[Init] Initial commit - NetMesh terminal manager

components/terminal/osc7Setup.ts

@@ -0,0 +1,819 @@
+export const OSC7_MARKER = "Netcatty OSC 7 cwd tracking";
+
+export const OSC7_SETUP_TARGETS = [
+  "~/.bashrc",
+  "${ZDOTDIR:-~}/.zshrc",
+  "~/.config/fish/config.fish",
+] as const;
+
+export const OSC7_SETUP_SHELL_MARKER = "__NETCATTY_OSC7_SETUP_SHELL__=";
+export const OSC7_SETUP_CONFIG_MARKER = "__NETCATTY_OSC7_SETUP_CONFIG__=";
+// Emitted when the silent exec-channel setup finds the active terminal shell
+// owned by another user (after `su` / `sudo su`); the exec channel cannot
+// configure that shell, so the renderer retypes the setup inside the terminal
+// where it runs as the target user (#1942).
+export const OSC7_SETUP_OTHER_USER_MARKER = "__NETCATTY_OSC7_SETUP_OTHER_USER_SHELL__=";
+
+export type Osc7SetupActionContext = {
+  protocol?: string;
+  isLocalConnection?: boolean;
+  isSerialConnection?: boolean;
+  isNetworkDevice?: boolean;
+};
+
+export type Osc7SetupShell = "bash" | "zsh" | "fish";
+
+export type Osc7SetupMetadata = {
+  shell: Osc7SetupShell;
+  configPath: string;
+};
+
+export type Osc7SetupRunResult = {
+  success: boolean;
+  pending?: boolean;
+  stdout?: string;
+  stderr?: string;
+  code?: number | null;
+  error?: string;
+  reloadCommand?: string;
+  /** Setup was retyped into the terminal for a user-switched (su/sudo) shell. */
+  sentToTerminal?: boolean;
+};
+
+export type RunOsc7SetupActionOptions = {
+  status: string;
+  sessionId: string;
+  setupCommand: string;
+  setupOsc7Tracking?: (
+    sessionId: string,
+    command: string,
+  ) => Promise<Osc7SetupRunResult>;
+  writeToSession: (
+    sessionId: string,
+    data: string,
+    options?: {
+      automated?: boolean;
+      logRewrite?: { sentCommand: string; displayCommand: string };
+    },
+  ) => void;
+  writeLocalTerminalData?: (data: string) => void;
+};
+
+export const shouldOfferOsc7SetupAction = ({
+  protocol,
+  isLocalConnection,
+  isSerialConnection,
+  isNetworkDevice,
+}: Osc7SetupActionContext): boolean =>
+  !isLocalConnection
+  && !isSerialConnection
+  && !isNetworkDevice
+  && protocol !== "telnet";
+
+const DOLLAR = "$";
+
+const URL_PATH_AWK_SCRIPT = String.raw`BEGIN {
+  for (i = 0; i < 256; i++) {
+    c = sprintf("%c", i)
+    ord[c] = i
+  }
+}
+{
+  if (NR > 1) encode("\n")
+  for (i = 1; i <= length($0); i++) {
+    encode(substr($0, i, 1))
+  }
+}
+function encode(c, o) {
+  o = ord[c]
+  if ((o >= 48 && o <= 57) || (o >= 65 && o <= 90) || (o >= 97 && o <= 122) || c == "/" || c == "-" || c == "." || c == "_" || c == "~") {
+    printf "%s", c
+  } else {
+    printf "%%%02X", o
+  }
+}`;
+
+const quoteForSingleQuotedShellString = (value: string): string =>
+  `'${value.replace(/'/g, `'\\''`)}'`;
+
+const URL_PATH_AWK_SCRIPT_QUOTED = quoteForSingleQuotedShellString(URL_PATH_AWK_SCRIPT);
+
