Struct InProcess 

pub struct InProcess { /* private fields */ }

The native in-process multiplexer backend.

Implementations

impl InProcess

pub fn new() -> Self

pub fn set_spawn_env(&self, env: SpawnEnv)

Set the embedder’s typed env + cwd override, applied to every subsequent child PTY’s env AFTER the inherited + fallback env. mado calls this with its caps::EnvProjection pairs (+ the boot cwd) so vim in an embedded-tear window sees xterm-ghostty + truecolor + the vendored terminfo — identical to the local-PTY path. Idempotent; the last write wins.

pub fn spawn_cwd(&self) -> Option<PathBuf>

The embedder’s current spawn cwd override (SpawnEnv.cwd), if any.

mado stamps this per-spawn (the focused pane’s cwd / boot cwd) before each new_session, so the daemon can read it at session- create time to learn which directory a session was opened in — the seed for praça’s project↔session binding (M1 “Remember”). None when no embedder cwd override is set (the bare-daemon path).

pub fn set_socket_path(&self, path: PathBuf)

Record the UDS path the daemon bound to. Subsequent PTY spawns stamp TEAR_SOCKET=<path> on the child env. Called by tear-daemon::start* immediately after bind.

pub fn socket_path(&self) -> Option<PathBuf>

Borrow the recorded socket path, if any.

pub fn enable_pane_recording(&self, pane_id: PaneId) -> ControlResult<()>

Enable recording for pane_id. Idempotent — calling on an already-enabled pane resets the recording buffer (per PaneRecording::enable semantics). Reads the pane’s current size from the registry for the asciinema header.

pub fn disable_pane_recording(&self, pane_id: PaneId) -> ControlResult<()>

Stop recording for pane_id. The captured buffer is retained until the next enable or kill_pane; the operator can still export after stopping.

pub fn export_pane_recording(&self, pane_id: PaneId) -> ControlResult<String>

Export the pane’s captured recording as asciinema v2 .cast (JSON-lines). Returns an empty string when nothing has been captured yet (recording was never enabled or the pane has no events).

pub fn pane_recording_status( &self, pane_id: PaneId, ) -> ControlResult<(bool, u32)>

(is_enabled, event_count) snapshot — driven by the pane-info / pane-record-status ergonomics.

pub fn pane_blocks_list( &self, pane_id: PaneId, since_index: u64, limit: u32, ) -> ControlResult<Vec<Block>>

List captured blocks for a pane (oldest-first). Filters by since_index — pass 0 to get every retained block. The daemon currently caps at 10_000 blocks per pane (ring eviction). Returns NoSuchPane if the pane has no grid.

pub fn pane_block_at(&self, pane_id: PaneId, index: u64) -> ControlResult<Block>

Fetch one block by per-pane index. Returns NoSuchPane if the pane is gone, or the InvalidArgument variant via Rejected when the block has been evicted / never existed.

pub fn pane_blocks_status(&self, pane_id: PaneId) -> ControlResult<(u32, bool)>

(total_completed_blocks, current_in_progress) — useful for status displays. tear top reads this column.

pub fn subscribe_pane_bytes( &self, pane: PaneId, ) -> ControlResult<Receiver<Vec<u8>>>

Register a byte-stream subscriber for the named pane. Returns the receiver end of an mpsc::channel; every PTY chunk that lands in this pane is sent on the corresponding sender. Drop the receiver to unsubscribe — the next send will error and the daemon prunes the dead sender.

Returns NoSuchPane if the pane has no PTY (never spawned or already killed).

If the pane’s child has already exited (remain-on-exit dead pane), the returned receiver is born already-disconnected: no live sender is registered, so the consumer can replay the pane’s final grid snapshot and then immediately observe end-of-stream (recv() -> Err) instead of blocking forever on a pane that will never emit again. The closed check and the sender push happen under the same lock, so a subscribe that races with the pane’s exit can’t leak a sender that never disconnects.

pub fn with_registry<R>(&self, f: impl FnOnce(&Registry) -> R) -> R

Borrow the registry read-only — useful for callers that want to scan multiple entities atomically without locking per-call.

