortcuts.
	426	+
	427	+	The sidebar has to be open for the browser to know its own state, which is why
	428	+	the panel keeps a connection to the background worker while it lives. That
	429	+	connection carries three commands (open, focus, close) and nothing else — no
	430	+	terminal traffic goes through it, for the reason in the header of `sidebar.js`.
	431	+
272	432		## Picking elements off the page
273	433
274	434		Two ways to start it, and the difference matters:
⋯ 8 unchanged lines
283	443		navigate or submit.
284	444
285	445		To get out: Esc (from either the page or the sidebar), or press the
286		-	crosshair again — it toggles.
	446	+	crosshair again — it toggles. Esc in one half of a split view ends the whole
	447	+	pick, not just that half's overlay.
287	448
	449	+	Split view. Chrome puts two tabs side by side but marks only one of them
	450	+	`active`, so aiming at "the active tab" always lands in whichever half last had
	451	+	focus — the other half looks dead. The picker instead runs in both halves at
	452	+	once (found via `splitViewId`, Chrome 140+) and takes the first click; the loser
	453	+	is torn down. The half you clicked is made active before the screenshot,
	454	+	because `tabs.captureVisibleTab` takes no tab id and shoots whatever is active.
	455	+	One caveat on the Alt+Shift+P path: the `activeTab` grant the shortcut mints
	456	+	covers the active half only, so a pick in the other half needs that origin
	457	+	granted (see below) — otherwise that half sits out and the active one still
	458	+	works. Firefox has no split view and no `splitViewId`; it takes the single-tab
	459	+	path.
	460	+
288	461		Picking sends the result straight to the terminal, screenshot first:
289	462
290	463		1. The element's box is cropped out of a screenshot of the tab and put on the
⋯ 149 unchanged lines
440	613		\| Config \| Realm \| Files \|
441	614		\|---\|---\|---\|
442	615		\| `extension/jsconfig.json` \| sidebar document \| `sidebar.js`, `picker.js`, `lib/` \|
443		-	\| `extension/jsconfig.sw.json` \| service worker \| `sw.js`, `picker.js`, `lib/shot.js` \|
	616	+	\| `extension/jsconfig.sw.json` \| service worker \| `sw.js`, `picker.js`, `lib/shot.js`, `lib/split.js` \|
444	617
445	618		`extension/types/globals.d.ts` is hand-written rather than pulled from
446	619		`@types/chrome`, so it doubles as the inventory of extension API surface this
⋯ 28 unchanged lines
475	648		daemon/src/pty.rs portable-pty backend
476	649		daemon/src/tls.rs self-signed cert generation, rustls config
477	650		daemon/src/rewind.rs replayable stream, so we can inspect the request head
478		-	daemon/tests/ security.rs (28), tls.rs (10), pty_e2e.rs (8)
	651	+	daemon/src/activation.rs taking the listening socket systemd passed us
	652	+	daemon/src/install.rs the systemd units / launchd agent `install` writes
	653	+	daemon/tests/ security.rs (28), tls.rs (10), pty_e2e.rs (8),
	654	+	activation.rs (5)
479	655		extension/picker.js injected element picker (no privileges, runs in page)
480	656		extension/lib/ sanitize.js (page-text-to-shell boundary), theme.js
481		-	(light/dark palettes) — both with tests; shot.js
482		-	(element screenshot crop, clipboard write)
	657	+	(light/dark palettes), split.js (running the picker in
	658	+	both halves of a split view) — all three with tests;
	659	+	shot.js (element screenshot crop, clipboard write)
483	660		extension/types/ hand-written ambients: extension API surface, the
484	661		daemon's wire frames, the vendored xterm build
485	662		extension/ sidebar, two manifests, vendored xterm.js
⋯ 6 unchanged lines
492	669		the certificate.
493	670		- Chrome has not been loaded at all; whether MV3 needs anything in
494	671		`host_permissions` or CSP `connect-src` is still unverified.
495		-	- No packaging: the daemon is started by hand, and there's no systemd unit.
	672	+	- No packaging: there's no distributable build, though `termbridge install` now
	673	+	covers starting the daemon (socket activation on Linux, a login agent on
	674	+	macOS).

⋯ 19 unchanged lines
20	20		"nom",
21	21		"num-traits",
22	22		"rusticata-macros",
23		-	"thiserror 2.0.19",
	23	+	"thiserror 2.0.20",
24	24		"time",
25	25		]
26	26
⋯ 70 unchanged lines
97	97
98	98		[[package]]
99	99		name = "cc"
100		-	version = "1.4.0"
	100	+	version = "1.4.2"
101	101		source = "registry+https://github.com/rust-lang/crates.io-index"
102		-	checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
	102	+	checksum = "5d262e149917187838d5b42777c8253bcb64500067342904e7d429499a6f277e"
103	103		dependencies = [
104	104		"find-msvc-tools",
105	105		"shlex",
⋯ 48 unchanged lines
154	154
155	155		[[package]]
156	156		name = "data-encoding"
157		-	version = "2.11.0"
	157	+	version = "2.11.1"
158	158		source = "registry+https://github.com/rust-lang/crates.io-index"
159		-	checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
	159	+	checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
160	160
161	161		[[package]]
162	162		name = "der-parser"
⋯ 28 unchanged lines
191	191
192	192		[[package]]
193	193		name = "displaydoc"
194		-	version = "0.2.6"
	194	+	version = "0.2.7"
195	195		source = "registry+https://github.com/rust-lang/crates.io-index"
196		-	checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
	196	+	checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
197	197		dependencies = [
198	198		"proc-macro2",
199	199		"quote",
200		-	"syn 2.0.119",
	200	+	"syn 3.0.3",
201	201		]
202	202
203	203		[[package]]
⋯ 31 unchanged lines
235	235
236	236		[[package]]
237	237		name = "find-msvc-tools"
238		-	version = "0.1.9"
	238	+	version = "0.1.10"
239	239		source = "registry+https://github.com/rust-lang/crates.io-index"
240		-	checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
	240	+	checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
241	241
242	242		[[package]]
243	243		name = "futures-core"
244		-	version = "0.3.33"
	244	+	version = "0.3.34"
245	245		source = "registry+https://github.com/rust-lang/crates.io-index"
246		-	checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
	246	+	checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
247	247
248	248		[[package]]
249	249		name = "futures-sink"
250		-	version = "0.3.33"
	250	+	version = "0.3.34"
251	251		source = "registry+https://github.com/rust-lang/crates.io-index"
252		-	checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
	252	+	checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
253	253
254	254		[[package]]
255	255		name = "futures-task"
256		-	version = "0.3.33"
	256	+	version = "0.3.34"
257	257		source = "registry+https://github.com/rust-lang/crates.io-index"
258		-	checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
	258	+	checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
259	259
260	260		[[package]]
261	261		name = "futures-util"
262		-	version = "0.3.33"
	262	+	version = "0.3.34"
263	263		source = "registry+https://github.com/rust-lang/crates.io-index"
264		-	checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
	264	+	checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
265	265		dependencies = [
266	266		"futures-core",
267	267		"futures-sink",
⋯ 27 unchanged lines
295	295
296	296		[[package]]
297	297		name = "http"
298		-	version = "1.4.2"
	298	+	version = "1.5.0"
299	299		source = "registry+https://github.com/rust-lang/crates.io-index"
300		-	checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
	300	+	checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
301	301		dependencies = [
302	302		"bytes",
303	303		"itoa",
⋯ 7 unchanged lines
311	311
312	312		[[package]]
313	313		name = "hybrid-array"
314		-	version = "0.4.13"
	314	+	version = "0.4.14"
315	315		source = "registry+https://github.com/rust-lang/crates.io-index"
316		-	checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
	316	+	checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
317	317		dependencies = [
318	318		"typenum",
319	319		]
⋯ 91 unchanged lines
411	411
412	412		[[package]]
413	413		name = "num-integer"
414		-	version = "0.1.46"
	414	+	version = "0.1.47"
415	415		source = "registry+https://github.com/rust-lang/crates.io-index"
416		-	checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
	416	+	checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
417	417		dependencies = [
418	418		"num-traits",
419	419		]
⋯ 108 unchanged lines
528	528
529	529		[[package]]
530	530		name = "rcgen"
531		-	version = "0.14.8"
	531	+	version = "0.14.9"
532	532		source = "registry+https://github.com/rust-lang/crates.io-index"
533		-	checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
	533	+	checksum = "091e7a8e7d86e6feb87a27ce8e2cba29d49eff9507afeebefab7eeb2ca667fb4"
534	534		dependencies = [
535	535		"pem",
536	536		"ring",
⋯ 41 unchanged lines
578	578
579	579		[[package]]
580	580		name = "rustls"
581		-	version = "0.23.42"
	581	+	version = "0.23.43"
582	582		source = "registry+https://github.com/rust-lang/crates.io-index"
583		-	checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
	583	+	checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
584	584		dependencies = [
585	585		"log",
586	586		"once_cell",
⋯ 15 unchanged lines
602	602
603	603		[[package]]
604	604		name = "rustls-webpki"
605		-	version = "0.103.13"
	605	+	version = "0.103.14"
606	606		source = "registry+https://github.com/rust-lang/crates.io-index"
607		-	checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
	607	+	checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
608	608		dependencies = [
609	609		"ring",
610	610		"rustls-pki-types",
⋯ 45 unchanged lines
656	656
657	657		[[package]]
658	658		name = "serial2"
659		-	version = "0.2.37"
	659	+	version = "0.2.38"
660	660		source = "registry+https://github.com/rust-lang/crates.io-index"
661		-	checksum = "9eb6ea5562eeaed6936b8b54e086aa0f88b9e5b1bef45beb038e2519fa1185b1"
	661	+	checksum = "b16809bc35793b19ce4e0c53924bc0dce3937f15487997cfdaed936004180730"
662	662		dependencies = [
663	663		"cfg-if",
664	664		"libc",
⋯ 151 unchanged lines
816	816
817	817		[[package]]
818	818		name = "thiserror"
819		-	version = "2.0.19"
	819	+	version = "2.0.20"
820	820		source = "registry+https://github.com/rust-lang/crates.io-index"
821		-	checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
	821	+	checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
822	822		dependencies = [
823		-	"thiserror-impl 2.0.19",
	823	+	"thiserror-impl 2.0.20",
824	824		]
825	825
826	826		[[package]]
⋯ 9 unchanged lines
836	836
837	837		[[package]]
838	838		name = "thiserror-impl"
839		-	version = "2.0.19"
	839	+	version = "2.0.20"
840	840		source = "registry+https://github.com/rust-lang/crates.io-index"
841		-	checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
	841	+	checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
842	842		dependencies = [
843	843		"proc-macro2",
844	844		"quote",
⋯ 2 unchanged lines
847	847
848	848		[[package]]
849	849		name = "time"
850		-	version = "0.3.54"
	850	+	version = "0.3.55"
851	851		source = "registry+https://github.com/rust-lang/crates.io-index"
852		-	checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
	852	+	checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
853	853		dependencies = [
854	854		"deranged",
855	855		"num-conv",
⋯ 37 unchanged lines
893	893
894	894		[[package]]
895	895		name = "tokio-macros"
896		-	version = "2.7.1"
	896	+	version = "2.7.2"
897	897		source = "registry+https://github.com/rust-lang/crates.io-index"
898		-	checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
	898	+	checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
899	899		dependencies = [
900	900		"proc-macro2",
901	901		"quote",
902		-	"syn 2.0.119",
	902	+	"syn 3.0.3",
903	903		]
904	904
905	905		[[package]]
⋯ 31 unchanged lines
937	937		"log",
938	938		"rand",
939	939		"sha1",
940		-	"thiserror 2.0.19",
	940	+	"thiserror 2.0.20",
941	941		]
942	942
943	943		[[package]]
⋯ 153 unchanged lines
1097	1097		"oid-registry",
1098	1098		"ring",
1099	1099		"rusticata-macros",
1100		-	"thiserror 2.0.19",
	1100	+	"thiserror 2.0.20",
1101	1101		"time",
1102	1102		]
1103	1103
⋯ 21 unchanged lines

1	+	//! Picking up a listening socket that someone else already bound.
2	+	//!
3	+	//! systemd's socket activation lets the socket outlive the daemon: systemd
4	+	//! holds `127.0.0.1:7681` open from login, and only execs `termbridge serve`
5	+	//! when the sidebar actually connects. Combined with `--idle-timeout` the
6	+	//! daemon then exits once the last client goes away, and the next connection
7	+	//! starts a fresh one.
8	+	//!
9	+	//! That is only safe because tmux, not this process, is the persistence layer.
10	+	//! Sessions survive the daemon exiting, so "no clients" really is "nothing to
11	+	//! keep alive".
12	+
13	+	use std::net::TcpListener;
14	+
15	+	/// The first fd systemd passes. Defined by the protocol, not by us.
16	+	const LISTEN_FDS_START: i32 = 3;
17	+
18	+	/// Take the listener systemd passed us, if this process was socket-activated.
19	+	///
20	+	/// `Ok(None)` means "started normally, bind your own socket". An `Err` means we
21	+	/// were activated but the handoff was wrong, which must not fall back to
22	+	/// binding: the port is already owned by systemd and the bind would fail (or,
23	+	/// worse, succeed on a different port and leave the sidebar talking to nobody).
24	+	pub fn systemd_listener() -> std::io::Result<Option<TcpListener>> {
25	+	let Some(fds) = listen_fds()? else {
26	+	return Ok(None);
27	+	};
28	+	if fds != 1 {
29	+	return Err(err(format!(
30	+	"systemd passed {fds} sockets, expected exactly 1 — check ListenStream in termbridge.socket"
31	+	)));
32	+	}
33	+
34	+	// Safe to own fd 3: the LISTEN_PID check below/above proved these variables
35	+	// were meant for this process, and nothing else in the daemon touches it.
36	+	let listener = unsafe {
37	+	use std::os::fd::FromRawFd;
38	+	TcpListener::from_raw_fd(LISTEN_FDS_START)
39	+	};
40	+
41	+	// Same invariant the self-bound path asserts. A unit file with
42	+	// `ListenStream=0.0.0.0:7681` would otherwise silently expose a shell to
43	+	// the network, and the unit is a file the user can edit.
44	+	let addr = listener.local_addr()?;
45	+	if !addr.ip().is_loopback() {
46	+	return Err(err(format!(
47	+	"refusing the socket systemd passed: {addr} is not loopback"
48	+	)));
49	+	}
50	+
51	+	listener.set_nonblocking(true)?;
52	+	Ok(Some(listener))
53	+	}
54	+
55	+	/// `$LISTEN_FDS`, but only if `$LISTEN_PID` says the variables are ours.
56	+	///
57	+	/// The check matters because these variables are inherited by children. Without
58	+	/// it, a shell spawned inside the pty would look socket-activated to any
59	+	/// termbridge it ran.
60	+	fn listen_fds() -> std::io::Result<Option<usize>> {
61	+	let Ok(pid) = std::env::var("LISTEN_PID") else {
62	+	return Ok(None);
63	+	};
64	+	let fds = std::env::var("LISTEN_FDS").unwrap_or_default();
65	+	// Clear before anything can fork: the pty spawns a shell, and these must
66	+	// not be part of its environment. Called from startup, single-threaded,
67	+	// before any other thread can be reading the environment.
68	+	unsafe {
69	+	std::env::remove_var("LISTEN_PID");
70	+	std::env::remove_var("LISTEN_FDS");
71	+	std::env::remove_var("LISTEN_FDNAMES");
72	+	}
73	+
74	+	if pid.trim().parse::<u32>().ok() != Some(std::process::id()) {
75	+	return Ok(None);
76	+	}
77	+	match fds.trim().parse::<usize>() {
78	+	Ok(n) => Ok(Some(n)),
79	+	Err(_) => Err(err(format!("LISTEN_PID is ours but LISTEN_FDS={fds:?}"))),
80	+	}
81	+	}
82	+
83	+	fn err(msg: String) -> std::io::Error {
84	+	std::io::Error::new(std::io::ErrorKind::InvalidInput, msg)
85	+	}
86	+
87	+	#[cfg(test)]
88	+	mod tests {
89	+	use super::*;
90	+
91	+	// These mutate process-global environment, so they share one test to avoid
92	+	// racing each other under the default multi-threaded harness.
93	+	#[test]
94	+	fn env_handshake() {
95	+	// SAFETY (all of these): the harness runs this test alone in its
96	+	// process for the same reason the assertions below are batched.
97	+	unsafe { std::env::remove_var("LISTEN_PID") };
98	+	assert!(
99	+	listen_fds().unwrap().is_none(),
100	+	"no LISTEN_PID: not activated"
101	+	);
102	+
103	+	// Addressed to some other process: ignored, and consumed so it cannot
104	+	// be inherited further.
105	+	unsafe {
106	+	std::env::set_var("LISTEN_PID", "1");
107	+	std::env::set_var("LISTEN_FDS", "1");
108	+	}
109	+	assert!(
110	+	listen_fds().unwrap().is_none(),
111	+	"LISTEN_PID for another pid"
112	+	);
113	+	assert!(std::env::var("LISTEN_PID").is_err(), "consumed anyway");
114	+	assert!(std::env::var("LISTEN_FDS").is_err(), "consumed anyway");
115	+
116	+	unsafe {
117	+	std::env::set_var("LISTEN_PID", std::process::id().to_string());
118	+	std::env::set_var("LISTEN_FDS", "2");
119	+	}
120	+	assert_eq!(listen_fds().unwrap(), Some(2));
121	+
122	+	unsafe {
123	+	std::env::set_var("LISTEN_PID", std::process::id().to_string());
124	+	std::env::set_var("LISTEN_FDS", "not-a-number");
125	+	}
126	+	assert!(listen_fds().is_err(), "ours but malformed is an error");
127	+	}
128	+	}

⋯ 72 unchanged lines
73	73		pub updated: u64,
74	74		}
75	75
	76	+	impl Record {
	77	+	/// Seconds since the last hook event. Saturating, so a record written
	78	+	/// before a clock adjustment reads as brand new rather than ancient.
	79	+	pub fn age(&self) -> u64 {
	80	+	now().saturating_sub(self.updated)
	81	+	}
	82	+	}
	83	+
76	84		pub fn dir() -> PathBuf {
77	85		crate::paths::config_dir().join("agents")
78	86		}
⋯ 26 unchanged lines
105	113		map
106	114		}
107	115
108		-	fn now() -> u64 {
	116	+	pub fn now() -> u64 {
109	117		std::time::SystemTime::now()
110	118		.duration_since(std::time::UNIX_EPOCH)
111	119		.map(\|d\| d.as_secs())
⋯ 215 unchanged lines
327	335		"session_id": "a", "hook_event_name": "SessionStart", "cwd": "/tmp/p",
328	336		}));
329	337		assert_eq!(read_all().len(), 1);
330		-	assert!(event(serde_json::json!({
331		-	"session_id": "a", "hook_event_name": "SessionEnd", "reason": "clear",
332		-	}))
333		-	.is_none());
	338	+	assert!(
	339	+	event(serde_json::json!({
	340	+	"session_id": "a", "hook_event_name": "SessionEnd", "reason": "clear",
	341	+	}))
	342	+	.is_none()
	343	+	);
334	344		assert!(read_all().is_empty());
335	345		});
336	346		}
⋯ 2 unchanged lines
339	349		fn unknown_events_and_ids_are_ignored() {
340	350		with_temp_dir(\|\| {
341	351		assert!(event(serde_json::json!({"hook_event_name": "Stop"})).is_none());
342		-	assert!(event(serde_json::json!({"session_id": "a", "hook_event_name": "Wat"})).is_none());
	352	+	assert!(
	353	+	event(serde_json::json!({"session_id": "a", "hook_event_name": "Wat"})).is_none()
	354	+	);
343	355		assert!(read_all().is_empty());
344	356		});
345	357		}
⋯ 7 unchanged lines

⋯ 24 unchanged lines
25	25		use std::sync::Arc;
26	26
27	27		use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
28		-	use tokio::sync::{mpsc, oneshot, Mutex};
	28	+	use tokio::sync::{Mutex, mpsc, oneshot};
29	29
30	30		/// A `%`-prefixed line tmux sent us unprompted, verbatim.
31	31		pub type Notification = String;
⋯ 47 unchanged lines
79	79		tokio::spawn(async move {
80	80		while let Some((line, reply)) = jobs_rx.recv().await {
81	81		queue.lock().await.push_back(reply);
82		-	if stdin.write_all(format!("{line}\n").as_bytes()).await.is_err()
	82	+	if stdin
	83	+	.write_all(format!("{line}\n").as_bytes())
	84	+	.await
	85	+	.is_err()
83	86		\|\| stdin.flush().await.is_err()
84	87		{
85	88		break;
⋯ 134 unchanged lines

