Let deliberate terminal use claim shared sizing

[mariusvniekerk]

A workspace terminal can be open in several browsers—or on desktop and mobile—but tmux still has only one effective geometry. A background view can otherwise leave the session sized for a screen nobody is actively using, causing stale wrapping and row/column behavior in the view the user is actually looking at.

This change makes deliberate use the ownership signal. Typing, pasting, terminal pointer interaction, or deliberately resizing its pane transfers size ownership to that view. Passive browser reflow only updates fallback geometry, so merely opening or laying out another view does not steal control. If the owner goes away, an eligible active view takes over with its last known size.

sequenceDiagram
    autonumber
    participant V as View in use
    participant O as Ownership coordinator
    participant T as Terminal / tmux

    Note over V,O: Passive reflow updates this view's fallback size only<br/>Ownership does not change
    Note over V: Deliberate input or<br/>effective pane resize
    Note over V,O: Before the claim, another browser may own the size
    V->>O: claim_resize(current columns, rows)
    O->>O: Replace owner with this view
    O->>T: Apply winning geometry
    T-->>O: Resize settled
    O-->>V: Claim acknowledged
    opt Terminal input triggered the claim
        V->>T: Forward triggering input
    end
    Note over V,T: Latest deliberate action wins<br/>across desktop and mobile views

Loading

^{generated by a clanker}

[roborev-ci]

roborev: Combined Review (ea75f4e)

The resize-ownership change has three medium-severity correctness issues affecting PTY sizing and input ordering.

Medium

• frontend/src/lib/components/terminal/XtermTerminalPane.svelte:670 — Deliberate geometry changes emit claim_resize for every terminal endpoint, but workspace-level handlers in internal/terminal accept only resize. They silently discard the frame, leaving the PTY at its previous dimensions while subsequent identical measurements are suppressed. Restrict claim_resize to runtime-session endpoints, or make both workspace terminal bridges handle it as a resize and add full-stack coverage for the workspace route.

• internal/workspace/localruntime/manager.go:2274 — A lower-priority attachment returns before checking whether the current PTY resize generation is unsettled. If a local owner sends an asynchronous resize and an HTTP Fleet viewer then types, the Fleet claim returns false, and its input is forwarded without waiting for tmux settlement. Preserve ownership priority, but return the pending generation for active non-owner claims so the caller refreshes tmux before forwarding input.

• frontend/src/lib/components/terminal/XtermTerminalPane.svelte:1001 — Input forwarding ignores a failed claimTerminalResize(). During direct-session replay, resizeReady remains false until replay_ready, allowing keystrokes or pasted input to be sent without a resize claim or settlement; an incomplete retained terminal sequence can leave this window open indefinitely. Queue or suppress input until resize claiming is ready, then enqueue the claim before releasing buffered input.

---

Reviewers: 2 done | Synthesis: codex, 12s | Total: 6m35s

[roborev-ci]

roborev: Combined Review (8c30b03)

Terminal resize settlement has two medium-severity gaps that can allow input to reach the PTY before geometry settles.

Medium

• internal/workspace/localruntime/manager.go:2274 — A lower-priority attachment’s resize claim returns before checking for an unsettled resize from the current higher-priority owner. Fleet HTTP input can therefore reach tmux while a recent local resize remains pending. For every valid active claim, request settlement of any outstanding resize generation; only applying the claimant’s dimensions should remain priority-gated.

• frontend/src/lib/components/terminal/XtermTerminalPane.svelte:1007 — Input is forwarded even when claimTerminalResize() returns false. Local runtime connections keep resizeReady=false until replay parsing finishes, so typing, paste, wheel, or binary input during that window can reach the PTY without claiming ownership or settling geometry. Delay forwarding until the resize claim can be enqueued, or explicitly resolve/cancel the replay boundary before claiming and forwarding deliberate input.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 9m50s

[roborev-ci]

roborev: Combined Review (ed32765)

The change is generally sound, but one medium-severity resize-ownership issue remains.

Medium

• Passive viewers can steal terminal resize ownership — frontend/src/lib/components/terminal/XtermTerminalPane.svelte:1007

  onData includes automatic terminal-protocol replies, not only user input. When process output triggers a reply such as a cursor-position response, every visible viewer may send claim_resize, allowing a passive or unfocused browser to take ownership nondeterministically.

  Fix: Claim ownership only through trusted user-gesture paths such as pointer, keyboard, paste, and wheel events. Forward automatic onData and onBinary replies without claiming. Add a two-view full-stack test confirming that a terminal-generated query does not transfer ownership.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 10m9s