pub fn pane_snapshot(&self, pane_id: PaneId) -> ControlResult<PaneSnapshot>

Return a serializable snapshot of the named pane’s rendered grid. Returns NoSuchPane if the pane never had a grid installed (which can only happen if it never had a PTY — every PTY-spawning code path also installs a grid).

pub fn pane_cursor_keys_mode(&self, pane_id: PaneId) -> ControlResult<bool>

No-alloc DECCKM lookup — reads one bool off the live PaneGrid rather than building a full PaneSnapshot. Mado’s embedded-tear input loop hits this on every arrow keystroke; the snapshot path would clone the entire cell grid (~100KB per call on an 80×40 pane).

pub fn reap_proven_dead_session(&self, proof: AllPanesExited) -> bool

Remove a session the caller has proven dead — every pane’s child process has exited.

This is the only way for a daemon to end a session on its own initiative, and AllPanesExited is the only ticket in. A rule keyed on “nobody is attached”, on an idle timer, or on the session’s tear_types::SessionSource cannot construct one — see crate::reap for the incident that motivated the narrowing.

Returns true if the session was removed. false means the proof went stale between witnessing and now (a new_window landed, or an explicit kill_session won the race) — the proof is re-taken under the write lock, so a resurrected session is never reaped.

Call with no registry guard held. Mint the proof from an owned TearSession (list_sessions() / get_session() both clone) or from a read() bound to its own let statement. Passing a proof witnessed inside a still-live read guard deadlocks on the write() below — parking_lot’s RwLock is not reentrant and this thread would be waiting for itself.

impl InProcess

pub fn set_freio( &self, session: Option<SessionId>, engaged: bool, ) -> (Vec<(SessionId, Freio)>, Vec<PaneId>, Vec<PaneId>)

Engage or release the operator’s brake — see tear_types::freio.

session: None means every session; that is the one-gesture panic path. Returns, in order: every session’s state after the call, the panes actually braked, and — critically — the panes the brake could NOT reach because their provenance is unknown.

That third list is not diagnostics. An operator who pressed a panic button must be told what it did not stop, or they will believe everything halted.

at_unix is stamped HERE, from the daemon’s clock. No caller supplies it, so a backdated brake has no code path.

pub fn freio_state(&self) -> Vec<(SessionId, Freio)>

Every session’s brake state.

impl InProcess

Provenance-aware spawn verbs.

Inherent rather than trait methods: MultiplexerControl is implemented by backends with no provenance model (the tmux backend), and widening the trait would force them to carry a concept they cannot honour. The trait verbs delegate here with Yurai::Unknown.

pub fn new_session_yurai( &self, name: &str, shell: &str, args: &[String], source: SessionSource, size_cells: (u16, u16), yurai: Yurai, ) -> ControlResult<SessionId>

Spawn a session, recording WHO asked. See tear_types::yurai.

pub fn new_window_yurai( &self, session: SessionId, name: &str, shell: &str, args: &[String], yurai: Yurai, ) -> ControlResult<WindowId>

Open a window, recording WHO asked.

pub fn split_pane_yurai( &self, origin: PaneId, direction: Direction, shell: &str, args: &[String], yurai: Yurai, ) -> ControlResult<PaneId>

Split a pane, recording WHO asked.

The new pane inherits the provenance of the CONNECTION that asked for the split, not of the pane it split from: an operator splitting an agent’s pane gets their own pane, and the brake leaves it alone.

Trait Implementations

impl Default for InProcess

fn default() -> Self

Returns the “default value” for a type.

impl MultiplexerControl for InProcess

fn pane_snapshot(&self, id: PaneId) -> ControlResult<PaneSnapshot>

Phase-2 override of the trait’s default pane_snapshot. Delegates to the inherent Self::pane_snapshot method, which reads the per-pane PaneGrid installed by Self::spawn_pty_for.

fn pane_cursor_keys_mode(&self, id: PaneId) -> ControlResult<bool>

Override the trait default with the no-alloc lookup — mado’s input loop calls this per keystroke, so the fast path matters here.

fn pane_resize_absolute( &self, id: PaneId, cols: u16, rows: u16, ) -> ControlResult<()>

Phase-3.1 override — resize the underlying PTY (fires SIGWINCH at the child) AND resize the per-pane PaneGrid so subsequent snapshots reflect the new geometry.