1	+	//! `termbridge install` — hand the daemon to the service manager so nobody has
2	+	//! to remember to start it.
3	+	//!
4	+	//! On Linux this is socket activation: systemd binds 127.0.0.1:7681 at login
5	+	//! and starts the daemon on the first connection, so the sidebar just works
6	+	//! from a cold boot with no process running at rest. See [`crate::activation`].
7	+	//!
8	+	//! macOS gets a plain login agent instead. launchd can do socket activation
9	+	//! too, but only through `launch_activate_socket(3)`, and shipping untested
10	+	//! FFI would be worse than an idle process.
11	+
12	+	use std::io::Write;
13	+	use std::path::{Path, PathBuf};
14	+	use std::process::Command;
15	+
16	+	/// Seconds of no clients before an activated daemon exits. Long enough that
17	+	/// closing the sidebar for a moment doesn't churn the process, short enough
18	+	/// that a forgotten browser tab doesn't pin a pty server all week.
19	+	const DEFAULT_IDLE: u64 = 900;
20	+
21	+	pub struct Options {
22	+	pub port: u16,
23	+	pub idle_secs: u64,
24	+	pub session: Option<String>,
25	+	}
26	+
27	+	impl Default for Options {
28	+	fn default() -> Self {
29	+	Options {
30	+	port: crate::DEFAULT_PORT,
31	+	idle_secs: DEFAULT_IDLE,
32	+	session: None,
33	+	}
34	+	}
35	+	}
36	+
37	+	pub fn install(opts: &Options) -> std::io::Result<()> {
38	+	let exe = exe_path()?;
39	+	if cfg!(target_os = "macos") {
40	+	launchd_install(&exe, opts)
41	+	} else {
42	+	systemd_install(&exe, opts)
43	+	}
44	+	}
45	+
46	+	pub fn uninstall() -> std::io::Result<()> {
47	+	if cfg!(target_os = "macos") {
48	+	launchd_uninstall()
49	+	} else {
50	+	systemd_uninstall()
51	+	}
52	+	}
53	+
54	+	/// `termbridge reload` — put the daemon that is running now out, so the next
55	+	/// connection starts the binary that is on disk now.
56	+	///
57	+	/// The update path after a rebuild. `install` already does this as a side
58	+	/// effect, but it also rewrites the unit files from the flags it was given, so
59	+	/// re-running it to pick up a new binary quietly resets an idle timeout or a
60	+	/// pinned session that was set once and forgotten. This touches no
61	+	/// configuration: same units, same options, new process.
62	+	///
63	+	/// What it does not restart is tmux. The sessions, their windows and
64	+	/// everything running in them belong to the tmux server, which this daemon only
65	+	/// attaches to — so a reload drops the sidebar's socket for as long as it takes
66	+	/// the browser to reconnect, and loses nothing else.
67	+	pub fn reload() -> std::io::Result<()> {
68	+	if cfg!(target_os = "macos") {
69	+	launchd_reload()
70	+	} else {
71	+	systemd_reload()
72	+	}
73	+	}
74	+
75	+	/// Resolved, absolute, and symlink-free: the unit file outlives this shell, so
76	+	/// a relative `./target/release/termbridge` in it would break the moment the
77	+	/// user cd'd somewhere else.
78	+	fn exe_path() -> std::io::Result<PathBuf> {
79	+	let exe = std::env::current_exe()?;
80	+	Ok(std::fs::canonicalize(&exe).unwrap_or(exe))
81	+	}
82	+
83	+	// ---------------------------------------------------------------------------
84	+	// systemd
85	+	// ---------------------------------------------------------------------------
86	+
87	+	pub const SOCKET_UNIT: &str = "termbridge.socket";
88	+	pub const SERVICE_UNIT: &str = "termbridge.service";
89	+
90	+	fn home() -> PathBuf {
91	+	std::env::var_os("HOME")
92	+	.map(PathBuf::from)
93	+	.unwrap_or_default()
94	+	}
95	+
96	+	fn systemd_unit_dir() -> PathBuf {
97	+	match std::env::var_os("XDG_CONFIG_HOME") {
98	+	Some(x) if !x.is_empty() => PathBuf::from(x),
99	+	_ => home().join(".config"),
100	+	}
101	+	.join("systemd/user")
102	+	}
103	+
104	+	pub fn socket_unit(port: u16) -> String {
105	+	format!(
106	+	"# Written by `termbridge install`. Safe to edit; re-running overwrites it.\n\
107	+	[Unit]\n\
108	+	Description=termbridge terminal bridge socket\n\
109	+	Documentation=https://github.com/collin/terminal\n\
110	+	\n\
111	+	[Socket]\n\
112	+	# Loopback only. The daemon hands out shell access and refuses to serve\n\
113	+	# anything else, so widening this just breaks startup.\n\
114	+	ListenStream=127.0.0.1:{port}\n\
115	+	# One daemon for all connections, not one process per connection.\n\
116	+	Accept=no\n\
117	+	\n\
118	+	[Install]\n\
119	+	WantedBy=sockets.target\n"
120	+	)
121	+	}
122	+
123	+	pub fn service_unit(exe: &Path, opts: &Options) -> String {
124	+	let session = match &opts.session {
125	+	Some(s) => format!(" --session {s}"),
126	+	None => String::new(),
127	+	};
128	+	format!(
129	+	"# Written by `termbridge install`. Safe to edit; re-running overwrites it.\n\
130	+	[Unit]\n\
131	+	Description=termbridge terminal bridge for the browser sidebar\n\
132	+	Requires={SOCKET_UNIT}\n\
133	+	After={SOCKET_UNIT}\n\
134	+	\n\
135	+	[Service]\n\
136	+	ExecStart={exe} serve --systemd-socket --idle-timeout {idle}{session}\n\
137	+	# The daemon exits on its own once no sidebar has been connected for\n\
138	+	# --idle-timeout. tmux keeps the sessions, so that loses nothing, and\n\
139	+	# the socket unit starts us again on the next connection.\n\
140	+	Restart=no\n\
141	+	SuccessExitStatus=0\n\
142	+	# Stopping this unit must stop this daemon and nothing else. On a\n\
143	+	# machine with no tmux server running, we are what starts one, and a\n\
144	+	# process forked from here keeps this cgroup for life — reparenting to\n\
145	+	# systemd when tmux daemonises does not move it out. So under the\n\
146	+	# default KillMode=control-group, `termbridge reload` would signal the\n\
147	+	# user's tmux server and every pane in it, which is the one thing this\n\
148	+	# daemon promises never to touch.\n\
149	+	KillMode=mixed\n",
150	+	exe = exe.display(),
151	+	idle = opts.idle_secs,
152	+	)
153	+	}
154	+
155	+	fn systemd_install(exe: &Path, opts: &Options) -> std::io::Result<()> {
156	+	let dir = systemd_unit_dir();
157	+	std::fs::create_dir_all(&dir)?;
158	+	write_file(&dir.join(SOCKET_UNIT), &socket_unit(opts.port))?;
159	+	write_file(&dir.join(SERVICE_UNIT), &service_unit(exe, opts))?;
160	+	println!("wrote {}/{{{SOCKET_UNIT},{SERVICE_UNIT}}}", dir.display());
161	+
162	+	systemctl(&["daemon-reload"])?;
163	+	// The service is deliberately not enabled: enabling the socket is what
164	+	// makes the daemon on-demand. Starting the service directly would defeat
165	+	// the point and, worse, race the socket for the port.
166	+	systemctl(&["enable", SOCKET_UNIT])?;
167	+
168	+	// Re-running install has to work, because that is the update path: rebuild
169	+	// the binary, run install, done. Two things make that awkward.
170	+	//
171	+	// `enable --now` is a no-op on an already-active socket, so it would leave
172	+	// the old configuration listening while systemd logs "Unit configuration
173	+	// changed while unit was running ... Unit not functional until restarted"
174	+	// and quietly stops accepting. Only an explicit restart re-reads it.
175	+	//
176	+	// And the restart has to come after the daemon is gone, or the new socket
177	+	// cannot bind the port the old daemon is still holding.
178	+	let _ = systemctl(&["stop", SERVICE_UNIT]);
179	+	systemctl(&["restart", SOCKET_UNIT])?;
180	+
181	+	// A systemd user service inherits the manager's environment, not a login
182	+	// shell's. Without this, PATH can be missing whatever the user added in
183	+	// their profile, and the daemon reports "tmux not found" while `tmux` works
184	+	// fine in every terminal they have open.
185	+	let _ = systemctl(&["import-environment", "PATH"]);
186	+
187	+	println!(
188	+	"\nsocket-activated on 127.0.0.1:{port}. Nothing is running yet — the first\n\
189	+	sidebar connection starts the daemon, and it exits {idle}s after the last\n\
190	+	one disconnects. tmux keeps your sessions across that.\n",
191	+	port = opts.port,
192	+	idle = opts.idle_secs,
193	+	);
194	+	println!(" status: systemctl --user status {SERVICE_UNIT}");
195	+	println!(" logs: journalctl --user -u {SERVICE_UNIT} -f");
196	+	println!(" remove: termbridge uninstall");
197	+	Ok(())
198	+	}
199	+
200	+	fn systemd_uninstall() -> std::io::Result<()> {
201	+	let _ = systemctl(&["disable", "--now", SOCKET_UNIT]);
202	+	let _ = systemctl(&["stop", SERVICE_UNIT]);
203	+	let dir = systemd_unit_dir();
204	+	for unit in [SOCKET_UNIT, SERVICE_UNIT] {
205	+	let path = dir.join(unit);
206	+	match std::fs::remove_file(&path) {
207	+	Ok(()) => println!("removed {}", path.display()),
208	+	Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
209	+	Err(e) => return Err(e),
210	+	}
211	+	}
212	+	let _ = systemctl(&["daemon-reload"]);
213	+	println!("\nthe daemon is no longer started automatically; `termbridge serve` still works.");
214	+	Ok(())
215	+	}
216	+
217	+	fn systemd_reload() -> std::io::Result<()> {
218	+	let dir = systemd_unit_dir();
219	+	if !dir.join(SOCKET_UNIT).exists() {
220	+	return Err(std::io::Error::other(format!(
221	+	"no {SOCKET_UNIT} in {} — run `termbridge install` first, or restart \
222	+	your own `termbridge serve` by hand",
223	+	dir.display()
224	+	)));
225	+	}
226	+
227	+	// A unit edited by hand since login is a unit systemd is still holding the
228	+	// old text of, and the restart below would put that old text back.
229	+	systemctl(&["daemon-reload"])?;
230	+
231	+	// Stop before restarting the socket, for the reason `install` documents:
232	+	// the new listener cannot bind a port the old daemon is still holding.
233	+	// Ignored rather than checked — "it was not running" is the normal case
234	+	// here, and it is the state we wanted anyway.
235	+	let _ = systemctl(&["stop", SERVICE_UNIT]);
236	+	systemctl(&["restart", SOCKET_UNIT])?;
237	+	let _ = systemctl(&["import-environment", "PATH"]);
238	+
239	+	println!(
240	+	"daemon stopped and the socket is listening again. The next sidebar\n\
241	+	connection starts the current binary; your tmux sessions are untouched."
242	+	);
243	+	Ok(())
244	+	}
245	+
246	+	fn launchd_reload() -> std::io::Result<()> {
247	+	let path = launchd_plist_path();
248	+	if !path.exists() {
249	+	return Err(std::io::Error::other(format!(
250	+	"no {} — run `termbridge install` first, or restart your own \
251	+	`termbridge serve` by hand",
252	+	path.display()
253	+	)));
254	+	}
255	+	// `kickstart -k` kills the running agent and starts it again from the plist
256	+	// already loaded, which is what a reload is. No bootout/bootstrap pair: that
257	+	// would re-read a plist this command has no business rewriting.
258	+	let target = format!("gui/{}/{LAUNCHD_LABEL}", uid());
259	+	let status = Command::new("launchctl")
260	+	.args(["kickstart", "-k", &target])
261	+	.status()?;
262	+	if !status.success() {
263	+	return Err(std::io::Error::other(format!(
264	+	"launchctl kickstart -k {target} failed ({status})"
265	+	)));
266	+	}
267	+	println!("daemon restarted; your tmux sessions are untouched.");
268	+	Ok(())
269	+	}
270	+
271	+	fn systemctl(args: &[&str]) -> std::io::Result<()> {
272	+	let status = Command::new("systemctl")
273	+	.arg("--user")
274	+	.args(args)
275	+	.status()
276	+	.map_err(\|e\| {
277	+	std::io::Error::new(
278	+	e.kind(),
279	+	format!("could not run systemctl --user {}: {e}", args.join(" ")),
280	+	)
281	+	})?;
282	+	if !status.success() {
283	+	return Err(std::io::Error::other(format!(
284	+	"systemctl --user {} failed ({status})",
285	+	args.join(" ")
286	+	)));
287	+	}
288	+	Ok(())
289	+	}
290	+
291	+	// ---------------------------------------------------------------------------
292	+	// launchd
293	+	// ---------------------------------------------------------------------------
294	+
295	+	pub const LAUNCHD_LABEL: &str = "com.termbridge.daemon";
296	+
297	+	fn launchd_plist_path() -> PathBuf {
298	+	home().join(format!("Library/LaunchAgents/{LAUNCHD_LABEL}.plist"))
299	+	}
300	+
301	+	pub fn launchd_plist(exe: &Path, opts: &Options) -> String {
302	+	let mut args = vec![
303	+	exe.display().to_string(),
304	+	"serve".into(),
305	+	"--port".into(),
306	+	opts.port.to_string(),
307	+	];
308	+	if let Some(s) = &opts.session {
309	+	args.push("--session".into());
310	+	args.push(s.clone());
311	+	}
312	+	let args: String = args
313	+	.iter()
314	+	.map(\|a\| format!(" <string>{}</string>\n", xml_escape(a)))
315	+	.collect();
316	+	let log = crate::paths::config_dir().join("daemon.log");
317	+	format!(
318	+	"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\
319	+	<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n\
320	+	<plist version=\"1.0\"><dict>\n\
321	+	\x20 <key>Label</key><string>{LAUNCHD_LABEL}</string>\n\
322	+	\x20 <key>ProgramArguments</key><array>\n{args} </array>\n\
323	+	\x20 <key>RunAtLoad</key><true/>\n\
324	+	\x20 <key>KeepAlive</key><true/>\n\
325	+	\x20 <key>StandardOutPath</key><string>{log}</string>\n\
326	+	\x20 <key>StandardErrorPath</key><string>{log}</string>\n\
327	+	</dict></plist>\n",
328	+	log = xml_escape(&log.display().to_string()),
329	+	)
330	+	}
331	+
332	+	fn launchd_install(exe: &Path, opts: &Options) -> std::io::Result<()> {
333	+	let path = launchd_plist_path();
334	+	if let Some(parent) = path.parent() {
335	+	std::fs::create_dir_all(parent)?;
336	+	}
337	+	write_file(&path, &launchd_plist(exe, opts))?;
338	+	println!("wrote {}", path.display());
339	+
340	+	let target = format!("gui/{}", uid());
341	+	let _ = Command::new("launchctl")
342	+	.args(["bootout", &format!("{target}/{LAUNCHD_LABEL}")])
343	+	.status();
344	+	let status = Command::new("launchctl")
345	+	.args(["bootstrap", &target])
346	+	.arg(&path)
347	+	.status()?;
348	+	if !status.success() {
349	+	return Err(std::io::Error::other(format!(
350	+	"launchctl bootstrap failed ({status})"
351	+	)));
352	+	}
353	+	println!(
354	+	"\nrunning at login on 127.0.0.1:{port}.\n\
355	+	Note: this is a plain login agent, so the daemon stays resident. On-demand\n\
356	+	socket activation is Linux-only for now.\n",
357	+	port = opts.port
358	+	);
359	+	println!(
360	+	" logs: tail -f {}",
361	+	crate::paths::config_dir().join("daemon.log").display()
362	+	);
363	+	println!(" remove: termbridge uninstall");
364	+	Ok(())
365	+	}
366	+
367	+	fn launchd_uninstall() -> std::io::Result<()> {
368	+	let path = launchd_plist_path();
369	+	let _ = Command::new("launchctl")
370	+	.args(["bootout", &format!("gui/{}/{LAUNCHD_LABEL}", uid())])
371	+	.status();
372	+	match std::fs::remove_file(&path) {
373	+	Ok(()) => println!("removed {}", path.display()),
374	+	Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
375	+	Err(e) => return Err(e),
376	+	}
377	+	println!("\nthe daemon is no longer started at login; `termbridge serve` still works.");
378	+	Ok(())
379	+	}
380	+
381	+	/// Shelling out to `id -u` rather than taking a libc dependency for one number
382	+	/// on one platform. Falls back to 501, macOS's first human user.
383	+	fn uid() -> String {
384	+	Command::new("id")
385	+	.arg("-u")
386	+	.output()
387	+	.ok()
388	+	.filter(\|o\| o.status.success())
389	+	.and_then(\|o\| String::from_utf8(o.stdout).ok())
390	+	.map(\|s\| s.trim().to_string())
391	+	.filter(\|s\| !s.is_empty() && s.bytes().all(\|b\| b.is_ascii_digit()))
392	+	.unwrap_or_else(\|\| "501".into())
393	+	}
394	+
395	+	fn xml_escape(s: &str) -> String {
396	+	s.replace('&', "&")
397	+	.replace('<', "<")
398	+	.replace('>', ">")
399	+	}
400	+
401	+	fn write_file(path: &Path, contents: &str) -> std::io::Result<()> {
402	+	let mut f = std::fs::File::create(path)?;
403	+	f.write_all(contents.as_bytes())?;
404	+	Ok(())
405	+	}
406	+
407	+	#[cfg(test)]
408	+	mod tests {
409	+	use super::*;
410	+
411	+	#[test]
412	+	fn socket_unit_is_loopback_only() {
413	+	let unit = socket_unit(7681);
414	+	assert!(unit.contains("ListenStream=127.0.0.1:7681"));
415	+	assert!(unit.contains("WantedBy=sockets.target"));
416	+	}
417	+
418	+	/// The service must ask for the passed socket. Without the flag it would
419	+	/// try to bind the port systemd already owns and fail on every activation.
420	+	#[test]
421	+	fn service_unit_consumes_the_activated_socket() {
422	+	let unit = service_unit(Path::new("/usr/local/bin/termbridge"), &Options::default());
423	+	assert!(unit.contains("ExecStart=/usr/local/bin/termbridge serve --systemd-socket"));
424	+	assert!(unit.contains(&format!("--idle-timeout {DEFAULT_IDLE}")));
425	+	assert!(unit.contains(&format!("Requires={SOCKET_UNIT}")));
426	+	assert!(!unit.contains("--port"), "the socket unit owns the port");
427	+	}
428	+
429	+	#[test]
430	+	fn service_unit_carries_a_pinned_session() {
431	+	let opts = Options {
432	+	session: Some("work".into()),
433	+	..Options::default()
434	+	};
435	+	let unit = service_unit(Path::new("/bin/termbridge"), &opts);
436	+	assert!(unit.contains("--session work"));
437	+	}
438	+
439	+	#[test]
440	+	fn plist_escapes_paths() {
441	+	let opts = Options::default();
442	+	let plist = launchd_plist(Path::new("/tmp/a&b/termbridge"), &opts);
443	+	assert!(plist.contains("<string>/tmp/a&b/termbridge</string>"));
444	+	assert!(plist.contains(LAUNCHD_LABEL));
445	+	}
446	+	}

	1	+	pub mod activation;
1	2		pub mod agents;
2	3		pub mod auth;
3	4		pub mod control;
	5	+	pub mod install;
4	6		pub mod paths;
	7	+	pub mod project;
5	8		pub mod pty;
6	9		pub mod rewind;
	10	+	pub mod server;
	11	+	pub mod ssh;
7	12		pub mod status;
8	13		pub mod tls;
9	14		pub mod window_status;
10		-	pub mod server;
11	15
12	16		pub use server::{Config, Event, Server};
	17	+
	18	+	/// The port the extension dials by default. Lives here because the unit file
	19	+	/// `install` writes has to name the same one the daemon would have bound.
	20	+	pub const DEFAULT_PORT: u16 = 7681;