+const BASH_DELETE_MARKED_HISTORY_COMMAND = String.raw`if test -n "${DOLLAR}{BASH_VERSION-}"; then __netcatty_osc7_history_cleanup_marker__=1; __netcatty_osc7_history_line=$(HISTTIMEFORMAT= builtin history 1 2>/dev/null) || __netcatty_osc7_history_line=""; case "$__netcatty_osc7_history_line" in *__netcatty_osc7_history_cleanup_marker__=1*) __netcatty_osc7_history_number=$(printf "%s\n" "$__netcatty_osc7_history_line" | sed "s/^ *\([0-9][0-9]*\).*/\1/"); case "$__netcatty_osc7_history_number" in ""|*[!0-9]*) ;; *) builtin history -d "$__netcatty_osc7_history_number" 2>/dev/null || true;; esac;; esac; unset __netcatty_osc7_history_cleanup_marker__ __netcatty_osc7_history_line __netcatty_osc7_history_number 2>/dev/null || true; fi`;
+
+const POSIX_SETUP_SCRIPT = String.raw`set -eu
+marker="# >>> Netcatty OSC 7 cwd tracking >>>"
+SELF=$$
+expected_cwd="${DOLLAR}{NETCATTY_OSC7_EXPECTED_CWD:-}"
+forced_shell="${DOLLAR}{NETCATTY_OSC7_FORCE_SHELL:-}"
+
+find_login_shell() {
+  _shell=$(ps -e -o pid=,ppid=,tty=,comm= 2>/dev/null | awk -v pp="$1" -v self="$SELF" '
+    $1 != self && $2 == pp && $4 ~ /^-?(ba|z|fi|k|da|a)?sh$/ {
+      if ($3 != "?") { print $1; found=1; exit }
+      if (any == "") any=$1
+    }
+    END { if (!found && any != "") print any }
+  ')
+  [ -n "$_shell" ] && { echo "$_shell"; return; }
+  [ -r "/proc/$SELF/environ" ] || return
+  _conn=$(tr '\0' '\n' < "/proc/$SELF/environ" 2>/dev/null | sed -n 's/^SSH_CONNECTION=//p' | head -n1)
+  [ -z "$_conn" ] && return
+  _any=""
+  for _d in /proc/[0-9]*; do
+    _pid=$(basename "$_d")
+    [ "$_pid" = "$SELF" ] && continue
+    [ -r "$_d/environ" ] || continue
+    _conn2=$(tr '\0' '\n' < "$_d/environ" 2>/dev/null | sed -n 's/^SSH_CONNECTION=//p' | head -n1)
+    [ "$_conn2" = "$_conn" ] || continue
+    _comm=$(cat "$_d/comm" 2>/dev/null)
+    case "$_comm" in
+      sh|bash|zsh|fish|ksh|dash|ash) ;;
+      *) continue ;;
+    esac
+    _tty=$(ps -p "$_pid" -o tty= 2>/dev/null | tr -d '[:space:]')
+    if [ "$_tty" != "?" ] && [ -n "$_tty" ]; then
+      echo "$_pid"
+      return
+    fi
+    [ -z "$_any" ] && _any="$_pid"
+  done
+  [ -n "$_any" ] && echo "$_any"
+}
+
+find_active_shell() {
+  ps -e -o pid=,ppid=,stat=,comm= 2>/dev/null | awk -v start="$1" '
+    { pp[$1]=$2; st[$1]=$3; cm[$1]=$4; ord[NR]=$1 }
+    function isshell(c) { return c ~ /^-?(ba|z|fi|k|da|a)?sh$/ }
+    function depth(p,   d) { d=0; while (p != "" && d < 64) { if (p == start) return d; p=pp[p]; d++ } return -1 }
+    END {
+      best=-1; bp="";
+      for (i=1; i<=NR; i++) {
+        p=ord[i];
+        if (!isshell(cm[p])) continue;
+        if (index(st[p], "+") == 0) continue;
+        d=depth(p); if (d < 0) continue;
+        if (d > best) { best=d; bp=p }
+      }
+      print (bp != "" ? bp : start)
+    }
+  '
+}
+
+read_proc_env_value() {
+  [ -r "$1" ] || return 1
+  tr '\0' '\n' < "$1" 2>/dev/null | sed -n "s/^$2=//p" | head -n1
+}
+
+active_shell_pid=""
+login_shell_pid=""
+if [ -z "$forced_shell" ] && [ -d /proc ]; then
+  login_shell_pid=$(find_login_shell "$PPID" || true)
+  if [ -n "$login_shell_pid" ]; then
+    active_shell_pid=$(find_active_shell "$login_shell_pid" || true)
+    [ -n "$active_shell_pid" ] || active_shell_pid="$login_shell_pid"
+  fi
+fi
+
+# After su / sudo su the foreground shell belongs to another user. This exec
+# channel runs as the login user, so it can neither verify nor configure that
+# shell (ptrace-scoped /proc access). Report the target shell so the caller
+# can retype the setup inside the terminal, where it runs as that user (#1942).