fn list_sessions(&self) -> ControlResult<Vec<TearSession>>

List every active session. Sorted by creation time (oldest first); the CLI’s tear list renders this directly.

fn get_session(&self, id: SessionId) -> ControlResult<TearSession>

Look up a single session by id.

fn get_window(&self, id: WindowId) -> ControlResult<(SessionId, TearWindow)>

Look up a single window. Returns the window + its parent session id (handy for rendering window paths like work:1).

fn get_pane(&self, id: PaneId) -> ControlResult<TearPane>

Look up a single pane.

fn new_session_with_source_and_size( &self, name: &str, shell: &str, args: &[String], source: SessionSource, size_cells: (u16, u16), ) -> ControlResult<SessionId>

Same as Self::new_session_with_source but the first pane is created at the given (cols, rows) size. The child shell’s TIOCGWINSZ returns these values on first query — TUI apps render at the correct grid from the very first prompt, no resize-flicker on attach.

fn new_window( &self, session: SessionId, name: &str, shell: &str, args: &[String], ) -> ControlResult<WindowId>

Create a new window in a session, spawning shell as its first pane. args is that program’s argv[1..] — passed as a vector, never through a shell. &[] for a bare shell.

fn split_pane( &self, origin: PaneId, direction: Direction, shell: &str, args: &[String], ) -> ControlResult<PaneId>

Split a pane in the given direction. shell is the program spawned in the new pane and args is its argv[1..] — passed as a vector, never through a shell. &[] for a bare shell.

fn rename_session(&self, id: SessionId, new_name: &str) -> ControlResult<()>

Rename a session. Idempotent — renaming to the current name returns Ok(()) without side effects.

fn kill_session(&self, id: SessionId) -> ControlResult<()>

Kill a session and all its children.

fn kill_window(&self, id: WindowId) -> ControlResult<()>

fn select_window(&self, id: WindowId) -> ControlResult<()>

fn kill_pane(&self, id: PaneId) -> ControlResult<()>

fn select_pane(&self, id: PaneId) -> ControlResult<()>

fn resize_pane( &self, id: PaneId, direction: Direction, delta_cells: i16, ) -> ControlResult<()>

Resize a pane along one axis. delta_cells is signed — negative shrinks. tmux’s resize-pane -L/-R/-U/-D.

fn apply_layout(&self, window: WindowId, kind: LayoutKind) -> ControlResult<()>

Re-arrange a window’s existing panes into a named LayoutKind preset (tmux select-layout). The panes keep their PTYs and scrollback — only the window’s layout tree changes, then geometry reflows. LayoutKind::Custom (and an empty window) is a no-op: there is no canonical arrangement to impose, so the operator’s manual tree wins. Built on LayoutNode::from_kind.

fn send_keys(&self, id: PaneId, bytes: &[u8]) -> ControlResult<()>

Send keystrokes (already-bytes-encoded — caller resolved the chord) to a pane’s PTY.

fn pane_subscriber_count(&self, id: PaneId) -> ControlResult<u32>

How many byte-stream subscribers are currently attached to the named pane. Returns 0 if the pane has no subscribers (or doesn’t exist — wraps the typed NoSuchPane miss into a 0 count so the migration call site doesn’t have to distinguish “no subscribers” from “pane gone”).

fn set_input_policy(&self, id: PaneId, policy: InputPolicy) -> ControlResult<()>

Replace a pane’s typed crate::pane::InputPolicy. Default behavior is Free; setting Locked causes every subsequent send_keys for that pane to return ControlError::Rejected. Idempotent — same policy is a no-op.

fn capabilities(&self) -> DaemonIdentity

What this backend can actually do, and who it is.

fn new_session( &self, name: &str, shell: &str, ) -> Result<SessionId, ControlError>

Create a new session. name is the operator-visible label; the returned SessionId is the stable handle. Defaults to SessionSource::Human — agent-driven consumers (mado MCP, automation) should call Self::new_session_with_source so tear list --source can audit provenance.

fn new_session_with_source( &self, name: &str, shell: &str, source: SessionSource, ) -> Result<SessionId, ControlError>

Create a session with a typed [SessionSource] tag. The daemon stores this on the TearSession so tear list can group by provenance and operators can audit agent-created sessions.