⋯ 3 unchanged lines
4	4		use termbridge::pty::Profile;
5	5		use termbridge::{Config, Event, Server};
6	6
7		-	const DEFAULT_PORT: u16 = 7681;
	7	+	use termbridge::DEFAULT_PORT;
8	8
9	9		fn usage() -> ! {
10	10		eprintln!(
⋯ 2 unchanged lines
13	13		USAGE:
14	14		termbridge serve [--port N] [--session NAME]
15	15		start the daemon
	16	+	termbridge serve --systemd-socket [--idle-timeout SECS]
	17	+	serve on the socket systemd passed us
	18	+	termbridge install [--port N] [--idle-timeout SECS] [--session NAME]
	19	+	start the daemon on demand, from now on
	20	+	termbridge uninstall stop doing that
	21	+	termbridge reload restart the running daemon (after a rebuild)
16	22		termbridge token print the auth token (paste into extension)
17	23		termbridge token --rotate generate a new token
18	24		termbridge pair <origin> approve an extension origin
⋯ 17 unchanged lines
36	42		async fn main() -> Result<(), Box<dyn std::error::Error>> {
37	43		let args: Vec<String> = std::env::args().skip(1).collect();
38	44		let dir = paths::config_dir();
	45	+	let flag = \|name: &str\| {
	46	+	args.iter()
	47	+	.position(\|a\| a == name)
	48	+	.and_then(\|i\| args.get(i + 1))
	49	+	.cloned()
	50	+	};
39	51
40	52		match args.first().map(String::as_str) {
41	53		Some("serve") => {
42		-	let port = match args.iter().position(\|a\| a == "--port") {
43		-	Some(i) => args
44		-	.get(i + 1)
	54	+	let port = flag("--port")
	55	+	.and_then(\|p\| p.parse().ok())
	56	+	.unwrap_or(DEFAULT_PORT);
	57	+	let session = flag("--session");
	58	+	// 0 disables it, so a unit file can turn the timeout off without
	59	+	// being rewritten into a different shape.
	60	+	let idle = flag("--idle-timeout")
	61	+	.and_then(\|s\| s.parse::<u64>().ok())
	62	+	.filter(\|s\| *s > 0)
	63	+	.map(Duration::from_secs);
	64	+	let listener = if args.iter().any(\|a\| a == "--systemd-socket") {
	65	+	match termbridge::activation::systemd_listener()? {
	66	+	Some(l) => Some(l),
	67	+	None => {
	68	+	eprintln!(
	69	+	"--systemd-socket was passed but no socket arrived. Start this \
	70	+	through termbridge.socket (see `termbridge install`), not directly."
	71	+	);
	72	+	std::process::exit(2);
	73	+	}
	74	+	}
	75	+	} else {
	76	+	None
	77	+	};
	78	+	serve(port, session, idle, listener).await
	79	+	}
	80	+	Some("install") => {
	81	+	let opts = termbridge::install::Options {
	82	+	port: flag("--port")
45	83		.and_then(\|p\| p.parse().ok())
46	84		.unwrap_or(DEFAULT_PORT),
47		-	None => DEFAULT_PORT,
	85	+	idle_secs: flag("--idle-timeout")
	86	+	.and_then(\|s\| s.parse().ok())
	87	+	.unwrap_or(termbridge::install::Options::default().idle_secs),
	88	+	session: flag("--session"),
48	89		};
49		-	let session = args
50		-	.iter()
51		-	.position(\|a\| a == "--session")
52		-	.and_then(\|i\| args.get(i + 1))
53		-	.cloned();
54		-	serve(port, session).await
	90	+	termbridge::install::install(&opts)?;
	91	+	Ok(())
	92	+	}
	93	+	Some("uninstall") => {
	94	+	termbridge::install::uninstall()?;
	95	+	Ok(())
	96	+	}
	97	+	// Deliberately takes no flags. Everything `install` accepts is written
	98	+	// into the unit file, and a reload that quietly rewrote it would be an
	99	+	// install under another name.
	100	+	Some("reload") => {
	101	+	termbridge::install::reload()?;
	102	+	Ok(())
55	103		}
56	104		Some("token") => {
57	105		let token = if args.iter().any(\|a\| a == "--rotate") {
⋯ 29 unchanged lines
87	135		} else {
88	136		termbridge::tls::load_or_create(&dir)?
89	137		};
90		-	println!("certificate: {}", dir.join(termbridge::tls::CERT_FILE).display());
91		-	println!("private key: {}", dir.join(termbridge::tls::KEY_FILE).display());
	138	+	println!(
	139	+	"certificate: {}",
	140	+	dir.join(termbridge::tls::CERT_FILE).display()
	141	+	);
	142	+	println!(
	143	+	"private key: {}",
	144	+	dir.join(termbridge::tls::KEY_FILE).display()
	145	+	);
92	146		println!("SHA-256: {}", id.fingerprint);
93	147		Ok(())
94	148		}
⋯ 30 unchanged lines
125	179		Ok(())
126	180		}
127	181		Some("tmux") => {
128		-	println!(
129		-	"Add this to ~/.tmux.conf, then `tmux source-file ~/.tmux.conf`:\n"
130		-	);
	182	+	println!("Add this to ~/.tmux.conf, then `tmux source-file ~/.tmux.conf`:\n");
131	183		print!("{}", termbridge::window_status::tmux_conf());
132	184		println!(
133	185		"\nThe hooks are what set it, so install those first if you haven't:\n\
⋯ 19 unchanged lines
153	205		}
154	206		}
155	207
156		-	async fn serve(port: u16, session: Option<String>) -> Result<(), Box<dyn std::error::Error>> {
	208	+	async fn serve(
	209	+	port: u16,
	210	+	session: Option<String>,
	211	+	idle_timeout: Option<Duration>,
	212	+	activated: Option<std::net::TcpListener>,
	213	+	) -> Result<(), Box<dyn std::error::Error>> {
157	214		let dir = paths::config_dir();
158	215		let token = paths::load_or_create_token(&dir)?;
159	216		let paired = paths::load_paired_origins(&dir);
⋯ 1 unchanged line
161	218		let identity = termbridge::tls::load_or_create(&dir)?;
162	219		let mut config = Config::new(token, paired.clone());
163	220		config.auth_timeout = Duration::from_secs(3);
	221	+	config.idle_timeout = idle_timeout;
164	222		config.tls = Some(termbridge::tls::acceptor(&identity)?);
165	223		let pinned = session
166	224		.as_deref()
⋯ 3 unchanged lines
170	228		.unwrap_or_else(\|\| termbridge::pty::DEFAULT_SESSION.to_string());
171	229		config.default_session = default_session.clone();
172	230		// A pinned --session is a choice; without one, a lone existing session is
173		-	// a better guess than a fresh "browser" beside it.
	231	+	// a better guess than a fresh "default" beside it.
174	232		config.adopt_sole_session = pinned.is_none();
175	233		config.profile = if Profile::tmux_available() {
176	234		Profile::tmux(&default_session)
⋯ 5 unchanged lines
182	240		let profile = config.profile.clone();
183	241		let config_adopts_sole = config.adopt_sole_session && profile.program == "tmux";
184	242
185		-	let mut server = Server::start(config, port).await?;
186		-	println!("termbridge listening on wss://{a} (ws:// also accepted on the same port)", a = server.addr());
	243	+	let mut server = match activated {
	244	+	Some(listener) => Server::from_std(config, listener)?,
	245	+	None => Server::start(config, port).await?,
	246	+	};
	247	+	println!(
	248	+	"termbridge listening on wss://{a} (ws:// also accepted on the same port)",
	249	+	a = server.addr()
	250	+	);
187	251		println!("running: {} {}", profile.program, profile.args.join(" "));
188	252		let existing = termbridge::pty::list_sessions(&profile.tmux_global_args());
189	253		if !existing.is_empty() {
⋯ 25 unchanged lines
215	279		while let Some(event) = server.next_event().await {
216	280		match event {
217	281		Event::Accepted { origin } => println!("[accept] {origin}"),
218		-	Event::Rejected { origin, why, detail } => {
	282	+	// Under socket activation this is the normal way to stop: the
	283	+	// socket unit keeps listening, so the next sidebar connection
	284	+	// starts a fresh daemon and tmux hands it back the same sessions.
	285	+	Event::Idle => {
	286	+	println!(
	287	+	"[idle] no clients for {:?} — exiting",
	288	+	idle_timeout.unwrap_or_default()
	289	+	);
	290	+	break;
	291	+	}
	292	+	Event::Rejected {
	293	+	origin,
	294	+	why,
	295	+	detail,
	296	+	} => {
219	297		let o = origin.unwrap_or_else(\|\| "<none>".into());
220	298		println!("[reject] {o}: {}", why.reason());
221	299		if let Some(d) = detail {
⋯ 29 unchanged lines

⋯ 15 unchanged lines
16	16		Io(io::Error),
17	17		/// The token file is readable by group or other. Refuse rather than
18	18		/// silently authenticate against a world-readable secret.
19		-	TooPermissive { path: PathBuf, mode: u32 },
	19	+	TooPermissive {
	20	+	path: PathBuf,
	21	+	mode: u32,
	22	+	},
20	23		Malformed,
21	24		}
22	25
⋯ 29 unchanged lines
52	55		let base = std::env::var_os("XDG_CONFIG_HOME")
53	56		.map(PathBuf::from)
54	57		.unwrap_or_else(\|\| {
55		-	let home = std::env::var_os("HOME").map(PathBuf::from).unwrap_or_default();
	58	+	let home = std::env::var_os("HOME")
	59	+	.map(PathBuf::from)
	60	+	.unwrap_or_default();
56	61		home.join(".config")
57	62		});
58	63		base.join("termbridge")
⋯ 89 unchanged lines
148	153		.truncate(true)
149	154		.mode(0o600)
150	155		.open(&path)?;
151		-	writeln!(f, "# Origins approved to connect to termbridge. One per line.")?;
	156	+	writeln!(
	157	+	f,
	158	+	"# Origins approved to connect to termbridge. One per line."
	159	+	)?;
152	160		for o in &existing {
153	161		writeln!(f, "{o}")?;
154	162		}
⋯ 13 unchanged lines
168	176		.truncate(true)
169	177		.mode(0o600)
170	178		.open(&path)?;
171		-	writeln!(f, "# Origins approved to connect to termbridge. One per line.")?;
	179	+	writeln!(
	180	+	f,
	181	+	"# Origins approved to connect to termbridge. One per line."
	182	+	)?;
172	183		for o in existing.iter().filter(\|o\| *o != &origin) {
173	184		writeln!(f, "{o}")?;
174	185		}
175	186		Ok(true)
176	187		}
177	188
	189	+	/// Where the throwaway launcher scripts live: the per-user runtime dir when
	190	+	/// there is one (0700 already, and cleared on logout), the temp dir otherwise.
	191	+	/// Either way the subdirectory is made 0700, because on a shared box `/tmp` is
	192	+	/// world-traversable and a prompt is the user's text.
	193	+	fn script_dir() -> PathBuf {
	194	+	let base = std::env::var_os("XDG_RUNTIME_DIR")
	195	+	.map(PathBuf::from)
	196	+	.unwrap_or_else(std::env::temp_dir);
	197	+	base.join("termbridge")
	198	+	}
	199	+
	200	+	/// Write a script that runs `claude` on `prompt`, and return its path.
	201	+	///
	202	+	/// The prompt exists as a file rather than as part of a command line because it
	203	+	/// is arbitrary user text and the command line it would otherwise land in is a
	204	+	/// tmux one — tmux's single quotes have no escape, so there is no way to put
	205	+	/// a quote through them, and its double quotes expand `#()`, which runs a
	206	+	/// shell. A path this daemon generated is the only client text on that line,
	207	+	/// and it is hex.
	208	+	///
	209	+	/// The script drops the shell it came from at the end rather than exiting: a
	210	+	/// window that vanishes the moment Claude does takes the transcript with it.
	211	+	pub fn write_prompt_script(prompt: &str) -> io::Result<PathBuf> {
	212	+	let dir = script_dir();
	213	+	fs::create_dir_all(&dir)?;
	214	+	fs::set_permissions(&dir, fs::Permissions::from_mode(0o700))?;
	215	+	let path = dir.join(format!("prompt-{}.sh", random_hex(8)));
	216	+	let mut f = fs::OpenOptions::new()
	217	+	.write(true)
	218	+	.create_new(true)
	219	+	.mode(0o700)
	220	+	.open(&path)?;
	221	+	// Single quotes, with the one escape sh allows: end the quote, an escaped
	222	+	// quote, start it again. Nothing else in the prompt is special inside them.
	223	+	let quoted = prompt.replace('\'', r"'\''");
	224	+	write!(
	225	+	f,
	226	+	"#!/bin/sh\n\
	227	+	prompt='{quoted}'\n\
	228	+	# Unlinked while the shell still holds it open, so this reads on.\n\
	229	+	rm -f -- \"$0\"\n\
	230	+	claude \"$prompt\"\n\
	231	+	exec \"${{SHELL:-/bin/sh}}\"\n"
	232	+	)?;
	233	+	Ok(path)
	234	+	}
	235	+
	236	+	/// Write a script that runs `command` in the user's shell, and return its path.
	237	+	///
	238	+	/// A file for the same reason [`write_prompt_script`] is one: the text is the
	239	+	/// user's, and the line it would otherwise be spliced into is tmux's, which
	240	+	/// cannot be escaped into safely.
	241	+	///
	242	+	/// The command runs under `$SHELL -c` rather than `/bin/sh -c` because the box
	243	+	/// it was typed into looks like the shell in the pane beside it — the aliases,
	244	+	/// functions and syntax that work there are what someone types here, and for a
	245	+	/// fish user `sh` would reject half of them.
	246	+	///
	247	+	/// Then the shell is dropped into interactively rather than exited, which is
	248	+	/// the whole point of running it here instead of in a scratch window: the
	249	+	/// output stays on screen, in the directory the command ran in, and the pane is
	250	+	/// a shell you can carry on in. A non-zero status is printed first, because the
	251	+	/// prompt that replaces it is not going to say so.
	252	+	pub fn write_command_script(command: &str) -> io::Result<PathBuf> {
	253	+	let dir = script_dir();
	254	+	fs::create_dir_all(&dir)?;
	255	+	fs::set_permissions(&dir, fs::Permissions::from_mode(0o700))?;
	256	+	let path = dir.join(format!("run-{}.sh", random_hex(8)));
	257	+	let mut f = fs::OpenOptions::new()
	258	+	.write(true)
	259	+	.create_new(true)
	260	+	.mode(0o700)
	261	+	.open(&path)?;
	262	+	// The same single-quote escape as the prompt script: end, escaped quote,
	263	+	// start again. Inside them nothing else in the command is special, so what
	264	+	// the shell below is handed is exactly what was typed.
	265	+	let quoted = command.replace('\'', r"'\''");
	266	+	write!(
	267	+	f,
	268	+	"#!/bin/sh\n\
	269	+	cmd='{quoted}'\n\
	270	+	# Unlinked while the shell still holds it open, so this reads on.\n\
	271	+	rm -f -- \"$0\"\n\
	272	+	\"${{SHELL:-/bin/sh}}\" -c \"$cmd\"\n\
	273	+	status=$?\n\
	274	+	[ \"$status\" -eq 0 ] \|\| printf '\\n[exit %s]\\n' \"$status\"\n\
	275	+	exec \"${{SHELL:-/bin/sh}}\"\n"
	276	+	)?;
	277	+	Ok(path)
	278	+	}
	279	+
	280	+	/// Write a script that starts a session's first pane in `dir`, optionally with
	281	+	/// Claude running on `prompt`, and return its path.
	282	+	///
	283	+	/// The directory goes in a file for the reason the prompt and the command do:
	284	+	/// the line it would otherwise be spliced into is a tmux one, and a path is
	285	+	/// allowed to contain a quote. `new-session -c` would be the direct way to say
	286	+	/// this and there is no safe way to write it.
	287	+	///
	288	+	/// `cd` rather than anything cleverer, because what the pane's working
	289	+	/// directory is is what tmux reports as the session's — so every window opened
	290	+	/// in this session afterwards, by the panel's "+" or its `!`, inherits the
	291	+	/// project directory without anything having to remember it.
	292	+	///
	293	+	/// A `cd` that fails does not close the window: it says so and hands over a
	294	+	/// shell, which is the one state from which you can see what went wrong.
	295	+	pub fn write_project_script(dir: &Path, prompt: Option<&str>) -> io::Result<PathBuf> {
	296	+	let dir = dir
	297	+	.to_str()
	298	+	.ok_or_else(\|\| io::Error::new(io::ErrorKind::InvalidInput, "path is not valid UTF-8"))?;
	299	+	let script_dir = script_dir();
	300	+	fs::create_dir_all(&script_dir)?;
	301	+	fs::set_permissions(&script_dir, fs::Permissions::from_mode(0o700))?;
	302	+	let path = script_dir.join(format!("project-{}.sh", random_hex(8)));
	303	+	let mut f = fs::OpenOptions::new()
	304	+	.write(true)
	305	+	.create_new(true)
	306	+	.mode(0o700)
	307	+	.open(&path)?;
	308	+	// The same single-quote escape the two scripts above use: end the quote, an
	309	+	// escaped quote, start it again.
	310	+	let quoted = \|s: &str\| s.replace('\'', r"'\''");
	311	+	write!(
	312	+	f,
	313	+	"#!/bin/sh\n\
	314	+	dir='{}'\n\
	315	+	# Unlinked while the shell still holds it open, so this reads on.\n\
	316	+	rm -f -- \"$0\"\n\
	317	+	cd \"$dir\" \|\| printf '\\ncannot enter %s\\n' \"$dir\"\n",
	318	+	quoted(dir)
	319	+	)?;
	320	+	if let Some(prompt) = prompt {
	321	+	write!(
	322	+	f,
	323	+	"prompt='{}'\n\
	324	+	claude \"$prompt\"\n",
	325	+	quoted(prompt)
	326	+	)?;
	327	+	}
	328	+	writeln!(f, "exec \"${{SHELL:-/bin/sh}}\"")?;
	329	+	Ok(path)
	330	+	}
	331	+
178	332		fn random_hex(n: usize) -> String {
179	333		let mut buf = vec![0u8; n];
180	334		// Straight from the OS CSPRNG. Deliberately not a userspace PRNG — this is
⋯ 9 unchanged lines

1	+	//! Directories, for the omnibar's path rows.
2	+	//!
3	+	//! The panel is a web page: it cannot stat a directory, and the one question it
4	+	//! has to answer before it can offer anything sensible is whether the path in
5	+	//! the box exists yet. So it asks, one directory at a time, and this module is
6	+	//! what answers — the names inside a directory and whether it is there at all.
7	+	//!
8	+	//! Deliberately narrow. Names only, never contents; one directory per question,
9	+	//! never a walk; and nothing outside the directory that was asked about. The
10	+	//! socket is authenticated and the thing on the other end of it is a terminal,
11	+	//! so this is not a privilege boundary — it is a ceiling on the shape of what
12	+	//! can leave the machine by accident.
13	+
14	+	use std::path::{Path, PathBuf};
15	+
16	+	/// The longest path the panel may ask about. Longer than any real one, short
17	+	/// enough that a query cannot be used to push work at the daemon.
18	+	pub const MAX_PATH: usize = 4096;
19	+
20	+	/// The most names returned per directory, each of dirs and files. A source tree
21	+	/// with more entries than this exists; a project directory with more of them
22	+	/// that you would then pick one of by typing does not.
23	+	const MAX_ENTRIES: usize = 300;
24	+
25	+	/// What is at a path.
26	+	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
27	+	pub enum Kind {
28	+	Dir,
29	+	File,
30	+	Missing,
31	+	/// There, or possibly there, and not ours to look at. Deliberately one
32	+	/// answer rather than two: the panel says "cannot read" either way, and
33	+	/// distinguishing them would be reporting on a directory we were refused.
34	+	Denied,
35	+	}
36	+
37	+	impl Kind {
38	+	pub fn as_str(self) -> &'static str {
39	+	match self {
40	+	Kind::Dir => "dir",
41	+	Kind::File => "file",
42	+	Kind::Missing => "missing",
43	+	Kind::Denied => "denied",
44	+	}
45	+	}
46	+	}
47	+
48	+	/// One directory, as the omnibar needs it.
49	+	#[derive(Debug, Clone, PartialEq, Eq)]
50	+	pub struct Listing {
51	+	/// The expanded path. The panel matches this against the working
52	+	/// directories tmux reports, which is how a path you already have a session
53	+	/// on becomes a switch rather than a second session.
54	+	pub path: PathBuf,
55	+	pub kind: Kind,
56	+	/// How many directories `mkdir -p` would have to create to make this one.
57	+	/// Zero when it is already there. The panel says so before you press Enter,
58	+	/// because "create one directory" and "create four" are different answers
59	+	/// to a typo.
60	+	pub creates: usize,
61	+	/// Directory names inside it, sorted, visible ones first — the panel
62	+	/// filters these by what you have typed of the next component.
63	+	pub dirs: Vec<String>,
64	+	/// The other names. Only ever used to say "that is a file": a path whose
65	+	/// last component is one is not somewhere a session can start, and without
66	+	/// this it would look like something to create.
67	+	pub files: Vec<String>,
68	+	}
69	+
70	+	/// `~/Code/foo` as an absolute path, or nothing.
71	+	///
72	+	/// The panel's own rule is that a leading `~` is what makes the box a path at
73	+	/// all, so this is deliberately strict about the rest: absolute or `~`-rooted,
74	+	/// no `.` or `..`, no `~user`. A relative path has no meaning here — there is
75	+	/// no directory for it to be relative to until a session exists, which is
76	+	/// the thing being asked for.
77	+	pub fn expand(raw: &str) -> Option<PathBuf> {
78	+	expand_in(raw, home().as_deref())
79	+	}
80	+
81	+	/// [`expand`] against a given home, which is the half of it worth testing:
82	+	/// `$HOME` is process-wide, and a test that set it would be setting it for
83	+	/// every other test running beside it.
84	+	fn expand_in(raw: &str, home: Option<&Path>) -> Option<PathBuf> {
85	+	let s = raw.trim();
86	+	if s.is_empty() \|\| s.len() > MAX_PATH \|\| s.chars().any(char::is_control) {
87	+	return None;
88	+	}
89	+	let (mut path, rest) = match s.strip_prefix('~') {
90	+	Some("") => (home?.to_path_buf(), ""),
91	+	// `~user` is somebody else's home, which is not ours to guess at: what
92	+	// follows the tilde has to be the separator.
93	+	Some(rest) => (home?.to_path_buf(), rest.strip_prefix('/')?),
94	+	None => (PathBuf::from("/"), s.strip_prefix('/')?),
95	+	};
96	+	for part in rest.split('/') {
97	+	// Empty is a doubled or trailing slash, which is nothing.
98	+	if part.is_empty() {
99	+	continue;
100	+	}
101	+	if part == "." \|\| part == ".." {
102	+	return None;
103	+	}
104	+	path.push(part);
105	+	}
106	+	Some(path)
107	+	}
108	+
109	+	fn home() -> Option<PathBuf> {
110	+	let home = PathBuf::from(std::env::var_os("HOME")?);
111	+	home.is_absolute().then_some(home)
112	+	}
113	+
114	+	/// Answer one question about one directory.
115	+	///
116	+	/// `raw` is what the box holds up to the last `/`, so the entries are the
117	+	/// candidates for the component being typed. Whether the full path exists is
118	+	/// the panel's own arithmetic from `dirs` and `files` — one query per level
119	+	/// typed rather than one per keystroke.
120	+	pub fn list(raw: &str) -> Option<Listing> {
121	+	let mut path = expand(raw)?;
122	+	let (kind, mut dirs, mut files) = match std::fs::metadata(&path) {
123	+	Ok(m) if m.is_dir() => match read_names(&path) {
124	+	Some((d, f)) => (Kind::Dir, d, f),
125	+	None => (Kind::Denied, Vec::new(), Vec::new()),
126	+	},
127	+	Ok(_) => (Kind::File, Vec::new(), Vec::new()),
128	+	Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
129	+	(Kind::Missing, Vec::new(), Vec::new())
130	+	}
131	+	Err(_) => (Kind::Denied, Vec::new(), Vec::new()),
132	+	};
133	+	dirs.truncate(MAX_ENTRIES);
134	+	files.truncate(MAX_ENTRIES);
135	+	// Symlinks resolved, but only for a directory that is there: this is the
136	+	// string the panel matches against the working directories tmux reports,
137	+	// and tmux reports a pane's real one. `~/code` being a link to `~/Code`
138	+	// would otherwise be a session it could not see it already had.
139	+	if kind == Kind::Dir {
140	+	if let Ok(real) = std::fs::canonicalize(&path) {
141	+	path = real;
142	+	}
143	+	}
144	+	Some(Listing {
145	+	creates: missing_ancestors(&path),
146	+	path,
147	+	kind,
148	+	dirs,
149	+	files,
150	+	})
151	+	}
152	+
153	+	/// Names in a directory, split into the ones you can descend into and the rest.
154	+	///
155	+	/// Symlinks are followed for the classification only — a link to a directory
156	+	/// is offered as one, because that is what typing it would land you in. Nothing
157	+	/// is followed to read through it, and an entry whose target cannot be stat'ed
158	+	/// is filed as a file rather than skipped, so a broken link is visible instead
159	+	/// of quietly missing.
160	+	///
161	+	/// Sorted, and hidden names last: a truncated listing should lose `.cache`
162	+	/// before it loses a project.
163	+	fn read_names(dir: &Path) -> Option<(Vec<String>, Vec<String>)> {
164	+	let entries = std::fs::read_dir(dir).ok()?;
165	+	let mut dirs = Vec::new();
166	+	let mut files = Vec::new();
167	+	for entry in entries.flatten() {
168	+	// Not `to_string_lossy`: a name we cannot round-trip is a name the
169	+	// panel cannot send back, and offering it would be offering a path that
170	+	// does not exist.
171	+	let Some(name) = entry.file_name().to_str().map(String::from) else {
172	+	continue;
173	+	};
174	+	let is_dir = entry
175	+	.file_type()
176	+	.ok()
177	+	.map(\|t\| {
178	+	if t.is_symlink() {
179	+	std::fs::metadata(entry.path())
180	+	.map(\|m\| m.is_dir())
181	+	.unwrap_or(false)
182	+	} else {
183	+	t.is_dir()
184	+	}
185	+	})
186	+	.unwrap_or(false);
187	+	if is_dir { &mut dirs } else { &mut files }.push(name);
188	+	}
189	+	for list in [&mut dirs, &mut files] {
190	+	list.sort_by(\|a, b\| {
191	+	let hidden = \|s: &String\| s.starts_with('.');
192	+	hidden(a).cmp(&hidden(b)).then_with(\|\| a.cmp(b))
193	+	});
194	+	}
195	+	Some((dirs, files))
196	+	}
197	+
198	+	/// How many components of `path` do not exist yet.
199	+	fn missing_ancestors(path: &Path) -> usize {
200	+	let mut n = 0;
201	+	for a in path.ancestors() {
202	+	// `exists()` is false for a path we are not allowed to stat, which
203	+	// would overcount. It is a number in a row's subtitle, and the mkdir
204	+	// that follows reports its own failure.
205	+	if a.exists() {
206	+	break;
207	+	}
208	+	n += 1;
209	+	}
210	+	n
211	+	}
212	+
213	+	#[cfg(test)]
214	+	mod tests {
215	+	use super::*;
216	+
217	+	const HOME: &str = "/home/someone";
218	+
219	+	fn home() -> Option<&'static Path> {
220	+	Some(Path::new(HOME))
221	+	}
222	+
223	+	#[test]
224	+	fn expands_tilde_and_absolute_only() {
225	+	let h = PathBuf::from(HOME);
226	+	assert_eq!(expand_in("~", home()), Some(h.clone()));
227	+	assert_eq!(expand_in("~/Code", home()), Some(h.join("Code")));
228	+	assert_eq!(expand_in("~/Code/", home()), Some(h.join("Code")));
229	+	assert_eq!(expand_in("~/Code//foo", home()), Some(h.join("Code/foo")));
230	+	assert_eq!(
231	+	expand_in("/etc/ssh", home()),
232	+	Some(PathBuf::from("/etc/ssh"))
233	+	);
234	+	}
235	+
236	+	#[test]
237	+	fn refuses_anything_that_is_not_a_rooted_path() {
238	+	for bad in [
239	+	"",
240	+	"Code", // relative
241	+	"./Code", // relative
242	+	"~/Code/../../..", // traversal
243	+	"~/..",
244	+	"/etc/../root",
245	+	"~root/x", // another user's home is not ours to expand
246	+	"~/a\nb", // control characters
247	+	] {
248	+	assert_eq!(expand_in(bad, home()), None, "{bad} should not expand");
249	+	}
250	+	assert_eq!(
251	+	expand_in(&format!("~/{}", "a".repeat(MAX_PATH)), home()),
252	+	None
253	+	);
254	+	// No home, no tilde. An absolute path is still fine.
255	+	assert_eq!(expand_in("~/Code", None), None);
256	+	assert!(expand_in("/tmp", None).is_some());
257	+	}
258	+
259	+	#[test]
260	+	fn lists_a_directory_and_says_what_is_missing() {
261	+	let tmp = std::env::temp_dir().join(format!("tb-project-list-{}", std::process::id()));
262	+	let _ = std::fs::remove_dir_all(&tmp);
263	+	std::fs::create_dir_all(tmp.join("alpha")).unwrap();
264	+	std::fs::create_dir_all(tmp.join(".hidden")).unwrap();
265	+	std::fs::write(tmp.join("notes.txt"), "hi").unwrap();
266	+	let at = \|p: &Path\| list(&p.to_string_lossy()).expect("absolute paths expand");
267	+
268	+	let l = at(&tmp);
269	+	assert_eq!(l.kind, Kind::Dir);
270	+	assert_eq!(l.creates, 0);
271	+	// Visible first, hidden after it.
272	+	assert_eq!(l.dirs, ["alpha", ".hidden"]);
273	+	assert_eq!(l.files, ["notes.txt"]);
274	+
275	+	assert_eq!(at(&tmp.join("alpha")).kind, Kind::Dir);
276	+	assert_eq!(at(&tmp.join("notes.txt")).kind, Kind::File);
277	+
278	+	// Three levels of nothing is three directories to make.
279	+	let l = at(&tmp.join("a/b/c"));
280	+	assert_eq!(l.kind, Kind::Missing);
281	+	assert_eq!(l.creates, 3);
282	+	assert!(l.dirs.is_empty());
283	+
284	+	let _ = std::fs::remove_dir_all(&tmp);
285	+	}
286	+	}