+if [ -n "$active_shell_pid" ]; then
+  active_uid=$(sed -n "s/^Uid:[[:space:]]*\([0-9]*\).*/\1/p" "/proc/$active_shell_pid/status" 2>/dev/null | head -n1 || true)
+  self_uid=$(id -u 2>/dev/null || true)
+  if [ -n "$active_uid" ] && [ -n "$self_uid" ] && [ "$active_uid" != "$self_uid" ]; then
+    other_shell=$(cat "/proc/$active_shell_pid/comm" 2>/dev/null | sed "s/^-//" | tr -d "[:space:]" || true)
+    printf '%s%s\n' '${OSC7_SETUP_OTHER_USER_MARKER}' "${DOLLAR}{other_shell:-unknown}"
+    printf "Netcatty OSC 7 setup: the active terminal shell belongs to another user\n" >&2
+    exit 5
+  fi
+fi
+
+if [ -d /proc ] && [ -n "$expected_cwd" ]; then
+  if [ -z "$active_shell_pid" ]; then
+    printf "Netcatty OSC 7 setup: could not identify the active terminal shell\n" >&2
+    exit 4
+  fi
+  active_cwd=$(readlink "/proc/$active_shell_pid/cwd" 2>/dev/null || true)
+  if [ "$active_cwd" != "$expected_cwd" ]; then
+    printf "Netcatty OSC 7 setup: active terminal shell did not match the current tab\n" >&2
+    exit 4
+  fi
+fi
+
+active_comm=""
+active_home=""
+active_shell_env=""
+active_zdotdir=""
+active_xdg_config_home=""
+if [ -n "$active_shell_pid" ]; then
+  active_comm=$(cat "/proc/$active_shell_pid/comm" 2>/dev/null | sed "s/^-//" | tr -d "[:space:]")
+  active_env_file="/proc/$active_shell_pid/environ"
+  if [ -r "$active_env_file" ]; then
+    active_home=$(read_proc_env_value "$active_env_file" HOME || true)
+    active_shell_env=$(read_proc_env_value "$active_env_file" SHELL || true)
+    active_zdotdir=$(read_proc_env_value "$active_env_file" ZDOTDIR || true)
+    active_xdg_config_home=$(read_proc_env_value "$active_env_file" XDG_CONFIG_HOME || true)
+  elif [ "$active_shell_pid" != "$login_shell_pid" ]; then
+    printf "Netcatty OSC 7 setup: cannot silently configure an active shell owned by another user\n" >&2
+    exit 3
+  fi
+fi
+
+parent_shell=$(ps -p "$PPID" -o comm= 2>/dev/null | sed "s/^-//" | tr -d "[:space:]")
+login_shell=$(basename "${DOLLAR}{active_shell_env:-${DOLLAR}{SHELL:-sh}}" | sed "s/^-//")
+shell_name="$login_shell"
+case "$parent_shell" in
+  bash|zsh|fish) shell_name="$parent_shell" ;;
+esac
+case "$active_comm" in
+  bash|zsh|fish) shell_name="$active_comm" ;;
+esac
+case "$forced_shell" in
+  bash|zsh|fish) shell_name="$forced_shell" ;;
+esac
+
+home_dir="${DOLLAR}{active_home:-$HOME}"
+zdotdir="${DOLLAR}{active_zdotdir:-${DOLLAR}{NETCATTY_ZDOTDIR:-${DOLLAR}{ZDOTDIR:-$home_dir}}}"
+xdg_config_home="${DOLLAR}{active_xdg_config_home:-${DOLLAR}{NETCATTY_XDG_CONFIG_HOME:-${DOLLAR}{XDG_CONFIG_HOME:-$home_dir/.config}}}"
+
+case "$shell_name" in
+  bash) config="$home_dir/.bashrc" ;;
+  zsh) config="$zdotdir/.zshrc" ;;
+  fish) config="$xdg_config_home/fish/config.fish" ;;
+  *)