⋯ 13 unchanged lines
14	14		use std::path::Path;
15	15		use std::sync::Arc;
16	16
17		-	use tokio_rustls::rustls::pki_types::{CertificateDer, PrivateKeyDer};
18		-	use tokio_rustls::rustls::ServerConfig;
19	17		use tokio_rustls::TlsAcceptor;
	18	+	use tokio_rustls::rustls::ServerConfig;
	19	+	use tokio_rustls::rustls::pki_types::{CertificateDer, PrivateKeyDer};
20	20
21	21		pub const CERT_FILE: &str = "cert.pem";
22	22		pub const KEY_FILE: &str = "key.pem";
⋯ 175 unchanged lines
198	198		fn parse_private_key(pem: &str) -> std::io::Result<PrivateKeyDer<'static>> {
199	199		for (begin, end) in [
200	200		("-----BEGIN PRIVATE KEY-----", "-----END PRIVATE KEY-----"),
201		-	("-----BEGIN EC PRIVATE KEY-----", "-----END EC PRIVATE KEY-----"),
202		-	("-----BEGIN RSA PRIVATE KEY-----", "-----END RSA PRIVATE KEY-----"),
	201	+	(
	202	+	"-----BEGIN EC PRIVATE KEY-----",
	203	+	"-----END EC PRIVATE KEY-----",
	204	+	),
	205	+	(
	206	+	"-----BEGIN RSA PRIVATE KEY-----",
	207	+	"-----END RSA PRIVATE KEY-----",
	208	+	),
203	209		] {
204	210		if let Some(rest) = pem.split(begin).nth(1) {
205	211		if let Some(body) = rest.split(end).next() {
206	212		let b64: String = body.chars().filter(\|c\| !c.is_whitespace()).collect();
207	213		let der = base64_decode(&b64)?;
208	214		return Ok(match begin {
209		-	"-----BEGIN EC PRIVATE KEY-----" => {
210		-	PrivateKeyDer::Sec1(der.into())
211		-	}
	215	+	"-----BEGIN EC PRIVATE KEY-----" => PrivateKeyDer::Sec1(der.into()),
212	216		"-----BEGIN RSA PRIVATE KEY-----" => PrivateKeyDer::Pkcs1(der.into()),
213	217		_ => PrivateKeyDer::Pkcs8(der.into()),
214	218		});
⋯ 5 unchanged lines

⋯ 8 unchanged lines
9	9		"compilerOptions": {
10	10		"lib": ["ES2022", "DOM", "DOM.Iterable"]
11	11		},
12		-	"include": ["sw.js", "picker.js", "lib/shot.js", "types/globals.d.ts", "types/worker.d.ts"]
	12	+	"include": [
	13	+	"sw.js",
	14	+	"picker.js",
	15	+	"lib/shot.js",
	16	+	"lib/split.js",
	17	+	"types/globals.d.ts",
	18	+	"types/worker.d.ts"
	19	+	]
13	20		}

1	+	// Run with: node --test "extension/lib/*.test.js"
2	+	//
3	+	// Chrome's split view is two visible tabs and one `active` flag, so the picker
4	+	// runs in both halves at once. What is checked here is the race that follows:
5	+	// who wins, who gets torn down, and which failures are allowed to end it.
6	+
7	+	const test = require("node:test");
8	+	const assert = require("node:assert");
9	+
10	+	const Split = require("./split.js");
11	+
12	+	/** Tabs whose injected picker is still open, keyed by tab id. */
13	+	const pending = new Map();
14	+
15	+	/**
16	+	* A stand-in for the scripting API. `pick` decides what each tab's injected
17	+	* picker does: a value resolves the pick, null cancels it, an Error rejects the
18	+	* injection, and a promise is awaited so a test can control who wins the race.
19	+	*/
20	+	function fakeApi(pick, log = []) {
21	+	return {
22	+	api: {
23	+	scripting: {
24	+	executeScript({ target, func }) {
25	+	// The cancel injection is a different function than the picker; it is
26	+	// the only one that takes no part in the race.
27	+	if (func.name === "tbCancelPicker") {
28	+	log.push(`cancel:${target.tabId}`);
29	+	const cancelled = pending.get(target.tabId);
30	+	if (cancelled) cancelled(null);
31	+	return Promise.resolve([{ result: undefined }]);
32	+	}
33	+	log.push(`pick:${target.tabId}`);
34	+	const outcome = pick(target.tabId);
35	+	if (outcome instanceof Error) return Promise.reject(outcome);
36	+	if (outcome === "wait") {
37	+	return new Promise((resolve) => {
38	+	pending.set(target.tabId, (v) => resolve([{ result: v }]));
39	+	});
40	+	}

⋯ 14 unchanged lines
15	15		ui: {
16	16		"--bg": "#14161a",
17	17		"--bg-panel": "#1c1f25",
	18	+	"--bg-strip": "#191b21",
18	19		"--bg-input": "#14161a",
19	20		"--border": "#2d3138",
20	21		"--fg": "#d7dae0",
⋯ 40 unchanged lines
61	62		ui: {
62	63		"--bg": "#ffffff",
63	64		"--bg-panel": "#f6f8fa",
	65	+	"--bg-strip": "#e6e9ed",
64	66		"--bg-input": "#ffffff",
65	67		"--border": "#d0d7de",
66	68		"--fg": "#1f2328",
⋯ 61 unchanged lines

⋯ 30 unchanged lines
31	31		}
32	32		}
33	33
34		-	pub const DEFAULT_SESSION: &str = "browser";
	34	+	/// The session the sidebar lands in with nothing configured, and the one the
	35	+	/// panel's "+" puts a new window in when it is not adding to a group.
	36	+	///
	37	+	/// Named for the role rather than for this client: it is where windows go when
	38	+	/// nothing has said otherwise, which is what a user's other tmux sessions are
	39	+	/// not. `--session` overrides it, and a lone pre-existing session is adopted
	40	+	/// ahead of creating this one — see `adopt_sole_session`.
	41	+	pub const DEFAULT_SESSION: &str = "default";
35	42
36	43		/// Session names reach `execvp` as a separate argv element, never a shell, so
37	44		/// metacharacters cannot inject a command. The one real hazard is a leading
⋯ 17 unchanged lines
55	62		Some(s.to_string())
56	63		}
57	64
	65	+	/// The most text the omnibar may hand to a new Claude. Long enough for a
	66	+	/// paragraph pasted into the box, short enough that nothing can push a
	67	+	/// megabyte of it through the socket a keystroke at a time.
	68	+	const MAX_PROMPT: usize = 8192;
	69	+
	70	+	/// A prompt for "send to Claude": any text, minus the bytes that would make it
	71	+	/// something other than text.
	72	+	///
	73	+	/// Deliberately permissive about punctuation, unlike the name validators above
	74	+	/// — a prompt is a sentence, and quotes and semicolons belong in one. It is
	75	+	/// safe to be, because the prompt never reaches a command line: it is written
	76	+	/// to a file, single-quoted, by [`crate::paths::write_prompt_script`]. What is
	77	+	/// rejected is control characters, which would arrive at a terminal as
	78	+	/// something to obey rather than something to read.
	79	+	pub fn valid_prompt(raw: &str) -> Option<String> {
	80	+	let s = raw.trim();
	81	+	if s.is_empty() \|\| s.len() > MAX_PROMPT {
	82	+	return None;
	83	+	}
	84	+	if s.chars().any(\|c\| c.is_control() && c != '\n' && c != '\t') {
	85	+	return None;
	86	+	}
	87	+	Some(s.to_string())
	88	+	}
	89	+
	90	+	/// The most text the omnibar may hand to a shell. A command line is a line,
	91	+	/// not a document; anything past this is a paste that meant to go somewhere
	92	+	/// else.
	93	+	const MAX_COMMAND: usize = 4096;
	94	+
	95	+	/// A shell command for the omnibar's `!` — a line handed to `$SHELL -c`.
	96	+	///
	97	+	/// As permissive about punctuation as [`valid_prompt`], and for the same
	98	+	/// reason: the text is shell source, so pipes, quotes and `&&` are the point of
	99	+	/// it, and it never reaches a tmux command line — it is written to a file,
	100	+	/// single-quoted, by [`crate::paths::write_command_script`].
	101	+	///
	102	+	/// Newlines are rejected where a prompt allows them. The box is one line, the
	103	+	/// text is run as one, and a newline arriving here means something built the
	104	+	/// request by hand.
	105	+	pub fn valid_command(raw: &str) -> Option<String> {
	106	+	let s = raw.trim();
	107	+	if s.is_empty() \|\| s.len() > MAX_COMMAND {
	108	+	return None;
	109	+	}
	110	+	if s.chars().any(\|c\| c.is_control()) {
	111	+	return None;
	112	+	}
	113	+	Some(s.to_string())
	114	+	}
	115	+
58	116		/// Existing tmux sessions, so the sidebar can offer them instead of guessing.
59	117		///
	118	+	/// Oldest first, by session id, for the same reason the status frames are —
	119	+	/// this list draws the first row of tabs, and it would otherwise be in tmux's
	120	+	/// alphabetical order until the first status frame silently reshuffled it.
	121	+	///
60	122		/// `global_args` carries the server-selection flags from the profile; without
61	123		/// them this asks the default tmux server, which is a different set of
62	124		/// sessions than the one the sidebar is attached to.
63	125		pub fn list_sessions(global_args: &[String]) -> Vec<String> {
64	126		let Ok(out) = std::process::Command::new("tmux")
65	127		.args(global_args)
66		-	.args(["list-sessions", "-F", "#{session_name}"])
	128	+	.args(["list-sessions", "-F", "#{session_id}\t#{session_name}"])
67	129		.output()
68	130		else {
69	131		return Vec::new();
⋯ 1 unchanged line
71	133		if !out.status.success() {
72	134		return Vec::new(); // no server running yet
73	135		}
74		-	String::from_utf8_lossy(&out.stdout)
	136	+	let text = String::from_utf8_lossy(&out.stdout);
	137	+	let mut sessions: Vec<(u64, String)> = text
75	138		.lines()
76		-	.map(str::trim)
77		-	.filter(\|l\| !l.is_empty())
78		-	.map(str::to_string)
79		-	.collect()
	139	+	.filter_map(\|line\| {
	140	+	// Name last: a session name is allowed to contain a tab.
	141	+	let (id, name) = line.split_once('\t')?;
	142	+	let name = name.trim_end_matches(['\r', '\n']);
	143	+	(!name.is_empty()).then(\|\| (crate::status::session_ordinal(id), name.to_string()))
	144	+	})
	145	+	.collect();
	146	+	sessions.sort_by_key(\|(ordinal, _)\| *ordinal);
	147	+	sessions.into_iter().map(\|(_, name)\| name).collect()
80	148		}
81	149
82	150		/// The one existing tmux session, when there is exactly one.
⋯ 35 unchanged lines
118	186		Some(s.to_string())
119	187		}
120	188
	189	+	/// A tmux session id (`$1`). Session names can hold quotes and spaces, so
	190	+	/// when the daemon has to name a session in a command line of its own it uses
	191	+	/// the id, which is `$` plus digits and nothing else.
	192	+	pub fn valid_session_id(raw: &str) -> Option<String> {
	193	+	let s = raw.trim();
	194	+	let digits = s.strip_prefix('$')?;
	195	+	if digits.is_empty() \|\| digits.len() > 12 \|\| !digits.chars().all(\|c\| c.is_ascii_digit()) {
	196	+	return None;
	197	+	}
	198	+	Some(s.to_string())
	199	+	}
	200	+
121	201		/// Our own pty's slave path, on its way into `switch-client -c`. It comes from
122	202		/// the kernel rather than a client, but it is still quoted into a command line,
123	203		/// so it gets the same treatment.
⋯ 236 unchanged lines

1	+	//! Hosts the omnibar can offer to connect to, and the gate on the one it sends
2	+	//! back.
3	+	//!
4	+	//! The daemon runs tmux on this machine, and that does not change here: an
5	+	//! ssh connection is an ordinary local window that happens to be running ssh.
6	+	//! Nothing about the session model, the tabs or the status frames knows the
7	+	//! difference, which is the whole reason this is cheap.
8	+	//!
9	+	//! What the daemon contributes is the list. The names worth offering are the
10	+	//! ones ssh itself already knows — `~/.ssh/config` and, failing that,
11	+	//! `~/.ssh/known_hosts` — so the panel offers hosts you have actually
12	+	//! connected to rather than asking you to remember them a second time.
13	+
14	+	use std::collections::HashSet;
15	+	use std::path::{Path, PathBuf};
16	+
17	+	/// The most hosts the panel is told about.
18	+	///
19	+	/// `known_hosts` on an old account runs to hundreds of lines, and the omnibar
20	+	/// shows eight rows. The cap is about not sending a list nobody will scroll,
21	+	/// not about safety — every name in it went through [`valid_ssh_host`].
22	+	const MAX_HOSTS: usize = 100;
23	+
24	+	/// The most an ssh destination may be. Longer than any real `user@host` and
25	+	/// far short of anything that would look like a command line.
26	+	const MAX_HOST: usize = 128;
27	+
28	+	/// An ssh destination, as `[user@]host`.
29	+	///
30	+	/// The hazard here is not shell metacharacters — the destination reaches ssh
31	+	/// as one argv element, by way of a generated script — but ssh's own options.
32	+	/// `ssh -oProxyCommand=…` runs a shell, and ssh accepts an option anywhere on
33	+	/// its command line, so a destination beginning with a dash is the one thing
34	+	/// that turns "connect somewhere" into "run something". Both halves are checked
35	+	/// for it, and the charset on top of that leaves nothing that could become a
36	+	/// second argument.
37	+	///
38	+	/// Deliberately narrower than what ssh accepts: no `ssh://` URLs, no IPv6
39	+	/// brackets, no `:port`. Those are all reachable by typing `!ssh …` into the
40	+	/// same box, which is where the general case belongs. This is for names.
41	+	pub fn valid_ssh_host(raw: &str) -> Option<String> {
42	+	let s = raw.trim();
43	+	if s.is_empty() \|\| s.len() > MAX_HOST {
44	+	return None;
45	+	}
46	+	// At most one `@`, so a host cannot smuggle a second destination.
47	+	let (user, host) = match s.split_once('@') {
48	+	Some((u, h)) => {
49	+	if h.contains('@') {
50	+	return None;
51	+	}
52	+	(Some(u), h)
53	+	}
54	+	None => (None, s),
55	+	};
56	+	let plain = \|part: &str\| {
57	+	!part.is_empty()
58	+	&& !part.starts_with('-')
59	+	&& part
60	+	.chars()
61	+	.all(\|c\| c.is_ascii_alphanumeric() \|\| matches!(c, '.' \| '-' \| '_'))
62	+	};
63	+	if !plain(host) {
64	+	return None;
65	+	}
66	+	if user.is_some_and(\|u\| !plain(u)) {
67	+	return None;
68	+	}
69	+	Some(s.to_string())
70	+	}
71	+
72	+	/// The tmux window name for a connection: the host, without the user.
73	+	///
74	+	/// Three windows on the same box are told apart by what is in them, not by the
75	+	/// login, and `collin@mini` in a tab is mostly the part that is the same every
76	+	/// time. Falls back to the whole destination, which [`valid_ssh_host`] has
77	+	/// already restricted to characters a tmux window name is happy with.
78	+	pub fn window_name(host: &str) -> &str {
79	+	match host.split_once('@') {
80	+	Some((_, h)) if !h.is_empty() => h,
81	+	_ => host,
82	+	}
83	+	}
84	+
85	+	/// Every host worth offering, best source first and deduplicated.
86	+	///
87	+	/// Config aliases lead because they are what a person types and what they
88	+	/// named themselves; `known_hosts` fills in behind them for the machines
89	+	/// reached without ever writing a config entry.
90	+	pub fn hosts() -> Vec<String> {
91	+	let Some(dir) = ssh_dir() else {
92	+	return Vec::new();
93	+	};
94	+	let mut out = Vec::new();
95	+	let mut seen = HashSet::new();
96	+	let mut push = \|name: String\| {
97	+	if out.len() < MAX_HOSTS && seen.insert(name.clone()) {
98	+	out.push(name);
99	+	}
100	+	};
101	+
102	+	let (names, includes) = parse_config(&read(dir.join("config")));
103	+	for name in names {
104	+	push(name);
105	+	}
106	+	// One level. Included files may include further files, and following that
107	+	// is a graph walk with a cycle check for the sake of a list of suggestions
108	+	// — the first level is where every real config puts its hosts.
109	+	for include in includes {
110	+	for path in expand_include(&include, &dir) {
111	+	let (names, _) = parse_config(&read(path));
112	+	for name in names {
113	+	push(name);
114	+	}
115	+	}
116	+	}
117	+	for name in parse_known_hosts(&read(dir.join("known_hosts"))) {
118	+	push(name);
119	+	}
120	+	out
121	+	}
122	+
123	+	fn ssh_dir() -> Option<PathBuf> {
124	+	let home = std::env::var_os("HOME")?;
125	+	Some(PathBuf::from(home).join(".ssh"))
126	+	}
127	+
128	+	/// Missing and unreadable are the same answer: no hosts from here. An
129	+	/// unreadable ssh config is not this daemon's problem to report.
130	+	fn read(path: impl AsRef<Path>) -> String {
131	+	std::fs::read_to_string(path).unwrap_or_default()
132	+	}
133	+
134	+	/// Host aliases and `Include` paths from an ssh config.
135	+	///
136	+	/// Aliases, not `HostName`s: the alias is the thing you type at ssh, and the
137	+	/// whole point of having written one is that it is shorter and more memorable
138	+	/// than the address behind it.
139	+	///
140	+	/// Patterns are skipped. `Host *` is settings for everything rather than a
141	+	/// machine, and offering it as somewhere to connect would be offering ssh's
142	+	/// own defaults block as a destination. Negations (`!host`) are skipped for
143	+	/// the same reason: they name where a block does not apply.
144	+	pub fn parse_config(text: &str) -> (Vec<String>, Vec<String>) {
145	+	let mut hosts = Vec::new();
146	+	let mut includes = Vec::new();
147	+	for line in text.lines() {
148	+	let line = line.trim();
149	+	if line.is_empty() \|\| line.starts_with('#') {
150	+	continue;
151	+	}
152	+	// ssh accepts `Host foo` and `Host=foo` alike, and is case-insensitive
153	+	// about the keyword.
154	+	let mut parts = line.split(\|c: char\| c.is_whitespace() \|\| c == '=');
155	+	let Some(keyword) = parts.next() else {
156	+	continue;
157	+	};
158	+	let values = parts.filter(\|v\| !v.is_empty());
159	+	if keyword.eq_ignore_ascii_case("host") {
160	+	hosts.extend(
161	+	values
162	+	.filter(\|v\| !v.contains(['*', '?', '!']))
163	+	.filter_map(valid_ssh_host),
164	+	);
165	+	} else if keyword.eq_ignore_ascii_case("include") {
166	+	includes.extend(values.map(str::to_string));
167	+	}
168	+	}
169	+	(hosts, includes)
170	+	}
171	+
172	+	/// Hostnames from a `known_hosts` file.
173	+	///
174	+	/// Most of what is in one is unusable here and is dropped: hashed entries
175	+	/// (`\|1\|…`, which is the default on many distributions) cannot be reversed,
176	+	/// addresses are not names anybody types, and `[host]:port` entries belong to
177	+	/// the general case that `!ssh` covers. What is left is the plain hostnames,
178	+	/// which is exactly the set that is useful when there is no config file.
179	+	pub fn parse_known_hosts(text: &str) -> Vec<String> {
180	+	let mut out = Vec::new();
181	+	for line in text.lines() {
182	+	let line = line.trim();
183	+	if line.is_empty() \|\| line.starts_with('#') \|\| line.starts_with('\|') {
184	+	continue;
185	+	}
186	+	// A marker line (`@cert-authority`, `@revoked`) shifts every field
187	+	// along by one.
188	+	let mut fields = line.split_whitespace();
189	+	let Some(first) = fields.next() else { continue };
190	+	let patterns = if first.starts_with('@') {
191	+	match fields.next() {
192	+	Some(p) => p,
193	+	None => continue,
194	+	}
195	+	} else {
196	+	first
197	+	};
198	+	// One entry can list a name and its address, comma separated.
199	+	for name in patterns.split(',') {
200	+	// An address is not a name worth suggesting: you would not have
201	+	// typed it, and if you would, `!ssh` takes it.
202	+	if name.chars().all(\|c\| c.is_ascii_digit() \|\| c == '.') {
203	+	continue;
204	+	}
205	+	if let Some(host) = valid_ssh_host(name) {
206	+	out.push(host);
207	+	}
208	+	}
209	+	}
210	+	out
211	+	}
212	+
213	+	/// The files an `Include` names.
214	+	///
215	+	/// Relative paths are relative to `~/.ssh`, per ssh_config(5). The only glob
216	+	/// handled is a `*` in the final component, which is the shape every real
217	+	/// config uses (`Include config.d/*`) — anything more elaborate silently
218	+	/// contributes nothing, which costs a suggestion and no more.
219	+	fn expand_include(pattern: &str, ssh_dir: &Path) -> Vec<PathBuf> {
220	+	let expanded = match pattern.strip_prefix("~/") {
221	+	Some(rest) => match std::env::var_os("HOME") {
222	+	Some(home) => PathBuf::from(home).join(rest),
223	+	None => return Vec::new(),
224	+	},
225	+	None => {
226	+	let p = Path::new(pattern);
227	+	if p.is_absolute() {
228	+	p.to_path_buf()
229	+	} else {
230	+	ssh_dir.join(p)
231	+	}
232	+	}
233	+	};
234	+	let Some(name) = expanded.file_name().and_then(\|n\| n.to_str()) else {
235	+	return Vec::new();
236	+	};
237	+	if !name.contains('*') {
238	+	return vec![expanded];
239	+	}
240	+	let (prefix, suffix) = name.split_once('*').unwrap_or((name, ""));
241	+	// A second `*` would need real glob matching; the prefix and suffix of the
242	+	// first one are as far as this goes.
243	+	if suffix.contains('*') {
244	+	return Vec::new();
245	+	}
246	+	let dir = expanded.parent().unwrap_or(ssh_dir).to_path_buf();
247	+	let Ok(entries) = std::fs::read_dir(&dir) else {
248	+	return Vec::new();
249	+	};
250	+	let mut out: Vec<PathBuf> = entries
251	+	.flatten()
252	+	.filter(\|e\| e.file_type().map(\|t\| t.is_file()).unwrap_or(false))
253	+	.filter(\|e\| match e.file_name().to_str() {
254	+	Some(n) => {
255	+	n.starts_with(prefix)
256	+	&& n.ends_with(suffix)
257	+	&& n.len() >= prefix.len() + suffix.len()
258	+	}
259	+	None => false,
260	+	})
261	+	.map(\|e\| e.path())
262	+	.collect();
263	+	// Directory order is whatever the filesystem feels like, and the panel
264	+	// shows the first few of whatever it is sent.
265	+	out.sort();
266	+	out
267	+	}
268	+
269	+	#[cfg(test)]
270	+	mod tests {
271	+	use super::*;
272	+
273	+	#[test]
274	+	fn accepts_plain_destinations() {
275	+	assert_eq!(valid_ssh_host("mini").as_deref(), Some("mini"));
276	+	assert_eq!(
277	+	valid_ssh_host(" collin@mini ").as_deref(),
278	+	Some("collin@mini")
279	+	);
280	+	assert_eq!(
281	+	valid_ssh_host("build-01.example.com").as_deref(),
282	+	Some("build-01.example.com")
283	+	);
284	+	}
285	+
286	+	#[test]
287	+	fn rejects_anything_ssh_would_read_as_an_option() {
288	+	// The one that matters: a leading dash is an ssh flag, and
289	+	// `-oProxyCommand=` runs a shell.
290	+	assert_eq!(valid_ssh_host("-oProxyCommand=sh"), None);
291	+	assert_eq!(valid_ssh_host("root@-oProxyCommand=sh"), None);
292	+	assert_eq!(valid_ssh_host("-mini"), None);
293	+	}
294	+
295	+	#[test]
296	+	fn rejects_anything_that_is_not_one_name() {
297	+	assert_eq!(valid_ssh_host(""), None);
298	+	assert_eq!(valid_ssh_host(" "), None);
299	+	assert_eq!(valid_ssh_host("mini ; kill-server"), None);
300	+	assert_eq!(valid_ssh_host("mini' ; kill-server ; '"), None);
301	+	assert_eq!(valid_ssh_host("a@b@c"), None);
302	+	assert_eq!(valid_ssh_host("@mini"), None);
303	+	assert_eq!(valid_ssh_host("collin@"), None);
304	+	assert_eq!(valid_ssh_host("ssh://mini"), None);
305	+	assert_eq!(valid_ssh_host("mini:22"), None);
306	+	assert_eq!(valid_ssh_host(&"a".repeat(MAX_HOST + 1)), None);
307	+	}
308	+
309	+	#[test]
310	+	fn window_name_drops_the_user() {
311	+	assert_eq!(window_name("collin@mini"), "mini");
312	+	assert_eq!(window_name("mini"), "mini");
313	+	}
314	+
315	+	#[test]
316	+	fn config_yields_aliases_and_includes() {
317	+	let (hosts, includes) = parse_config(
318	+	"# comment\n\
319	+	Include ~/.ssh/config.d/*\n\
320	+	Host mini nas\n\
321	+	\tHostName 10.0.0.4\n\
322	+	Host=work\n\
323	+	Host *\n\
324	+	Host *.internal\n\
325	+	Host !badhost\n\
326	+	Match host anything\n",
327	+	);
328	+	assert_eq!(hosts, ["mini", "nas", "work"]);
329	+	assert_eq!(includes, ["~/.ssh/config.d/*"]);
330	+	}
331	+
332	+	#[test]
333	+	fn known_hosts_drops_what_cannot_be_typed() {
334	+	let hosts = parse_known_hosts(
335	+	"\|1\|aGFzaGVk\|aGFzaGVk ssh-ed25519 AAAA\n\
336	+	mini,10.0.0.4 ssh-ed25519 AAAA\n\
337	+	[mini]:2222 ssh-ed25519 AAAA\n\
338	+	@cert-authority anvil.example.com ssh-rsa AAAA\n\
339	+	192.168.1.9 ssh-rsa AAAA\n\
340	+	# comment\n",
341	+	);
342	+	assert_eq!(hosts, ["mini", "anvil.example.com"]);
343	+	}
344	+	}

1	+	//! Serving a socket we did not bind, and going away when nobody is using it.
2	+	//!
3	+	//! Together these are what make the daemon start itself: systemd owns the port
4	+	//! and execs us on the first connection, and we exit again once the sidebar is
5	+	//! gone. Both halves have to hold or the user is back to starting it by hand —
6	+	//! or, worse, ends up with a daemon that exits while a terminal is open.
7	+
8	+	use std::time::Duration;
9	+
10	+	use futures_util::{SinkExt, StreamExt};
11	+	use tokio_tungstenite::connect_async;
12	+	use tokio_tungstenite::tungstenite::Message;
13	+	use tokio_tungstenite::tungstenite::client::IntoClientRequest;
14	+
15	+	use termbridge::{Config, Event, Server};
16	+
17	+	const GOOD_TOKEN: &str = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
18	+	const PAIRED: &str = "chrome-extension://abcdefghijklmnopabcdefghijklmnop";
19	+
20	+	fn test_config() -> Config {
21	+	let mut c = Config::new(GOOD_TOKEN, vec![PAIRED.to_string()]);
22	+	c.auth_timeout = Duration::from_millis(300);
23	+	c.echo_only = true;
24	+	c
25	+	}
26	+
27	+	async fn authed(
28	+	server: &Server,
29	+	) -> tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>> {
30	+	let mut req = server.url().into_client_request().unwrap();
31	+	req.headers_mut().insert("origin", PAIRED.parse().unwrap());
32	+	let (mut ws, _) = connect_async(req).await.expect("connect");
33	+	ws.send(Message::Text(
34	+	format!(r#"{{"type":"auth","token":"{GOOD_TOKEN}"}}"#).into(),
35	+	))
36	+	.await
37	+	.unwrap();
38	+	let reply = ws.next().await.unwrap().unwrap();
39	+	assert!(reply.to_text().unwrap().contains("ok"), "auth: {reply:?}");
40	+	ws
41	+	}
42	+
43	+	/// A socket bound by somebody else is served exactly like one we bound. This is
44	+	/// the systemd handoff minus the environment variables, which `activation`'s
45	+	/// own tests cover.
46	+	#[tokio::test]
47	+	async fn serves_a_socket_it_did_not_bind() {
48	+	let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
49	+	let addr = listener.local_addr().unwrap();
50	+	listener.set_nonblocking(true).unwrap();
51	+
52	+	let server = Server::from_std(test_config(), listener).expect("adopt listener");
53	+	assert_eq!(server.addr(), addr, "kept the port systemd chose");
54	+
55	+	let mut ws = authed(&server).await;
56	+	ws.send(Message::Binary(b"hi".to_vec().into()))
57	+	.await
58	+	.unwrap();
59	+	assert_eq!(
60	+	ws.next().await.unwrap().unwrap(),
61	+	Message::Binary(b"hi".to_vec().into())
62	+	);
63	+	}
64	+
65	+	/// The whole point of the idle timeout: a daemon nobody is talking to should
66	+	/// stop, so the next connection gets a fresh one from the socket unit.
67	+	#[tokio::test]
68	+	async fn idle_daemon_asks_to_exit() {
69	+	let mut config = test_config();
70	+	config.idle_timeout = Some(Duration::from_millis(200));
71	+	let mut server = Server::start(config, 0).await.unwrap();
72	+
73	+	let event = tokio::time::timeout(Duration::from_secs(5), server.next_event())
74	+	.await
75	+	.expect("idle event within 5s");
76	+	assert_eq!(event, Some(Event::Idle));
77	+	}
78	+
79	+	/// And the failure that would actually hurt: killing the daemon out from under
80	+	/// an open terminal. A connected client must hold it open indefinitely, however
81	+	/// quiet the user is being.
82	+	#[tokio::test]
83	+	async fn a_connected_client_is_not_idle() {
84	+	let mut config = test_config();
85	+	config.idle_timeout = Some(Duration::from_millis(200));
86	+	let mut server = Server::start(config, 0).await.unwrap();
87	+
88	+	let _ws = authed(&server).await;
89	+	// Accepted, then nothing. Well past several timeouts.
90	+	assert_eq!(
91	+	server.next_event().await,
92	+	Some(Event::Accepted {
93	+	origin: PAIRED.into()
94	+	})
95	+	);
96	+	let quiet = tokio::time::timeout(Duration::from_millis(1500), server.next_event()).await;
97	+	assert!(quiet.is_err(), "exited under an open client: {quiet:?}");
98	+	}
99	+
100	+	/// The clock has to measure time since the last client left, not since
101	+	/// startup — otherwise the first disconnect after a long session triggers an
102	+	/// immediate exit, and the sidebar's reconnect races the shutdown.
103	+	#[tokio::test]
104	+	async fn the_clock_restarts_when_a_client_leaves() {
105	+	let mut config = test_config();
106	+	config.idle_timeout = Some(Duration::from_millis(600));
107	+	let mut server = Server::start(config, 0).await.unwrap();
108	+
109	+	let ws = authed(&server).await;
110	+	assert_eq!(
111	+	server.next_event().await,
112	+	Some(Event::Accepted {
113	+	origin: PAIRED.into()
114	+	})
115	+	);
116	+	tokio::time::sleep(Duration::from_millis(700)).await;
117	+	drop(ws);
118	+
119	+	let event = tokio::time::timeout(Duration::from_secs(5), server.next_event())
120	+	.await
121	+	.expect("idle event after the client left");
122	+	assert_eq!(event, Some(Event::Idle));
123	+	}
124	+
125	+	/// Left off by default. A hand-started `termbridge serve` that vanished a few
126	+	/// minutes after the user closed one tab would be a surprising regression.
127	+	#[tokio::test]
128	+	async fn no_timeout_by_default() {
129	+	assert!(Config::new(GOOD_TOKEN, vec![]).idle_timeout.is_none());
130	+	}

⋯ 16 unchanged lines
17	17		use tokio_tungstenite::tungstenite::client::IntoClientRequest;
18	18		use tokio_tungstenite::tungstenite::http::StatusCode;
19	19		use tokio_tungstenite::tungstenite::{Error as WsError, Message};
20		-	use tokio_tungstenite::{connect_async, MaybeTlsStream, WebSocketStream};
	20	+	use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};
21	21
22	22		use termbridge::auth::{self, Denied};
23		-	use termbridge::{paths, Config, Server};
	23	+	use termbridge::{Config, Server, paths};
24	24
25	25		const GOOD_TOKEN: &str = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
26	26		const PAIRED: &str = "chrome-extension://abcdefghijklmnopabcdefghijklmnop";
⋯ 38 unchanged lines
65	65
66	66		/// A client that got through the handshake and sent a valid auth frame.
67	67		async fn authed(server: &Server) -> Client {
68		-	let mut ws = connect(server, Some(PAIRED), None, "").await.expect("handshake");
	68	+	let mut ws = connect(server, Some(PAIRED), None, "")
	69	+	.await
	70	+	.expect("handshake");
69	71		ws.send(Message::Text(
70	72		serde_json::json!({"type": "auth", "token": GOOD_TOKEN})
71	73		.to_string()
⋯ 119 unchanged lines
191	193
192	194		#[test]
193	195		fn host_header_parsing() {
194		-	for good in ["127.0.0.1", "127.0.0.1:7681", "localhost", "localhost:7681", "[::1]:7681"] {
	196	+	for good in [
	197	+	"127.0.0.1",
	198	+	"127.0.0.1:7681",
	199	+	"localhost",
	200	+	"localhost:7681",
	201	+	"[::1]:7681",
	202	+	] {
195	203		assert!(auth::host_is_loopback(good), "{good} should be loopback");
196	204		}
197	205		for bad in [
⋯ 24 unchanged lines
222	230		.await
223	231		.unwrap();
224	232		let reply = ws.next().await.unwrap().unwrap();
225		-	assert!(reply.to_text().unwrap().contains("invalid token"), "{reply:?}");
	233	+	assert!(
	234	+	reply.to_text().unwrap().contains("invalid token"),
	235	+	"{reply:?}"
	236	+	);
226	237		}
227	238
228	239		#[tokio::test]
⋯ 37 unchanged lines
266	277		#[tokio::test]
267	278		async fn query_string_token_does_not_authenticate() {
268	279		let server = start(test_config()).await;
269		-	let mut ws = connect(&server, Some(PAIRED), None, &format!("/?token={GOOD_TOKEN}"))
270		-	.await
271		-	.unwrap();
	280	+	let mut ws = connect(
	281	+	&server,
	282	+	Some(PAIRED),
	283	+	None,
	284	+	&format!("/?token={GOOD_TOKEN}"),
	285	+	)
	286	+	.await
	287	+	.unwrap();
272	288		let outcome = tokio::time::timeout(Duration::from_secs(2), async {
273	289		while let Some(Ok(m)) = ws.next().await {
274	290		if let Message::Text(t) = &m {
⋯ 32 unchanged lines
307	323		let dir = tempfile::tempdir().unwrap();
308	324		let token = paths::generate_token(dir.path()).unwrap();
309	325
310		-	assert_eq!(token.len(), paths::TOKEN_BYTES * 2, "expected 32 random bytes as hex");
	326	+	assert_eq!(
	327	+	token.len(),
	328	+	paths::TOKEN_BYTES * 2,
	329	+	"expected 32 random bytes as hex"
	330	+	);
311	331
312	332		let mode = std::fs::metadata(dir.path().join("token"))
313	333		.unwrap()
⋯ 3 unchanged lines
317	337		assert_eq!(mode, 0o600, "token file mode is {mode:04o}, must be 0600");
318	338
319	339		let dir_mode = std::fs::metadata(dir.path()).unwrap().permissions().mode() & 0o777;
320		-	assert_eq!(dir_mode, 0o700, "config dir mode is {dir_mode:04o}, must be 0700");
	340	+	assert_eq!(
	341	+	dir_mode, 0o700,
	342	+	"config dir mode is {dir_mode:04o}, must be 0700"
	343	+	);
321	344		}
322	345
323	346		/// If the mode ever loosens, refuse rather than authenticate against a secret
⋯ 44 unchanged lines
368	391		let dir = tempfile::tempdir().unwrap();
369	392		assert!(paths::load_paired_origins(dir.path()).is_empty());
370	393		// Pairing only ever happens through the explicit CLI path.
371		-	assert!(!auth::origin_is_paired(PAIRED, &paths::load_paired_origins(dir.path())));
	394	+	assert!(!auth::origin_is_paired(
	395	+	PAIRED,
	396	+	&paths::load_paired_origins(dir.path())
	397	+	));
372	398		}
373	399
374	400		#[test]
375	401		fn pair_and_unpair_round_trip() {
376	402		let dir = tempfile::tempdir().unwrap();
377	403		assert!(paths::pair_origin(dir.path(), PAIRED).unwrap());
378		-	assert!(!paths::pair_origin(dir.path(), PAIRED).unwrap(), "idempotent");
379		-	assert_eq!(paths::load_paired_origins(dir.path()), vec![PAIRED.to_string()]);
	404	+	assert!(
	405	+	!paths::pair_origin(dir.path(), PAIRED).unwrap(),
	406	+	"idempotent"
	407	+	);
	408	+	assert_eq!(
	409	+	paths::load_paired_origins(dir.path()),
	410	+	vec![PAIRED.to_string()]
	411	+	);
380	412
381	413		assert!(paths::unpair_origin(dir.path(), PAIRED).unwrap());
382	414		assert!(paths::load_paired_origins(dir.path()).is_empty());
⋯ 8 unchanged lines
391	423		paths::pair_origin(dir.path(), ff).unwrap();
392	424		let paired = paths::load_paired_origins(dir.path());
393	425		assert!(auth::origin_is_paired(ff, &paired));
394		-	assert!(auth::origin_is_paired(&ff.to_uppercase(), &paired), "case-insensitive");
	426	+	assert!(
	427	+	auth::origin_is_paired(&ff.to_uppercase(), &paired),
	428	+	"case-insensitive"
	429	+	);
395	430		assert!(!auth::origin_is_paired(
396	431		"moz-extension://99999999-2222-3333-4444-555555555555",
397	432		&paired
⋯ 114 unchanged lines
512	547
513	548		let mut sock = tokio::net::TcpStream::connect(server.addr()).await.unwrap();
514	549		// Opening bytes of a TLS 1.x ClientHello record.
515		-	sock.write_all(&[0x16, 0x03, 0x01, 0x00, 0x2f, 0x01]).await.unwrap();
	550	+	sock.write_all(&[0x16, 0x03, 0x01, 0x00, 0x2f, 0x01])
	551	+	.await
	552	+	.unwrap();
516	553
517	554		let ev = tokio::time::timeout(Duration::from_secs(3), server.next_event())
518	555		.await
⋯ 30 unchanged lines