+    printf "Netcatty OSC 7 setup: unsupported shell %s\n" "$shell_name" >&2
+    printf "Supported shells: bash, zsh, fish\n" >&2
+    exit 2
+    ;;
+esac
+
+__netcatty_osc7_url_path() {
+  printf "%s" "$1" | LC_ALL=C awk ${URL_PATH_AWK_SCRIPT_QUOTED}
+}
+
+mkdir -p "$(dirname "$config")"
+touch "$config"
+# Snippet v2: guarded prompt entry + unexport PROMPT_COMMAND so su without
+# login does not inherit a bare osc7_cwd call into another user's shell.
+snippet_version_marker="netcatty-osc7-version: 2"
+end_marker="# <<< Netcatty OSC 7 cwd tracking <<<"
+# Returns 0 when every start marker is closed by a matching end marker.
+# Markers must be whole lines (optional indent) so an echo of the marker text
+# does not count as a block boundary.
+netcatty_osc7_markers_balanced() {
+  awk -v start="$marker" -v end="$end_marker" '
+    function trim(s) {
+      sub(/^[ \t]+/, "", s)
+      sub(/[ \t]+$/, "", s)
+      return s
+    }
+    {
+      t = trim($0)
+      if (t == start) {
+        if (skip) incomplete = 1
+        else skip = 1
+        next
+      }
+      if (t == end) {
+        if (!skip) incomplete = 1
+        else skip = 0
+        next
+      }
+    }
+    END {
+      if (skip) incomplete = 1
+      exit incomplete ? 1 : 0
+    }
+  ' "$1"
+}
+
+# Returns 0 when at least one contiguous start..end region contains the v2
+# version marker line. Older malformed markers outside that region are ignored
+# so recovery appends stay idempotent.
+netcatty_osc7_has_complete_v2_block() {
+  awk -v start="$marker" -v end="$end_marker" -v ver_line="# $snippet_version_marker" '
+    function trim(s) {
+      sub(/^[ \t]+/, "", s)
+      sub(/[ \t]+$/, "", s)
+      return s
+    }
+    {
+      t = trim($0)
+      if (t == start) {
+        skip = 1
+        has_ver = 0
+        next
+      }
+      if (skip && t == ver_line) has_ver = 1
+      if (t == end) {
+        if (skip && has_ver) found = 1
+        skip = 0
+        has_ver = 0
+        next
+      }
+    }
+    END { exit found ? 0 : 1 }
+  ' "$1"
+}
+
+# Resolve config to a real path so upgrades rewrite the final target of a
+# symlink chain without replacing intermediate links.
+netcatty_osc7_resolve_path() {
+  _path="$1"
+  if command -v realpath >/dev/null 2>&1; then
+    _resolved=$(realpath "$_path" 2>/dev/null || true)
+    if [ -n "$_resolved" ]; then
+      printf '%s\n' "$_resolved"
+      return 0
+    fi
+  fi
+  _depth=0
+  while [ -L "$_path" ] && [ "$_depth" -lt 32 ]; do
+    _link=$(readlink "$_path" 2>/dev/null || true)
+    [ -n "$_link" ] || break
+    case "$_link" in
+      /*) _path="$_link" ;;
+      *) _path="$(dirname "$_path")/$_link" ;;
+    esac
+    _depth=$((_depth + 1))
+  done
+  printf '%s\n' "$_path"
+}
+
+# Best-effort portable mode bits for chmod after atomic replace.