⋯ 8 unchanged lines
9	9
10	10		use futures_util::{SinkExt, StreamExt};
11	11		use tokio_rustls::rustls::pki_types::ServerName;
	12	+	use tokio_tungstenite::tungstenite::Message;
12	13		use tokio_tungstenite::tungstenite::client::IntoClientRequest;
13		-	use tokio_tungstenite::tungstenite::Message;
14	14
15		-	use termbridge::{tls, Config, Server};
	15	+	use termbridge::{Config, Server, tls};
16	16
17	17		const TOKEN: &str = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
18	18		const PAIRED: &str = "chrome-extension://abcdefghijklmnopabcdefghijklmnop";
⋯ 53 unchanged lines
72	72		id: &tls::Identity,
73	73		origin: Option<&str>,
74	74		) -> Result<
75		-	tokio_tungstenite::WebSocketStream<
76		-	tokio_rustls::client::TlsStream<tokio::net::TcpStream>,
77		-	>,
	75	+	tokio_tungstenite::WebSocketStream<tokio_rustls::client::TlsStream<tokio::net::TcpStream>>,
78	76		tokio_tungstenite::tungstenite::Error,
79	77		> {
80	78		let connector = tokio_rustls::TlsConnector::from(client_config(id));
⋯ 87 unchanged lines
168	166		.await
169	167		.unwrap();
170	168		let reply = ws.next().await.unwrap().unwrap();
171		-	assert!(reply.to_text().unwrap().contains("invalid token"), "{reply:?}");
	169	+	assert!(
	170	+	reply.to_text().unwrap().contains("invalid token"),
	171	+	"{reply:?}"
	172	+	);
172	173		}
173	174
174	175		#[tokio::test]
⋯ 74 unchanged lines
249	250		let dir = tempfile::tempdir().unwrap();
250	251		let a = tls::load_or_create(dir.path()).unwrap();
251	252		let b = tls::load_or_create(dir.path()).unwrap();
252		-	assert_eq!(a.fingerprint, b.fingerprint, "cert must not churn per start");
	253	+	assert_eq!(
	254	+	a.fingerprint, b.fingerprint,
	255	+	"cert must not churn per start"
	256	+	);
253	257		assert_eq!(a.fingerprint.len(), 32 * 3 - 1, "SHA-256 hex with colons");
254	258
255	259		let c = tls::generate(dir.path()).unwrap();
256		-	assert_ne!(a.fingerprint, c.fingerprint, "--regenerate must make a new one");
	260	+	assert_ne!(
	261	+	a.fingerprint, c.fingerprint,
	262	+	"--regenerate must make a new one"
	263	+	);
257	264		}
258	265
259	266		/// The landing page exists so the certificate-trust visit is comprehensible.
⋯ 7 unchanged lines
267	274
268	275		let mut sock = tokio::net::TcpStream::connect(server.addr()).await.unwrap();
269	276		sock.write_all(
270		-	format!("GET / HTTP/1.1\r\nHost: 127.0.0.1:{}\r\n\r\n", server.addr().port()).as_bytes(),
	277	+	format!(
	278	+	"GET / HTTP/1.1\r\nHost: 127.0.0.1:{}\r\n\r\n",
	279	+	server.addr().port()
	280	+	)
	281	+	.as_bytes(),
271	282		)
272	283		.await
273	284		.unwrap();
⋯ 2 unchanged lines
276	287		let _ = tokio::time::timeout(Duration::from_secs(2), sock.read_to_end(&mut body)).await;
277	288		let text = String::from_utf8_lossy(&body);
278	289
279		-	assert!(text.contains("200 OK"), "expected the landing page, got:\n{text}");
	290	+	assert!(
	291	+	text.contains("200 OK"),
	292	+	"expected the landing page, got:\n{text}"
	293	+	);
280	294		assert!(!text.contains(TOKEN), "landing page leaked the auth token");
281	295		assert!(
282	296		!text.to_lowercase().contains("\"token\""),
⋯ 3 unchanged lines

⋯ 46 unchanged lines
47	47		/**
48	48		* Cut the element's box out of a full-viewport screenshot.
49	49		*
50		-	* The scale factor comes from the captured image's own width rather than
	50	+	* The scale factor comes from the captured image's own size rather than
51	51		* devicePixelRatio: browser zoom, HiDPI and Chrome's own capture downscaling
52		-	* all move the two apart, and the ratio the image reports is the true one.
	52	+	* all move the two apart, and the ratio the image reports is the true one. It
	53	+	* is read off the height, because a split view can only disagree about width
	54	+	* — the two panes sit side by side and share the window's height.
53	55		*
54	56		* @param {string} dataUrl PNG data URL of the visible tab
55	57		* @param {TbPickedRect} rect element box in CSS pixels, viewport-relative
56	58		* @param {{ w: number; h: number }} viewport CSS pixel size of the viewport
	59	+	* @param {TbPane} [pane] where the viewport sits in the window, for split views
57	60		* @returns {Promise<Uint8Array>} PNG bytes
58	61		*/
59		-	async function cropShot(dataUrl, rect, viewport) {
	62	+	async function cropShot(dataUrl, rect, viewport, pane) {
60	63		const bmp = await createImageBitmap(new Blob([dataUrlBytes(dataUrl)], { type: "image/png" }));
61		-	const scale = viewport.w > 0 ? bmp.width / viewport.w : 1;
	64	+	const scale = viewport.h > 0 ? bmp.height / viewport.h : 1;
	65	+
	66	+	// A capture wider than the viewport is the whole window with the other half
	67	+	// of a split view in it. The pick's pane is flush against one edge of that
	68	+	// image, and its distance from the window's own left edge says which — the
	69	+	// left pane starts at ~0, the right one hundreds of pixels in, so the
	70	+	// half-width threshold holds even though zoom scales screenX and not `left`.
	71	+	let offsetX = 0;
	72	+	if (bmp.width - viewport.w * scale > 2 && pane?.screenX != null && pane.winLeft != null) {
	73	+	const fromLeft = pane.screenX - pane.winLeft;
	74	+	if (fromLeft > bmp.width / scale / 2) offsetX = bmp.width - viewport.w * scale;
	75	+	}
62	76
63	77		// Clamp to the viewport: an element can hang off the edge, and drawImage
64	78		// silently produces transparent pixels for the part that isn't there.
⋯ 2 unchanged lines
67	81		const right = Math.min(viewport.w, rect.x + rect.width + SHOT_PAD);
68	82		const bottom = Math.min(viewport.h, rect.y + rect.height + SHOT_PAD);
69	83
70		-	const sx = Math.round(left * scale);
	84	+	const sx = Math.round(offsetX + left * scale);
71	85		const sy = Math.round(top * scale);
72	86		const sw = Math.round((right - left) * scale);
73	87		const sh = Math.round((bottom - top) * scale);
⋯ 37 unchanged lines
111	125		}
112	126
113	127		/**
	128	+	* Pair the pick's on-screen position with its window's, so cropShot can tell
	129	+	* the two halves of a split view apart. Best-effort: without it the crop just
	130	+	* assumes the capture covers the pane alone, which is what it does today.
	131	+	*
	132	+	* @param {TbExtensionApi} api
	133	+	* @param {TbPicked} picked
	134	+	* @returns {Promise<TbPane \| undefined>}
	135	+	*/
	136	+	async function paneOf(api, picked) {
	137	+	if (picked.screenX == null) return undefined;
	138	+	try {
	139	+	// The worker has no window of its own; the shortcut acted on the focused
	140	+	// one, which is where the pick came from.
	141	+	const win = typeof document !== "undefined"
	142	+	? await api.windows.getCurrent()
	143	+	: await api.windows.getLastFocused();
	144	+	if (win?.left == null) return undefined;
	145	+	return { screenX: picked.screenX, winLeft: win.left };
	146	+	} catch {
	147	+	return undefined;
	148	+	}
	149	+	}
	150	+
	151	+	/**
114	152		* Screenshot the picked element and leave it on the system clipboard.
115	153		*
116	154		* Three routes, in order of how little they can go wrong:
⋯ 11 unchanged lines
128	166		if (!picked.rect \|\| !picked.viewport) return "no element geometry";
129	167		let png;
130	168		try {
	169	+	// captureVisibleTab takes no tab: it shoots whatever is active. In a
	170	+	// split view the pick may well have landed in the other half, so activate
	171	+	// the tab it came from first. Outside a split this is the tab that is
	172	+	// already active and the call does nothing — except help the clipboard
	173	+	// write below, which needs the page focused.
	174	+	if (tabId != null) await api.tabs.update(tabId, { active: true });
131	175		const dataUrl = await api.tabs.captureVisibleTab({ format: "png" });
132		-	png = await cropShot(dataUrl, picked.rect, picked.viewport);
	176	+	png = await cropShot(dataUrl, picked.rect, picked.viewport, await paneOf(api, picked));
133	177		} catch (e) {
134	178		return e instanceof Error ? e.message : String(e);
135	179		}
⋯ 40 unchanged lines

1	+	// Running the picker across Chrome's split view.
2	+	//
3	+	// A split view is two tabs side by side in one window. Both are rendered and
4	+	// both are clickable, but only one is `active` — Chrome marks a single tab
5	+	// active even while its partner is fully visible. So the obvious
6	+	// `tabs.query({active: true})` always resolves to whichever half last had
7	+	// focus, and a pick started from the other half highlights nothing.
8	+	//
9	+	// The fix is to inject into every visible half at once and take the first
10	+	// answer. `splitViewId` (Chrome 140+) is what makes the set knowable; it is
11	+	// read-only detection data, so nothing here creates or dissolves a split.
12	+	// Firefox has neither the property nor the feature, and falls through to the
13	+	// single-tab path.
14	+	//
15	+	// Loaded by both the sidebar (a document) and the background worker (no DOM),
16	+	// so nothing here may touch `document`.
17	+
18	+	/**
19	+	* Every tab a pick should run in: the active one, plus the other half of its
20	+	* split view when there is one. Active first — its failure is the one worth
21	+	* reporting, because it is the half the user was looking at.
22	+	*
23	+	* @param {TbExtensionApi} api
24	+	* @param {TbTab} tab the active tab
25	+	* @returns {Promise<TbTab[]>}
26	+	*/
27	+	async function pickTargets(api, tab) {
28	+	if (!tab \|\| tab.id == null) return [];
29	+	if (tab.splitViewId == null) return [tab];
30	+	try {
31	+	// Chrome throws on an unrecognised query key rather than ignoring it, so a
32	+	// browser that reports splitViewId but won't query on it lands in the catch.
33	+	const tabs = await api.tabs.query({ splitViewId: tab.splitViewId, currentWindow: true });
34	+	const out = [tab];
35	+	for (const t of tabs) if (t.id != null && t.id !== tab.id) out.push(t);
36	+	return out;
37	+	} catch {
38	+	return [tab];
39	+	}
40	+	}
41	+
42	+	/**
43	+	* Tear down a picker overlay from outside the page.
44	+	*
45	+	* picker.js parks its cleanup on `window.__tbPickerActive`; calling it resolves
46	+	* that pick's promise with null, exactly as an Escape would.
47	+	*/
48	+	function tbCancelPicker() {
49	+	if (window.__tbPickerActive) window.__tbPickerActive();
50	+	}
51	+
52	+	/**
53	+	* Cancel picks running in `tabIds`. Failures are ignored: a tab that closed or
54	+	* navigated took its picker with it.
55	+	*
56	+	* @param {TbExtensionApi} api
57	+	* @param {number[]} tabIds
58	+	*/
59	+	async function cancelPicks(api, tabIds) {
60	+	await Promise.all(
61	+	tabIds.map((tabId) =>
62	+	api.scripting.executeScript({ target: { tabId }, func: tbCancelPicker }).catch(() => {}),
63	+	),
64	+	);
65	+	}
66	+
67	+	/**
68	+	* Run the picker in every candidate tab at once and take the first real answer.
69	+	*
70	+	* The first half to settle wins, and the losers are torn down — including on a
71	+	* cancel, so an Escape in one pane doesn't leave an overlay live in the other.
72	+	* An injection that fails is not a settle: on the keyboard-shortcut path the
73	+	* `activeTab` grant covers only the active half, so the partner half usually
74	+	* refuses unless its origin was granted, and that must not end a pick the
75	+	* active half is still serving.
76	+	*
77	+	* @template T
78	+	* @param {TbExtensionApi} api
79	+	* @param {TbTab[]} tabs
80	+	* @param {() => Promise<T \| null>} func the picker, serialised into each page
81	+	* @returns {Promise<{ tabId: number \| undefined; value: T \| null; error: string }>}
82	+	*/
83	+	function racePick(api, tabs, func) {
84	+	/** @type {number[]} */
85	+	const ids = [];
86	+	for (const t of tabs) if (t?.id != null) ids.push(t.id);
87	+	if (!ids.length) return Promise.resolve({ tabId: undefined, value: null, error: "no page to pick in" });
88	+
89	+	return new Promise((resolve) => {
90	+	let finished = false;
91	+	let pending = ids.length;
92	+	let firstError = "";
93	+
94	+	for (const tabId of ids) {
95	+	api.scripting
96	+	.executeScript({ target: { tabId }, func })
97	+	// `undefined` means the injection itself failed; `null` means the pick
98	+	// was cancelled. Only the second one ends the race.
99	+	.then((results) => results?.[0]?.result ?? null)
100	+	.catch((e) => {
101	+	if (!firstError) firstError = e instanceof Error ? e.message : String(e);
102	+	return undefined;
103	+	})
104	+	.then((value) => {
105	+	if (finished) return;
106	+	if (value === undefined) {
107	+	if (--pending === 0) {
108	+	resolve({ tabId: ids[0], value: null, error: firstError \|\| "injection failed" });
109	+	}
110	+	return;
111	+	}
112	+	finished = true;
113	+	cancelPicks(
114	+	api,
115	+	ids.filter((other) => other !== tabId),
116	+	);
117	+	resolve({ tabId, value: /** @type {T \| null} */ (value), error: "" });
118	+	});
119	+	}
120	+	});
121	+	}
122	+
123	+	const Split = { pickTargets, racePick, cancelPicks };
124	+
125	+	if (typeof module !== "undefined" && module.exports) {
126	+	module.exports = Split;
127	+	}

⋯ 6 unchanged lines
7	7		"storage",
8	8		"sidePanel",
9	9		"tabs",
	10	+	"tabGroups",
10	11		"activeTab",
11	12		"scripting",
12	13		"clipboardWrite"
⋯ 25 unchanged lines
38	39		"default": "Alt+Shift+P"
39	40		},
40	41		"description": "Pick an element on the page"
	42	+	},
	43	+	"toggle-terminal": {
	44	+	"suggested_key": {
	45	+	"default": "Alt+Shift+T"
	46	+	},
	47	+	"description": "Open the terminal, focus it, or close it"
	48	+	},
	49	+	"focus-omnibar": {
	50	+	"suggested_key": {
	51	+	"default": "Ctrl+Shift+L"
	52	+	},
	53	+	"description": "Jump to a window, session or pane"
	54	+	},
	55	+	"hand-tab-to-claude": {
	56	+	"suggested_key": {
	57	+	"default": "Alt+Shift+K"
	58	+	},
	59	+	"description": "Move this tab into Claude in Chrome's tab group"
	60	+	},
	61	+	"set-claude-group": {
	62	+	"description": "Mark this tab's group as Claude in Chrome's"
41	63		}
42	64		},
43	65		"host_permissions": [
⋯ 12 unchanged lines

1	+	<!doctype html>
2	+	<!-- Throwaway: the sidebar's header, rendered outside the extension so the
3	+	layout can be looked at in a plain tab. Not shipped by build.sh. -->
4	+	<html>
5	+	<head>
6	+	<meta charset="utf-8" />
7	+	<title>header mock</title>
8	+	<link rel="stylesheet" href="sidebar.css" />
9	+	<style>
10	+	body { margin: 0; width: 380px; }
11	+	#term { height: 220px; background: var(--bg); }
12	+	#mode {
13	+	position: fixed; left: 390px; top: 8px;
14	+	font: 12px system-ui; color: #888;
15	+	}
16	+	</style>
17	+	</head>
18	+	<body>
19	+	<script src="lib/theme.js"></script>
20	+	<script>
21	+	const dark = matchMedia("(prefers-color-scheme: dark)").matches;
22	+	const t = Themes.resolveTheme("dark", dark);
23	+	for (const [k, v] of Object.entries(t.ui)) document.documentElement.style.setProperty(k, v);
24	+
25	+	// ?full fills the row; the default is one of each, so both layouts can be
26	+	// seen with slack left in the strip.
27	+	const FULL = location.search.includes("full");
28	+	const SESSIONS = FULL
29	+	? [
30	+	{ name: "browser", selected: true },
31	+	{ name: "anvil", state: "ready" },
32	+	{ name: "dotfiles", state: "working" },
33	+	]
34	+	: [{ name: "browser", selected: true }];
35	+	const WINDOWS = FULL
36	+	? [
37	+	{ index: 1, name: "termbridge", active: true, state: "working" },
38	+	{ index: 2, name: "sidebar", state: "waiting" },
39	+	{ index: 3, name: "notes" },
40	+	]
41	+	: [{ index: 1, name: "termbridge", active: true, state: "working" }];
42	+	const GLYPH = { working: "✳", waiting: "●", ready: "●", idle: "●", none: "" };
43	+
44	+	(async () => {
45	+	const html = await (await fetch("sidebar.html")).text();
46	+	const doc = new DOMParser().parseFromString(html, "text/html");
47	+	const header = doc.querySelector("header");
48	+	document.body.prepend(header);
49	+	const term = document.createElement("div");
50	+	term.id = "term";
51	+	document.body.appendChild(term);
52	+
53	+	document.body.classList.add("has-session");
54	+	const sessions = document.getElementById("sessions");
55	+	sessions.hidden = false;
56	+	document.getElementById("session-new").hidden = false;
57	+	for (const s of SESSIONS) {
58	+	const b = document.createElement("button");
59	+	b.className = `session-tab${s.attached ? " attached" : ""}`;
60	+	b.setAttribute("role", "tab");
61	+	b.setAttribute("aria-selected", String(!!s.selected));
62	+	if (!s.selected) {
63	+	const g = document.createElement("span");
64	+	g.className = `glyph ${s.state ?? "none"}`;
65	+	g.textContent = GLYPH[s.state ?? "none"];
66	+	b.appendChild(g);
67	+	}
68	+	const n = document.createElement("span");
69	+	n.className = "name";
70	+	n.textContent = s.name;
71	+	b.appendChild(n);
72	+	sessions.appendChild(b);
73	+	}
74	+
75	+	const tabs = document.getElementById("tabs");
76	+	tabs.hidden = false;
77	+	document.getElementById("tab-new").hidden = false;
78	+	for (const w of WINDOWS) {
79	+	const slot = document.createElement("div");
80	+	slot.className = `tab-slot closable${w.active ? " active" : ""}`;
81	+	const b = document.createElement("button");
82	+	b.className = "tab";
83	+	b.setAttribute("role", "tab");
84	+	b.setAttribute("aria-selected", String(!!w.active));
85	+	const g = document.createElement("span");
86	+	g.className = `glyph ${w.state ?? "none"}`;
87	+	g.textContent = GLYPH[w.state ?? "none"];
88	+	b.appendChild(g);
89	+	const n = document.createElement("span");
90	+	n.className = "name";
91	+	n.textContent = w.name;
92	+	b.appendChild(n);
93	+	slot.appendChild(b);
94	+	tabs.appendChild(slot);
95	+	}
96	+
97	+	// What syncJump would say with a pane waiting on you.
98	+	const jump = document.getElementById("jump");
99	+	jump.disabled = false;
100	+	jump.dataset.state = "waiting";
101	+
102	+	// The same DOM moves applyTabMode makes, so the groups layout can be
103	+	// looked at too. Everything below mirrors sidebar.js — if the two
104	+	// disagree, sidebar.js is right and this is stale.
105	+	const $ = (id) => document.getElementById(id);
106	+	const HUES = { browser: -1, anvil: 210, dotfiles: 25 };
107	+	function setMode(mode) {
108	+	const top = $("session-strip");
109	+	const row = $("window-strip");
110	+	document.body.classList.toggle("groups", mode === "groups");
111	+	if (mode === "groups") {
112	+	row.prepend($("reconnect"), $("settings-toggle"));
113	+	row.insertBefore($("status-text"), $("tabs"));
114	+	row.append($("tab-new"));
115	+	$("omni-strip").prepend($("pick"), $("jump"));
116	+	$("omni-strip").hidden = false;
117	+	$("omni-here").hidden = false;
118	+	$("omni").value = "";
119	+	$("omni-cwd").hidden = false;
120	+	$("omni-cwd").textContent = "~/Code/browser-terminal-extension";
121	+	top.hidden = true;
122	+	document.body.classList.add("has-windows");
123	+	drawGroups();
124	+	} else {
125	+	top.hidden = false;
126	+	top.prepend($("reconnect"), $("settings-toggle"));
127	+	top.insertBefore($("status-text"), $("sessions"));
128	+	top.append($("session-new"), $("session-name"));
129	+	row.prepend($("pick"), $("jump"));
130	+	row.append($("tab-new"));
131	+	$("omni-strip").hidden = true;
132	+	document.body.classList.remove("has-windows");
133	+	drawWindows();
134	+	}
135	+	}
136	+
137	+	function drawGroups() {
138	+	const strip = $("tabs");
139	+	strip.textContent = "";
140	+	for (const s of SESSIONS) {
141	+	const hue = HUES[s.name];
142	+	const chip = document.createElement("button");
143	+	chip.className =
144	+	`group-chip${s.selected ? " current" : ""}${hue < 0 ? " grey" : ""}`;
145	+	chip.style.setProperty("--group-h", String(hue));
146	+	chip.setAttribute("aria-expanded", "true");
147	+	const caret = document.createElement("span");
148	+	caret.className = "caret";
149	+	chip.appendChild(caret);
150	+	const n = document.createElement("span");
151	+	n.className = "name";
152	+	n.textContent = s.name;
153	+	chip.appendChild(n);
154	+	strip.appendChild(chip);
155	+	const windows = s.selected ? WINDOWS : [{ index: 1, name: "shell", active: true }];
156	+	for (const w of windows) strip.appendChild(windowTab(w, s.selected && w.active));
157	+	}
158	+	}
159	+
160	+	function drawWindows() {
161	+	const strip = $("tabs");
162	+	strip.textContent = "";
163	+	for (const w of WINDOWS) strip.appendChild(windowTab(w, w.active));
164	+	}
165	+
166	+	function windowTab(w, current) {
167	+	const slot = document.createElement("div");
168	+	slot.className = `tab-slot closable${current ? " active" : ""}` +
169	+	`${w.active && !current ? " elsewhere" : ""}`;
170	+	const b = document.createElement("button");
171	+	b.className = "tab";
172	+	b.setAttribute("role", "tab");
173	+	b.setAttribute("aria-selected", String(!!current));
174	+	const g = document.createElement("span");
175	+	g.className = `glyph ${w.state ?? "none"}`;
176	+	g.textContent = GLYPH[w.state ?? "none"];
177	+	b.appendChild(g);
178	+	const n = document.createElement("span");
179	+	n.className = "name";
180	+	n.textContent = w.name;
181	+	b.appendChild(n);
182	+	slot.appendChild(b);
183	+	return slot;
184	+	}
185	+
186	+	const toggle = document.createElement("button");
187	+	toggle.id = "mode";
188	+	toggle.textContent = "switch to tab groups";
189	+	let mode = "nested";
190	+	toggle.addEventListener("click", () => {
191	+	mode = mode === "nested" ? "groups" : "nested";
192	+	toggle.textContent = `switch to ${mode === "nested" ? "tab groups" : "nested tabs"}`;
193	+	setMode(mode);
194	+	});
195	+	document.body.appendChild(toggle);
196	+	})();
197	+	</script>
198	+	</body>
199	+	</html>