+netcatty_osc7_file_mode() {
+  if stat -c '%a' "$1" >/dev/null 2>&1; then
+    stat -c '%a' "$1"
+  elif stat -f '%OLp' "$1" >/dev/null 2>&1; then
+    stat -f '%OLp' "$1"
+  fi
+}
+
+# Best-effort portable owner:group for chown after atomic replace.
+netcatty_osc7_file_owner() {
+  if stat -c '%u:%g' "$1" >/dev/null 2>&1; then
+    stat -c '%u:%g' "$1"
+  elif stat -f '%u:%g' "$1" >/dev/null 2>&1; then
+    stat -f '%u:%g' "$1"
+  fi
+}
+
+# Append the v2 snippet to the given file path ($1).
+netcatty_osc7_append_v2() {
+  __netcatty_osc7_dest="$1"
+  case "$shell_name" in
+    bash)
+      cat >> "$__netcatty_osc7_dest" <<'NETCATTY_OSC7_BASH'
+
+# >>> Netcatty OSC 7 cwd tracking >>>
+# netcatty-osc7-version: 2
+__netcatty_osc7_url_path() {
+  printf "%s" "$1" | LC_ALL=C awk '${URL_PATH_AWK_SCRIPT}'
+}
+osc7_cwd() {
+  printf '\033]7;file://%s%s\a' "${DOLLAR}{HOSTNAME:-localhost}" "$(__netcatty_osc7_url_path "$PWD")"
+}
+# Safe prompt hook: no-op when helpers are missing (PROMPT_COMMAND string may
+# be inherited across su without this rc file).
+__netcatty_osc7_prompt() {
+  if declare -F osc7_cwd >/dev/null 2>&1; then
+    osc7_cwd
+  fi
+}
+# Install/dedupe the guarded prompt hook for both scalar and array PROMPT_COMMAND.
+__netcatty_osc7_hook='declare -F __netcatty_osc7_prompt >/dev/null 2>&1 && __netcatty_osc7_prompt'
+# Match declare -a / -ax / -ar etc. (array flag may appear with other flags).
+if declare -p PROMPT_COMMAND 2>/dev/null | grep -Eq 'declare -[A-Za-z]*a'; then
+  __netcatty_osc7_new=()
+  __netcatty_osc7_has_hook=0
+  for __netcatty_osc7_el in "${DOLLAR}{PROMPT_COMMAND[@]}"; do
+    case "${DOLLAR}{__netcatty_osc7_el}" in
+      osc7_cwd|__netcatty_osc7_prompt) continue ;;
+      *'declare -F __netcatty_osc7_prompt'*)
+        if [ "${DOLLAR}{__netcatty_osc7_has_hook}" -eq 0 ]; then
+          __netcatty_osc7_new+=("${DOLLAR}{__netcatty_osc7_hook}")
+          __netcatty_osc7_has_hook=1
+        fi
+        ;;
+      *) __netcatty_osc7_new+=("${DOLLAR}{__netcatty_osc7_el}") ;;
+    esac
+  done
+  if [ "${DOLLAR}{__netcatty_osc7_has_hook}" -eq 0 ]; then
+    __netcatty_osc7_new+=("${DOLLAR}{__netcatty_osc7_hook}")
+  fi
+  PROMPT_COMMAND=("${DOLLAR}{__netcatty_osc7_new[@]}")
+  unset __netcatty_osc7_new __netcatty_osc7_has_hook __netcatty_osc7_el 2>/dev/null || true
+else
+  if [ -n "${DOLLAR}{PROMPT_COMMAND+x}" ]; then
+    __netcatty_osc7_pc=""
+    __netcatty_osc7_sep=""
+    while IFS= read -r __netcatty_osc7_line || [ -n "${DOLLAR}{__netcatty_osc7_line}" ]; do