⋯ 238 unchanged lines
239	239		return {
240	240		rect: { x: r.left, y: r.top, width: r.width, height: r.height },
241	241		viewport: { w: window.innerWidth, h: window.innerHeight },
	242	+	// Where this viewport sits on the screen. Only the split view needs it:
	243	+	// it says which half of the window the pick came from.
	244	+	screenX: window.screenX,
242	245		css: cssSelector(el),
243	246		xpath: xpath(el),
244	247		id: el.id \|\| null,
⋯ 11 unchanged lines

⋯ 8 unchanged lines
9	9		<body>
10	10		<div id="reveal-strip"></div>
11	11
	12	+	<!-- Two rows of tabs, nested the way tmux itself nests: sessions on top,
	13	+	and under them the windows of whichever session is selected. The
	14	+	session row is where you are; the window row is where your keystrokes
	15	+	go. Both are populated from the daemon's status frames, which describe
	16	+	the whole tmux server and not just the session we are attached to. -->
12	17		<header>
	18	+	<!-- The rows, and beside them a corner column that spans all of them. The
	19	+	rows are the tmux part of the header; the corner is the panel's own
	20	+	hand-sized control, kept out of every row so it can be as big as a
	21	+	thumb needs rather than as tall as a row allows. -->
	22	+	<div id="rows">
	23	+	<div class="strip" id="session-strip">
13	24		<!-- The panel's own controls, held together at the left edge so the tab
14	25		strip owns the rest of the row and grows rightwards into it.
15	26		Reconnect appears only when it is actually actionable; theme and
⋯ 9 unchanged lines
25	36		</svg>
26	37		</button>
27	38
	39	+	<!-- A chevron rather than a menu glyph, in the same corner and with the
	40	+	same shape as the one Chrome hangs its tab-search popup off: what it
	41	+	opens is a card that floats over the terminal, so the icon says which
	42	+	way it goes and flips over while it is down. -->
	43	+	<button id="settings-toggle" class="icon" title="Settings"
	44	+	aria-haspopup="dialog" aria-expanded="false" aria-controls="settings">
	45	+	<svg viewBox="0 0 16 16" aria-hidden="true">
	46	+	<path d="M4 6.5l4 4 4-4" fill="none" stroke="currentColor"
	47	+	stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"/>
	48	+	</svg>
	49	+	</button>
	50	+
	51	+	<!-- The socket's state in words, and only while there is no session tab
	52	+	to stand in for it: tabs that are live are the "connected" light,
	53	+	and a disconnect empties them and puts this back. The ↻ button beside
	54	+	it appears on the same condition. -->
	55	+	<span id="status-text">disconnected</span>
	56	+
	57	+	<!-- One tab per tmux session. Clicking one runs switch-client, which
	58	+	moves the client this panel already has: the terminal below stays
	59	+	connected and nothing is re-spawned. The count is its window count,
	60	+	and the glyph is the loudest thing Claude Code is doing anywhere in
	61	+	it — which is the reason the daemon reports every session and not
	62	+	only the attached one. -->
	63	+	<div id="sessions" role="tablist" aria-label="tmux sessions" hidden></div>
	64	+
	65	+	<button id="session-new" class="icon" hidden
	66	+	title="New session Drop a window here to give it a session of its own">
	67	+	<svg viewBox="0 0 16 16" aria-hidden="true">
	68	+	<path d="M3.5 8h9M8 3.5v9" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"/>
	69	+	</svg>
	70	+	</button>
	71	+
	72	+	<!-- Named inline instead of in a dialog: a modal in this panel would
	73	+	block the socket's message handler for as long as it is up. -->
	74	+	<input id="session-name" type="text" placeholder="new session" spellcheck="false"
	75	+	autocomplete="off" hidden />
	76	+
	77	+	</div>
	78	+
	79	+	<div class="strip" id="window-strip">
	80	+	<!-- The one control in the header that acts on the page rather than on
	81	+	anything tmux owns, and it leads the window row, immediately left of
	82	+	jump: the two are the pair you reach for while working in a pane —
	83	+	one brings the page into the pane, the other takes you to the pane
	84	+	that wants you — so they sit together and away from the tabs. -->
28	85		<button id="pick" class="icon" title="Pick an element on the page (Esc cancels)">
29	86		<svg viewBox="0 0 16 16" aria-hidden="true">
30	87		<circle cx="8" cy="8" r="3.1" fill="none" stroke="currentColor" stroke-width="1.6"/>
⋯ 2 unchanged lines
33	90		</svg>
34	91		</button>
35	92
36		-	<button id="settings-toggle" class="icon" title="Settings">
	93	+	<!-- Second in the window row, right of the picker: it walks the panes an
	94	+	agent is waiting in, loudest first and never the one it last sent you
	95	+	to. Tinted by the state it would take you to, so the button says
	96	+	whether there is anywhere to go before you press it. -->
	97	+	<button id="jump" class="icon" title="No Claude panes" disabled>
37	98		<svg viewBox="0 0 16 16" aria-hidden="true">
38		-	<path d="M2 4.5h12M2 8h12M2 11.5h12" stroke="currentColor"
39		-	stroke-width="1.6" stroke-linecap="round"/>
40		-	<circle cx="5.5" cy="4.5" r="1.9" fill="currentColor"/>
41		-	<circle cx="10.5" cy="11.5" r="1.9" fill="currentColor"/>
	99	+	<path d="M3.4 3.6l4.2 4.4-4.2 4.4M8.4 3.6l4.2 4.4-4.2 4.4"
	100	+	fill="none" stroke="currentColor" stroke-width="1.6"
	101	+	stroke-linecap="round" stroke-linejoin="round"/>
42	102		</svg>
43	103		</button>
44	104
45		-	<!-- The session the tabs belong to. Switching here moves the live tmux
46		-	client (switch-client), so the terminal below stays connected and
47		-	nothing is re-spawned. It also carries the session name that the
48		-	status text used to, since the tabs push that out of the row.
49		-
50		-	Dot and select are one chip so the session reads as a control and not
51		-	as another tab: the chip is a recessed pill with a full border, where
52		-	a tab is borderless and the selected one is lifted onto the
53		-	terminal's background. Same row, opposite direction. -->
54		-	<div id="session-chip">
55		-	<span id="status" class="dot off" title="disconnected"></span>
56		-	<select id="session-switch" title="tmux session" hidden></select>
57		-	</div>
58		-
59		-	<!-- Only while there is no session name to stand in for it. -->
60		-	<span id="status-text">disconnected</span>
61		-
62		-	<!-- One tab per window in the attached session, browser-style: the active
	105	+	<!-- One tab per window in the selected session, browser-style: the active
63	106		tab is lifted to the terminal's own background so the two read as one
64	107		surface, and the dot in its favicon slot is what Claude Code is doing
65	108		in that window. Clicking a tab runs select-window — the same thing
66	109		`prefix 2` does in the terminal, and it moves every client watching
67		-	the session, because a window belongs to the session and not to us.
68		-	Populated from the daemon's status frames. -->
	110	+	the session, because a window belongs to the session and not to us. -->
69	111		<div id="tabs" role="tablist" aria-label="tmux windows" hidden></div>
70	112
71	113		<button id="tab-new" class="icon" title="New window" hidden>
⋯ 2 unchanged lines
74	116		</svg>
75	117		</button>
76	118
	119	+	</div>
	120	+
	121	+	<!-- Tab group mode only. With every window on the server in one row, the
	122	+	row is the wrong place to look something up — it scrolls, and past a
	123	+	handful of sessions what you want is off the end of it. So the row
	124	+	gets an address bar under it, the way a browser does: type, and the
	125	+	same set the tabs are drawn from is searched by name.
	126	+
	127	+	It is also where a session is made, which is why there is no second
	128	+	"+" beside the window one: a browser has no "new profile" button next
	129	+	to "new tab" either — you type the thing you want and it takes you
	130	+	there, or offers to create it. -->
	131	+	<div class="strip" id="omni-strip" hidden>
	132	+	<!-- An address bar, and the same two jobs: it says where you are, and it
	133	+	is how you go somewhere else. Where you are is the session name, and
	134	+	it is the box's own text rather than a label beside it — focusing
	135	+	selects the whole of it, so typing replaces it and Enter takes you
	136	+	to whatever you typed, or offers to create it.
	137	+
	138	+	Left of the caret is the button a browser puts in that same spot —
	139	+	what was the padlock and is now a pair of sliders — doing the same
	140	+	job: what the box says in a word, said properly. There it is the
	141	+	origin and its certificate; here it is the session, its working
	142	+	directory, and what is running in it.
	143	+
	144	+	The glyph is Chrome's, deliberately: this is the one control in the
	145	+	panel whose position is borrowed outright, and borrowing the position
	146	+	without the mark leaves people hunting for a padlock. The session's
	147	+	colour is not on it — the tab row above already says which group we
	148	+	are in, and a second copy of that hue in the box competes with it for
	149	+	the same glance. It appears again inside the panel, where it names
	150	+	what you have just opened. -->
	151	+	<div id="omni-box">
	152	+	<button id="omni-here" type="button" hidden
	153	+	aria-haspopup="dialog" aria-expanded="false"
	154	+	aria-label="Session info" title="Session info">
	155	+	<svg viewBox="0 0 16 16" aria-hidden="true">
	156	+	<path d="M2.2 5.5h1.6M8.2 5.5h5.6" stroke="currentColor"
	157	+	stroke-width="1.5" stroke-linecap="round"/>
	158	+	<circle cx="6" cy="5.5" r="1.9" fill="none" stroke="currentColor" stroke-width="1.5"/>
	159	+	<path d="M2.2 10.5h5.6M12.2 10.5h1.6" stroke="currentColor"
	160	+	stroke-width="1.5" stroke-linecap="round"/>
	161	+	<circle cx="10" cy="10.5" r="1.9" fill="none" stroke="currentColor" stroke-width="1.5"/>
	162	+	</svg>
	163	+	</button>
	164	+	<!-- A plain text input. Not a combobox: it does not fill itself in and
	165	+	there is no value to commit — what it holds is a query, and the list
	166	+	under it is results, so Enter runs a result rather than accepting a
	167	+	completion. The list announces itself instead. -->
	168	+	<input id="omni" type="text"
	169	+	aria-label="Jump to a window, name a new session, or run a command with !"
	170	+	placeholder="Jump, create or !run…"
	171	+	title="Jump to a window, session or Claude pane — type a name to create a session, or !command to run one in a new window"
	172	+	spellcheck="false" autocomplete="off" />
	173	+	<!-- The other half of what an address bar says: not just which session,
	174	+	but where it is. The name alone never tells you that, and it is the
	175	+	thing you want to know before typing a command into the box below.
	176	+	It rides on the right, dimmed, and steps out of the way the moment
	177	+	the box turns into a query — the query needs the width more than a
	178	+	directory you are about to leave does. -->
	179	+	<span id="omni-cwd" hidden></span>
	180	+	</div>
	181	+	</div>
	182	+	</div>
	183	+
	184	+	<!-- The corner, spanning every row there is. One control lives here, and
	185	+	it is the only one in the panel that is held rather than tapped: a
	186	+	finger stays on it for the length of a sentence, and sliding off it
	187	+	mid-word is the failure that matters. So it gets a square of its own
	188	+	out of the rows' reach and fills it, which is the only way a touch
	189	+	target in this header gets past a row's height.
	190	+
	191	+	Held, not clicked: it holds the space bar down in the pane for as long
	192	+	as your finger is on it, which is what Claude Code's voice mode listens
	193	+	for. A sidebar has no key to hold — the terminal is the thing with
	194	+	focus — so this is the panel's own. -->
	195	+	<div id="corner">
	196	+	<button id="talk" class="icon big" aria-pressed="false"
	197	+	title="Hold to talk — holds space down in the pane">
	198	+	<svg viewBox="0 0 16 16" aria-hidden="true">
	199	+	<rect x="5.7" y="1.6" width="4.6" height="8" rx="2.3"
	200	+	fill="none" stroke="currentColor" stroke-width="1.5"/>
	201	+	<path d="M3.4 7.4a4.6 4.6 0 0 0 9.2 0" fill="none" stroke="currentColor"
	202	+	stroke-width="1.5" stroke-linecap="round"/>
	203	+	<path d="M8 12.1v2.3" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/>
	204	+	</svg>
	205	+	</button>
	206	+
	207	+	<!-- No Enter button beside the mic: letting go of it is the send. The
	208	+	button used to be here because a voice message that cannot be sent is
	209	+	not worth dictating, and the keyboard is exactly what your hand is off
	210	+	when it is on the mic — but the hold now queues the Return itself, so
	211	+	the second button was pressing a key that had already been pressed. -->
	212	+	</div>
77	213		</header>
78	214
	215	+	<!-- Outside the header and positioned over the terminal: the header is a
	216	+	flex column that sizes the terminal, so a list that grew inside it
	217	+	would reflow the terminal on every keystroke. Deliberately not a
	218	+	<dialog> and nothing modal — a modal in this panel would block the
	219	+	socket's message handler for as long as it is up. -->
	220	+	<div id="omni-list" aria-live="polite" aria-label="Matches" hidden></div>
	221	+
79	222		<div id="picked" hidden>
80	223		<div class="picked-top">
81	224		<span id="picked-tag" class="chip"></span>
⋯ 24 unchanged lines
106	249
107	250		<div id="term"></div>
108	251
109		-	<aside id="settings" hidden>
	252	+	<!-- A card hung off the chevron rather than a drawer at the foot of the
	253	+	panel — the shape Chrome gives the popup on the other end of that same
	254	+	chevron. Positioned out of flow deliberately: as a flex item it sized
	255	+	the terminal, so every open and close re-fit xterm.js and reflowed the
	256	+	scrollback. Nothing modal about it, for the reason a modal here can't
	257	+	be: it would block the socket's message handler while it is up. -->
	258	+	<aside id="settings" role="dialog" aria-label="Settings" hidden>
	259	+	<div class="settings-head">
	260	+	<span class="title">Settings</span>
	261	+	<button id="settings-close" class="icon" title="Close" aria-label="Close settings">
	262	+	<svg viewBox="0 0 16 16" aria-hidden="true">
	263	+	<path d="M4 4l8 8M12 4l-8 8" stroke="currentColor"
	264	+	stroke-width="1.6" stroke-linecap="round"/>
	265	+	</svg>
	266	+	</button>
	267	+	</div>
	268	+
110	269		<h2>Pair this extension</h2>
111	270		<p class="hint">Run this once, then restart the daemon:</p>
112	271		<pre id="pair-cmd">loading…</pre>
⋯ 20 unchanged lines
133	292		</div>
134	293		<p class="hint" id="density-hint"></p>
135	294
	295	+	<!-- Two ways to lay out the same tmux server. Nested keeps the two rows
	296	+	this panel was built around; groups folds them into one, the way
	297	+	Chrome folds many tabs into a coloured group chip. -->
	298	+	<div class="row" id="tabmode-row">
	299	+	<select id="tabmode-select" title="How sessions and windows are laid out">
	300	+	<option value="nested">Nested tabs</option>
	301	+	<option value="groups">Tab groups</option>
	302	+	</select>
	303	+	</div>
	304	+	<p class="hint" id="tabmode-hint"></p>
	305	+
136	306		<div class="row" id="font-row">
137	307		<span class="hint">Font size</span>
138	308		<button id="font-smaller" class="icon" title="Smaller (Ctrl+Alt+- or Ctrl+wheel)">
⋯ 37 unchanged lines
176	346		<script src="lib/theme.js"></script>
177	347		<script src="lib/sanitize.js"></script>
178	348		<script src="lib/shot.js"></script>
	349	+	<script src="lib/split.js"></script>
179	350		<script src="picker.js"></script>
180	351		<script src="vendor/xterm.js"></script>
181	352		<script src="vendor/addon-fit.js"></script>
⋯ 3 unchanged lines