+      case "${DOLLAR}{__netcatty_osc7_line}" in
+        osc7_cwd|__netcatty_osc7_prompt) continue ;;
+        *'declare -F __netcatty_osc7_prompt'*) continue ;;
+        *)
+          __netcatty_osc7_pc="${DOLLAR}{__netcatty_osc7_pc}${DOLLAR}{__netcatty_osc7_sep}${DOLLAR}{__netcatty_osc7_line}"
+          __netcatty_osc7_sep="
+"
+          ;;
+      esac
+    done <<EOF
+${DOLLAR}{PROMPT_COMMAND-}
+EOF
+    if [ -n "${DOLLAR}{__netcatty_osc7_pc}" ]; then
+      PROMPT_COMMAND="${DOLLAR}{__netcatty_osc7_pc}
+${DOLLAR}{__netcatty_osc7_hook}"
+    else
+      PROMPT_COMMAND="${DOLLAR}{__netcatty_osc7_hook}"
+    fi
+    unset __netcatty_osc7_pc __netcatty_osc7_sep __netcatty_osc7_line 2>/dev/null || true
+  else
+    PROMPT_COMMAND="${DOLLAR}{__netcatty_osc7_hook}"
+  fi
+fi
+unset __netcatty_osc7_hook 2>/dev/null || true
+# Do not force-unexport PROMPT_COMMAND: the guarded hook is safe if inherited
+# across non-login su (declare -F fails quietly), and users may intentionally
+# export PROMPT_COMMAND for child shells.
+# <<< Netcatty OSC 7 cwd tracking <<<
+NETCATTY_OSC7_BASH
+      ;;
+    zsh)
+      cat >> "$__netcatty_osc7_dest" <<'NETCATTY_OSC7_ZSH'
+
+# >>> Netcatty OSC 7 cwd tracking >>>
+# netcatty-osc7-version: 2
+__netcatty_osc7_url_path() {
+  printf "%s" "$1" | LC_ALL=C awk '${URL_PATH_AWK_SCRIPT}'
+}
+osc7_cwd() {
+  printf '\033]7;file://%s%s\a' "${DOLLAR}{HOST:-${DOLLAR}{HOSTNAME:-localhost}}" "$(__netcatty_osc7_url_path "$PWD")"
+}
+__netcatty_osc7_prompt() {
+  if typeset -f osc7_cwd >/dev/null 2>&1; then
+    osc7_cwd
+  fi
+}
+if (( ${DOLLAR}{+precmd_functions} )); then
+  precmd_functions=(${DOLLAR}{precmd_functions:#osc7_cwd})
+  case " ${DOLLAR}{precmd_functions[*]} " in
+    *" __netcatty_osc7_prompt "*) ;;
+    *) precmd_functions+=(__netcatty_osc7_prompt) ;;
+  esac
+else
+  precmd_functions=(__netcatty_osc7_prompt)
+fi
+# <<< Netcatty OSC 7 cwd tracking <<<
+NETCATTY_OSC7_ZSH
+      ;;
+    fish)
+      cat >> "$__netcatty_osc7_dest" <<'NETCATTY_OSC7_FISH'
+
+# >>> Netcatty OSC 7 cwd tracking >>>
+# netcatty-osc7-version: 2
+function __netcatty_osc7_url_path
+    printf "%s" "$argv[1]" | LC_ALL=C awk '${URL_PATH_AWK_SCRIPT}'
+end
+function __netcatty_osc7_cwd --on-event fish_prompt
+    printf '\033]7;file://%s%s\a' (hostname 2>/dev/null; or printf localhost) (__netcatty_osc7_url_path "$PWD")
+end
+# <<< Netcatty OSC 7 cwd tracking <<<
+NETCATTY_OSC7_FISH
+      ;;
+  esac
+}
+
+need_write=1
+# Whole-line marker presence only (not substring matches inside echo etc.).