⋯ 13 unchanged lines
14	14		// Chrome's service worker starts empty; Firefox loads picker.js alongside this
15	15		// file via background.scripts, so there it is already defined.
16	16		if (typeof tbPickElement === "undefined" && typeof importScripts === "function") {
17		-	importScripts("picker.js", "lib/shot.js");
	17	+	importScripts("picker.js", "lib/shot.js", "lib/split.js");
18	18		}
19	19
20	20		// Chrome only: make the toolbar button open the side panel.
⋯ 12 unchanged lines
33	33		return;
34	34		}
35	35
36		-	let value = null;
37		-	try {
38		-	const results = await api.scripting.executeScript({
39		-	target: { tabId: tab.id },
40		-	func: tbPickElement,
41		-	});
42		-	value = results?.[0]?.result ?? null;
43		-	} catch (e) {
44		-	console.error("termbridge: pick failed", e);
45		-	return;
46		-	}
	36	+	// Both halves of a split view, when this is one. The activeTab grant the
	37	+	// command just minted covers only the active half, so the partner half is
	38	+	// reachable only where its origin was granted — Split.racePick treats that
	39	+	// refusal as one runner dropping out, not as the pick failing.
	40	+	const targets = (await Split.pickTargets(api, tab)).filter((t) => !SKIP.test(t.url ?? ""));
	41	+	const { tabId, value, error } = await Split.racePick(api, targets, tbPickElement);
	42	+	if (error) console.error("termbridge: pick failed", error);
47	43		if (!value) return;
48	44
49	45		// Screenshot here rather than in the sidebar: this path's page access comes
50	46		// from the activeTab grant the keyboard command just minted, and that grant
51	47		// belongs to the worker.
52		-	const shot = await Shot.copyPickedShot(api, tab.id, value);
	48	+	const shot = await Shot.copyPickedShot(api, tabId, value);
53	49		if (shot !== true) console.warn("termbridge: no screenshot", shot);
54	50
55	51		// The sidebar may not be open. Try to hand it over directly, and fall back to
⋯ 5 unchanged lines
61	57		}
62	58		}
63	59
64		-	api.commands?.onCommand.addListener((command) => {
	60	+	// --- the toggle shortcut -----------------------------------------------------
	61	+	//
	62	+	// Neither browser will tell us whether the panel is open, so the panel tells
	63	+	// us: it holds a port open for as long as it is alive and reports its own
	64	+	// focus over it. That state has to be here rather than fetched on demand,
	65	+	// because opening a side panel is only allowed during a user gesture, and a
	66	+	// round trip to the panel and back outlives the gesture the shortcut minted.
	67	+	//
	68	+	// The port carries three fixed commands and no data. It is deliberately not a
	69	+	// second route into the terminal — see the note at the top of sidebar.js.
	70	+
	71	+	/** @type {Map<number, { port: TbPort, focused: boolean }>} */
	72	+	const panels = new Map();
	73	+
	74	+	api.runtime.onConnect.addListener((port) => {
	75	+	if (port.name !== "sidebar") return;
	76	+	// Content scripts can connect too. Ours is an extension page: no sender.tab.
	77	+	if (port.sender?.tab \|\| port.sender?.id !== api.runtime.id) {
	78	+	port.disconnect();
	79	+	return;
	80	+	}
	81	+	/** @type {number \| null} */
	82	+	let windowId = null;
	83	+	port.onMessage.addListener((msg) => {
	84	+	if (msg?.type === "hello" && typeof msg.windowId === "number") {
	85	+	windowId = /** @type {number} */ (msg.windowId);
	86	+	panels.set(windowId, { port, focused: !!msg.focused });
	87	+	// The shortcut that opened this panel asked for the jump box, and there
	88	+	// was nothing here to ask at the time. This connection is the panel
	89	+	// arriving; the request is only good for the panel that open call was
	90	+	// for, so it is spent whether or not it was this one.
	91	+	const asked = pendingOmnibar.get(windowId);
	92	+	pendingOmnibar.delete(windowId);
	93	+	if (asked != null && Date.now() - asked < PENDING_OMNIBAR_MS) {
	94	+	port.postMessage({ type: "omnibar" });
	95	+	}
	96	+	} else if (msg?.type === "focus" && windowId != null) {
	97	+	const entry = panels.get(windowId);
	98	+	if (entry?.port === port) entry.focused = !!msg.focused;
	99	+	}
	100	+	});
	101	+	port.onDisconnect.addListener(() => {
	102	+	if (windowId != null && panels.get(windowId)?.port === port) panels.delete(windowId);
	103	+	});
	104	+	});
	105	+
	106	+	// Chrome only allows opening the panel while the gesture that the command
	107	+	// minted is still live, and a single `await` — even one that resolves
	108	+	// immediately — spends it. So everything from the command listener down to the
	109	+	// open call is synchronous, and the window id comes from the tab the listener
	110	+	// hands us rather than from a windows.getLastFocused() round trip.
	111	+	/** @param {number} windowId */
	112	+	function openPanel(windowId) {
	113	+	const opened = api.sidePanel?.open
	114	+	? api.sidePanel.open({ windowId })
	115	+	: api.sidebarAction?.open();
	116	+	// Chrome still rejects if the gesture was somehow already spent; that is not
	117	+	// worth an unhandled rejection in the worker's console.
	118	+	Promise.resolve(opened).catch((e) => console.warn("termbridge: cannot open panel", e));
	119	+	}
	120	+
	121	+	// Chrome hands the panel the keyboard when it opens it and at no other time:
	122	+	// there is no API to focus a panel that is already up, and `autofocus` does
	123	+	// nothing in one. So the only way to point the keyboard at an open panel is to
	124	+	// make it a panel Chrome is opening — take it away and put it back.
	125	+	//
	126	+	// The catch is the same gesture rule as above, from the other side: there is no
	127	+	// sidePanel.close() to call, and closing it the only way there is — asking the
	128	+	// panel to close itself — is a round trip that spends the gesture the reopen
	129	+	// needs. Disabling the panel closes it without asking anyone, so all three
	130	+	// calls are issued here, unawaited and in order, while the gesture is live.
	131	+	//
	132	+	// The panel document does not survive this, and that is the whole cost: the
	133	+	// terminal is a tmux client, so a new one reattaches to the same session with
	134	+	// its scrollback intact on the server. What the user sees is a flicker.
	135	+	//
	136	+	// Experimental — this leans on Chrome running the three in the order they were
	137	+	// issued. Set false to go back to leaving an open panel where it is.
	138	+	const REOPEN_TO_FOCUS = true;
	139	+
	140	+	/** @param {number} windowId */
	141	+	function reopenPanelForFocus(windowId) {
	142	+	const sidePanel = api.sidePanel;
	143	+	if (!REOPEN_TO_FOCUS \|\| !sidePanel?.setOptions) {
	144	+	// Firefox reaches the same end by a shorter road: sidebarAction.open()
	145	+	// focuses the sidebar whether or not it was already showing.
	146	+	openPanel(windowId);
	147	+	return;
	148	+	}
	149	+	const quiet = (/** @type {unknown} */ e) => console.warn("termbridge: panel reopen", e);
	150	+	Promise.resolve(sidePanel.setOptions({ enabled: false })).catch(quiet);
	151	+	Promise.resolve(sidePanel.setOptions({ enabled: true, path: "sidebar.html" })).catch(quiet);
	152	+	openPanel(windowId);
	153	+	}
	154	+
	155	+	/** @param {number \| undefined} windowId */
	156	+	function toggleSidebar(windowId) {
	157	+	// Firefox only started passing the tab to command listeners in 106; without
	158	+	// it the gesture is lost, but sidebarAction has no such restriction.
	159	+	if (windowId == null) {
	160	+	api.windows.getLastFocused().then((w) => toggleSidebar(w.id));
	161	+	return;
	162	+	}
	163	+	const entry = panels.get(windowId);
	164	+
	165	+	if (!entry) {
	166	+	openPanel(windowId);
	167	+	return;
	168	+	}
	169	+
	170	+	if (entry.focused) {
	171	+	// Firefox can close its own sidebar; Chrome has no close API, so the panel
	172	+	// closes itself with window.close().
	173	+	if (api.sidebarAction?.close) api.sidebarAction.close();
	174	+	else entry.port.postMessage({ type: "close" });
	175	+	return;
	176	+	}
	177	+
	178	+	// Open but focus is elsewhere — put the caret back in the terminal. The
	179	+	// panel is already showing, so the open call is only there to hand it focus.
	180	+	entry.port.postMessage({ type: "focus" });
	181	+	openPanel(windowId);
	182	+	}
	183	+
	184	+	// A jump box asked for while the panel was closed, by window and when. The
	185	+	// panel takes a moment to come up and connect, so the request has to outlive
	186	+	// the shortcut that made it — but only just: a panel arriving much later is
	187	+	// one the user opened themselves, and it should come up on the terminal like
	188	+	// any other.
	189	+	/** @type {Map<number, number>} */
	190	+	const pendingOmnibar = new Map();
	191	+	const PENDING_OMNIBAR_MS = 10_000;
	192	+
	193	+	// Put the caret in the panel's jump bar. Same port and the same reasoning as
	194	+	// the toggle: whether the panel is open is state only the panel can report.
	195	+	/** @param {number \| undefined} windowId */
	196	+	function focusOmnibar(windowId) {
	197	+	if (windowId == null) {
	198	+	api.windows.getLastFocused().then((w) => focusOmnibar(w.id));
	199	+	return;
	200	+	}
	201	+	const entry = panels.get(windowId);
	202	+
	203	+	// Not open. The panel is the only thing that can put the caret anywhere, so
	204	+	// the request is left here for it to pick up when it connects — and this is
	205	+	// the one path where the caret reliably lands, because a panel Chrome is
	206	+	// opening for the first time is a panel Chrome hands the keyboard to.
	207	+	if (!entry) {
	208	+	pendingOmnibar.set(windowId, Date.now());
	209	+	openPanel(windowId);
	210	+	return;
	211	+	}
	212	+
	213	+	// Open and already holding the keyboard: the panel it has is the one that
	214	+	// takes the caret, and nothing has to move for it to be typed into.
	215	+	if (entry.focused) {
	216	+	entry.port.postMessage({ type: "omnibar" });
	217	+	return;
	218	+	}
	219	+
	220	+	// Open, but the keyboard is on the page. Telling this panel to focus its box
	221	+	// would put a caret in a window nothing is typing into, so the request is
	222	+	// left for the panel that comes back and the panel is taken away and
	223	+	// reopened — the one move that makes Chrome hand the keyboard over.
	224	+	pendingOmnibar.set(windowId, Date.now());
	225	+	reopenPanelForFocus(windowId);
	226	+	}
	227	+
	228	+	// --- handing a tab to Claude in Chrome ---------------------------------------
	229	+	//
	230	+	// Not the Claude the rest of termbridge means: that one is Claude Code in a
	231	+	// tmux pane, reached through the daemon. This is the browser extension, and it
	232	+	// only drives tabs that sit inside its own tab group — a tab outside that group
	233	+	// is invisible to it. Membership is the entire gate, so handing a page over is
	234	+	// a tabs.group() call and nothing else.
	235	+	//
	236	+	// Which group is Claude's is a question only the user can answer. The group
	237	+	// carries no title to match on — Claude's comes back untitled — so
	238	+	// `set-claude-group` records the active tab's group id, and until that has
	239	+	// happened a single group in the browser is taken to be the one.
	240	+	//
	241	+	// Chrome only: Firefox has no tab group API, so api.tabGroups is undefined
	242	+	// there and both commands no-op.
	243	+
	244	+	const CLAUDE_GROUP_KEY = "claudeGroupId";
	245	+
	246	+	/** @returns {Promise<TbTabGroup \| null>} */
	247	+	async function resolveClaudeGroup() {
	248	+	const tabGroups = api.tabGroups;
	249	+	if (!tabGroups) return null;
	250	+
	251	+	const stored = (await api.storage.local.get(CLAUDE_GROUP_KEY))[CLAUDE_GROUP_KEY];
	252	+	if (typeof stored === "number") {
	253	+	try {
	254	+	return await tabGroups.get(stored);
	255	+	} catch {
	256	+	// Recorded group has been closed since. Fall through and rediscover.
	257	+	}
	258	+	}
	259	+
	260	+	const groups = await tabGroups.query({});
	261	+	if (groups.length === 1) {
	262	+	await api.storage.local.set({ [CLAUDE_GROUP_KEY]: groups[0].id });
	263	+	return groups[0];
	264	+	}
	265	+	return null;
	266	+	}
	267	+
	268	+	async function handTabToClaude() {
	269	+	const groupTabs = api.tabs.group;
	270	+	if (!groupTabs) return;
	271	+
	272	+	const [tab] = await api.tabs.query({ active: true, currentWindow: true });
	273	+	if (!tab \|\| typeof tab.id !== "number") return;
	274	+	// The same pages the picker cannot touch are pages Claude cannot drive.
	275	+	if (SKIP.test(tab.url ?? "")) {
	276	+	console.warn("termbridge: Claude cannot drive this page", tab.url);
	277	+	return;
	278	+	}
	279	+
	280	+	const group = await resolveClaudeGroup();
	281	+	if (!group) {
	282	+	console.warn(
	283	+	"termbridge: no Claude group recorded — put a tab in Claude's group and run set-claude-group",
	284	+	);
	285	+	return;
	286	+	}
	287	+	if (tab.groupId === group.id) return;
	288	+
	289	+	try {
	290	+	// group() will not reach across windows, and Claude's group usually sits in
	291	+	// one of its own, so the tab has to travel first.
	292	+	if (tab.windowId !== group.windowId) {
	293	+	await api.tabs.move(tab.id, { windowId: group.windowId, index: -1 });
	294	+	}
	295	+	await groupTabs({ groupId: group.id, tabIds: [tab.id] });
	296	+	await api.tabs.update(tab.id, { active: true });
	297	+	await api.windows.update(group.windowId, { focused: true });
	298	+	} catch (e) {
	299	+	console.error("termbridge: could not hand the tab over", e);
	300	+	}
	301	+	}
	302	+
	303	+	async function setClaudeGroup() {
	304	+	if (!api.tabGroups) return;
	305	+
	306	+	const [tab] = await api.tabs.query({ active: true, currentWindow: true });
	307	+	// Chrome reports -1 for a tab that is in no group.
	308	+	if (!tab \|\| typeof tab.groupId !== "number" \|\| tab.groupId < 0) {
	309	+	console.warn("termbridge: this tab is in no group — drag it into Claude's group first");
	310	+	return;
	311	+	}
	312	+	await api.storage.local.set({ [CLAUDE_GROUP_KEY]: tab.groupId });
	313	+	console.info("termbridge: Claude group set to", tab.groupId);
	314	+	}
	315	+
	316	+	api.commands?.onCommand.addListener((command, tab) => {
65	317		if (command === "pick-element") runPicker();
	318	+	if (command === "toggle-terminal") toggleSidebar(tab?.windowId);
	319	+	if (command === "focus-omnibar") focusOmnibar(tab?.windowId);
	320	+	if (command === "hand-tab-to-claude") handTabToClaude();
	321	+	if (command === "set-claude-group") setClaudeGroup();
66	322		});

⋯ 11 unchanged lines
12	12
13	13		interface TbTab {
14	14		id?: number;
	15	+	windowId?: number;
15	16		url?: string;
16	17		title?: string;
	18	+	/** The split view this tab is half of, if any — Chrome 140+, and read-only:
	19	+	the API detects splits, it cannot create or dissolve them. Absent in
	20	+	Firefox, which has no split view at all. */
	21	+	splitViewId?: number;
	22	+	/** The tab group this tab belongs to, or -1 for none. Chrome only. This is
	23	+	the whole gate on whether Claude in Chrome can see the tab. */
	24	+	groupId?: number;
17	25		}
18	26
	27	+	/** A Chrome tab group. Carries no stable identity beyond its id — the title is
	28	+	whatever the user (or another extension) last set, and is often empty, so it
	29	+	is not something to match on. */
	30	+	interface TbTabGroup {
	31	+	id: number;
	32	+	windowId: number;
	33	+	title?: string;
	34	+	}
	35	+
19	36		interface TbInjectionResult<T = unknown> {
20	37		result?: T;
21	38		frameId?: number;
⋯ 6 unchanged lines
28	45		tab?: TbTab;
29	46		}
30	47
	48	+	/** A long-lived connection. Only the toggle shortcut uses one — sidebar.js and
	49	+	sw.js are the two ends, and it carries three fixed command shapes. */
	50	+	interface TbPort {
	51	+	name: string;
	52	+	/** Set on the receiving end only, and set for content scripts exactly as
	53	+	TbMessageSender.tab is. */
	54	+	sender?: TbMessageSender;
	55	+	postMessage(message: any): void;
	56	+	disconnect(): void;
	57	+	onMessage: { addListener(cb: (message: any) => void): void };
	58	+	onDisconnect: { addListener(cb: () => void): void };
	59	+	}
	60	+
	61	+	interface TbWindow {
	62	+	id: number;
	63	+	/** Screen position of the window's left edge. Only the split-view crop reads
	64	+	it, to work out which half of the window a pick came from. */
	65	+	left?: number;
	66	+	}
	67	+
31	68		interface TbStorageArea {
32	69		get(keys?: string \| string[] \| null): Promise<Record<string, any>>;
33	70		set(items: Record<string, any>): Promise<void>;
⋯ 9 unchanged lines
43	80		cb: (message: any, sender: TbMessageSender) => void \| boolean \| Promise<any>,
44	81		): void;
45	82		};
	83	+	connect(info: { name: string }): TbPort;
	84	+	onConnect: { addListener(cb: (port: TbPort) => void): void };
46	85		};
47	86		storage: { local: TbStorageArea };
	87	+	windows: {
	88	+	/** The window the calling document lives in — the sidebar's own. */
	89	+	getCurrent(): Promise<TbWindow>;
	90	+	/** The worker has no window of its own, so the shortcut acts on this one. */
	91	+	getLastFocused(): Promise<TbWindow>;
	92	+	/** Only used to raise the window a handed-over tab just landed in. */
	93	+	update(windowId: number, props: { focused: boolean }): Promise<TbWindow>;
	94	+	};
48	95		tabs: {
49		-	query(info: { active?: boolean; currentWindow?: boolean }): Promise<TbTab[]>;
	96	+	query(info: {
	97	+	active?: boolean;
	98	+	currentWindow?: boolean;
	99	+	/** Chrome throws on this key rather than ignoring it where it isn't
	100	+	supported, so every call that passes it is wrapped. */
	101	+	splitViewId?: number;
	102	+	}): Promise<TbTab[]>;
50	103		create(props: { url: string }): Promise<TbTab>;
	104	+	/** Only used to make a tab active, which needs no permission. captureVisibleTab
	105	+	has no tabId of its own, so a split-view pick has to be activated first. */
	106	+	update(tabId: number, props: { active: boolean }): Promise<TbTab>;
51	107		/** The visible area of the active tab, as a PNG data URL. Needs a host
52	108		permission for the page, exactly as the picker's injection does. */
53	109		captureVisibleTab(options: { format: "png" }): Promise<string>;
	110	+	/** Chrome only, and needs "tabGroups". Adds tabs to an existing group; the
	111	+	tabs must already be in that group's window. */
	112	+	group?(options: { groupId: number; tabIds: number[] }): Promise<number>;
	113	+	/** Only used to carry a tab into the window Claude's group lives in, since
	114	+	group() will not reach across windows. */
	115	+	move(tabId: number, props: { windowId: number; index: number }): Promise<TbTab \| TbTab[]>;
54	116		};
	117	+	/** Chrome only — Firefox has no tab group API at all, which is what makes the
	118	+	handoff a Chrome-only feature. */
	119	+	tabGroups?: {
	120	+	get(groupId: number): Promise<TbTabGroup>;
	121	+	query(info: { windowId?: number }): Promise<TbTabGroup[]>;
	122	+	};
55	123		permissions: {
56	124		request(perms: { origins?: string[]; permissions?: string[] }): Promise<boolean>;
57	125		};
⋯ 21 unchanged lines
79	147		setPanelBehavior?(behavior: {
80	148		openPanelOnActionClick: boolean;
81	149		}): Promise<void>;
	150	+	/** Chrome only, and only during a user gesture. There is no close(): the
	151	+	panel closes itself with window.close(). */
	152	+	open?(options: { windowId: number }): Promise<void>;
	153	+	/** Disabling is the only way to close a panel from here — the panel it
	154	+	applies to goes away without being asked. Without a tabId it is the
	155	+	default for every tab, which is how this extension declares it. */
	156	+	setOptions?(options: { tabId?: number; path?: string; enabled?: boolean }): Promise<void>;
	157	+	};
	158	+	/** Firefox only — the counterpart to Chrome's sidePanel. Unlike Chrome's, it
	159	+	can close the sidebar as well as open it. */
	160	+	sidebarAction?: {
	161	+	open(): Promise<void>;
	162	+	close(): Promise<void>;
82	163		};
83	164		/** Absent when no keyboard shortcuts are declared in the manifest. */
84	165		commands?: {
85		-	onCommand: { addListener(cb: (command: string) => void): void };
	166	+	/** The tab is the active one at the time of the shortcut. Chrome always
	167	+	passes it; Firefox only since 106, so treat it as optional. It is the
	168	+	only way to learn the window id without an `await`, which on Chrome
	169	+	would spend the gesture sidePanel.open() needs. */
	170	+	onCommand: {
	171	+	addListener(cb: (command: string, tab?: TbTab) => void): void;
	172	+	};
86	173		};
87	174		}
88	175
⋯ 10 unchanged lines
99	186		// Everything here arrives over a socket. It is claimed structure, not
100	187		// guaranteed structure, and it is only ever assigned through textContent.
101	188
	189	+	/** One tmux session — one tab in the top row. */
102	190		interface TbSessionInfo {
	191	+	/** tmux session id (`$1`). Empty on the `ok` frame, which has names only. */
	192	+	id: string;
103	193		name: string;
104		-	/** Window count. 0 when it isn't known yet — the `ok` frame sends names only. */
105		-	windows: number;
106	194		/** Some tmux client, anywhere, is on this session. */
107	195		attached: boolean;
	196	+	/** The group colour, from the `@termbridge_color` tmux user option: a hue in
	197	+	degrees as a string, or "-1" for grey. Absent when nobody has chosen one,
	198	+	which is what tells the panel to pick. */
	199	+	color?: string \| null;
	200	+	/** Working directory of the session's current pane. Absent on the `ok` frame
	201	+	and whenever tmux has no pane to answer for. */
	202	+	path?: string \| null;
	203	+	/** When tmux made the session, in Unix seconds. */
	204	+	created?: number \| null;
	205	+	/** How many tmux clients are attached to it. */
	206	+	clients?: number;
	207	+	/** Its windows, in index order. Empty until the first status frame. */
	208	+	windows: TbWindowInfo[];
108	209		}
109	210
110		-	/** One window of the attached session — one tab. */
	211	+	/** One window of a session — one tab in the second row. */
111	212		interface TbWindowInfo {
112	213		/** tmux window id (`@3`). Stable; the index is not. */
113	214		id: string;
⋯ 4 unchanged lines
118	219		activity: boolean;
119	220		}
120	221
	222	+	/**
	223	+	* What an agent is doing. The header's glyph slot takes this plus `"none"` — its
	224	+	* own name for "no agent here", which it needs because every row has the slot
	225	+	* whether or not anything is in it.
	226	+	*/
	227	+	type TbAgentState = "working" \| "waiting" \| "ready" \| "idle" \| "unknown";
	228	+
121	229		interface TbAgent {
122	230		/** tmux pane id (`%12`), stable for the pane's lifetime. */
123	231		pane: string;
	232	+	/** Session name — the join to TbSessionInfo, since agents are server-wide. */
	233	+	session: string;
124	234		/** tmux window id (`@3`) — the join to TbWindowInfo. */
125	235		window_id: string;
126	236		window: string;
127	237		name: string;
128		-	state: "working" \| "waiting" \| "idle" \| "unknown";
	238	+	/**
	239	+	* `ready` is the one no hook reports: an idle agent whose pane has not been
	240	+	* on screen since it went idle. The daemon derives it — see `SEEN` in
	241	+	* daemon/src/status.rs.
	242	+	*/
	243	+	state: TbAgentState;
	244	+	/**
	245	+	* This pane is the one on screen under the sidebar — our client's session,
	246	+	* active window, active pane. The panel is told about panes and never about
	247	+	* its own, so this is the only "you are here" it gets.
	248	+	*/
	249	+	here?: boolean;
129	250		mode?: string \| null;
130	251		tool?: string \| null;
131	252		message?: string \| null;
⋯ 11 unchanged lines
143	264		defaultSession?: string;
144	265		/** Names only — window counts arrive with the first status frame. */
145	266		sessions?: string[];
	267	+	/**
	268	+	* Machines to offer in the omnibar, from the daemon's `~/.ssh/config` and
	269	+	* `~/.ssh/known_hosts`. Here rather than on the status frames because it
	270	+	* comes from files that do not change while a panel is open.
	271	+	*/
	272	+	hosts?: string[];
146	273		}
147	274
148		-	/** Pushed whenever tmux says something changed. */
	275	+	/**
	276	+	* Pushed whenever tmux says something changed. It describes the whole server:
	277	+	* every session with its own windows, and every agent in any of them.
	278	+	*/
149	279		interface TbStatusFrame {
150	280		type: "status";
	281	+	/** The session this panel's client is on right now. */
151	282		session?: string;
152	283		sessions?: TbSessionInfo[];
153		-	/** Windows of `session`, in index order. */
154		-	windows?: TbWindowInfo[];
155	284		agents?: TbAgent[];
156	285		}
157	286
	287	+	/**
	288	+	* One directory, in answer to `{type:"path", q}` — the only frame the panel
	289	+	* asks for rather than being told. Built in daemon/src/server.rs from
	290	+	* `project::Listing`.
	291	+	*/
	292	+	interface TbPathFrame {
	293	+	type: "path";
	294	+	/** The query, echoed back: replies can land after the box has moved on. */
	295	+	q: string;
	296	+	/** The expanded, absolute path. Empty when the query was not one. */
	297	+	path: string;
	298	+	/** "invalid" is a query the daemon would not expand — relative, `..`,
	299	+	someone else's `~`. */
	300	+	kind: "dir" \| "file" \| "missing" \| "denied" \| "invalid";
	301	+	/** Directories `mkdir -p` would have to create to make this path. */
	302	+	creates: number;
	303	+	/** Directory names inside it, sorted, visible ones before hidden. */
	304	+	dirs: string[];
	305	+	/** The other names. Only used to tell a file apart from a path to create. */
	306	+	files: string[];
	307	+	}
	308	+
158	309		type TbFrame =
159	310		\| TbOkFrame
160	311		\| TbStatusFrame
	312	+	\| TbPathFrame
161	313		\| { type: "exit"; code: number }
162	314		\| { type: "error"; reason: string }
163	315		\| { type: "tmux-error"; reason: string };
164	316
165	317		/** The element's box in CSS pixels, relative to the viewport. */
	318	+	/** Where a pick's viewport sits in its window, which is how the crop tells the
	319	+	two halves of a split view apart. Both in screen coordinates. */
	320	+	interface TbPane {
	321	+	screenX: number;
	322	+	winLeft: number;
	323	+	}
	324	+
166	325		interface TbPickedRect {
167	326		x: number;
168	327		y: number;
⋯ 11 unchanged lines
180	339		rect?: TbPickedRect;
181	340		/** Viewport size at pick time, which fixes the screenshot's scale factor. */
182	341		viewport?: { w: number; h: number };
	342	+	/** Screen position of the viewport's left edge. Absent on picks made before
	343	+	0.0.2; only a split view needs it. */
	344	+	screenX?: number;
183	345		css: string;
184	346		xpath: string;
185	347		id: string \| null;
⋯ 62 unchanged lines
248	410		declare const Themes: typeof import("../lib/theme.js");
249	411		declare const Sanitize: typeof import("../lib/sanitize.js");
250	412		declare const Shot: typeof import("../lib/shot.js");
	413	+	declare const Split: typeof import("../lib/split.js");
251	414
252	415		/** Set by picker.js inside the page, not here — see cancelPick(). */
253	416		interface Window {
⋯ 2 unchanged lines