+if awk -v start="$marker" '
+  function trim(s) { sub(/^[ \t]+/, "", s); sub(/[ \t]+$/, "", s); return s }
+  trim($0) == start { found = 1; exit }
+  END { exit found ? 0 : 1 }
+' "$config"; then
+  if netcatty_osc7_has_complete_v2_block "$config"; then
+    # At least one complete v2 block exists (even if older junk markers remain).
+    need_write=0
+  elif netcatty_osc7_markers_balanced "$config"; then
+    # Complete balanced block without v2 (legacy). Replace the marked region
+    # in place (not strip-then-append-at-EOF) so surrounding control flow such
+    # as if/then/fi wrappers stay valid. Build the full file in a temp, then
+    # atomically replace so read-only modes cannot lose the block without the
+    # replacement.
+    __netcatty_osc7_target=$(netcatty_osc7_resolve_path "$config")
+    __netcatty_osc7_dir=$(dirname "$__netcatty_osc7_target")
+    __netcatty_osc7_mode=$(netcatty_osc7_file_mode "$__netcatty_osc7_target" || true)
+    __netcatty_osc7_owner=$(netcatty_osc7_file_owner "$__netcatty_osc7_target" || true)
+    # Prefer same-dir atomic replace. If the directory is not writable
+    # (managed homes), fall back to append without aborting setup.
+    __netcatty_osc7_tmp=$(mktemp "$__netcatty_osc7_dir/.netcatty-osc7.XXXXXX" 2>/dev/null || true)
+    __netcatty_osc7_snip=$(mktemp "$__netcatty_osc7_dir/.netcatty-osc7-snip.XXXXXX" 2>/dev/null || true)
+    if [ -z "${DOLLAR}{__netcatty_osc7_tmp:-}" ] || [ -z "${DOLLAR}{__netcatty_osc7_snip:-}" ]; then
+      rm -f "$__netcatty_osc7_tmp" "$__netcatty_osc7_snip" 2>/dev/null || true
+      need_write=1
+    else
+    : > "$__netcatty_osc7_snip"
+    netcatty_osc7_append_v2 "$__netcatty_osc7_snip"
+    if awk -v start="$marker" -v end="$end_marker" -v snip="$__netcatty_osc7_snip" '
+      function trim(s) {
+        sub(/^[ \t]+/, "", s)
+        sub(/[ \t]+$/, "", s)
+        return s
+      }
+      {
+        t = trim($0)
+        if (t == start) {
+          while ((getline line < snip) > 0) print line
+          close(snip)
+          skip = 1
+          next
+        }
+        if (t == end) {
+          skip = 0
+          next
+        }
+        if (!skip) print
+      }
+    ' "$config" > "$__netcatty_osc7_tmp"
+    then
+      rm -f "$__netcatty_osc7_snip"
+      if [ -n "${DOLLAR}{__netcatty_osc7_mode:-}" ]; then
+        chmod "$__netcatty_osc7_mode" "$__netcatty_osc7_tmp" 2>/dev/null || true
+      fi
+      if [ -n "${DOLLAR}{__netcatty_osc7_owner:-}" ]; then
+        # If we cannot restore ownership, leave the original file untouched.
+        if ! chown "$__netcatty_osc7_owner" "$__netcatty_osc7_tmp" 2>/dev/null; then
+          rm -f "$__netcatty_osc7_tmp"
+          need_write=1
+        else
+          mv -f "$__netcatty_osc7_tmp" "$__netcatty_osc7_target"
+          need_write=0
+        fi
+      else
+        mv -f "$__netcatty_osc7_tmp" "$__netcatty_osc7_target"
+        need_write=0
+      fi
+    else
+      rm -f "$__netcatty_osc7_tmp" "$__netcatty_osc7_snip"
+      need_write=1
+    fi
+    fi
+  else
+    # Incomplete or unbalanced markers and no complete v2 yet.
+    # Never rewrite/truncate: append a complete v2 block only.
+    need_write=1
+  fi
+fi
+
+if [ "$need_write" = 1 ]; then
+  netcatty_osc7_append_v2 "$config"
+fi
+
+if [ -z "$forced_shell" ]; then
+  printf '%s%s\n' '${OSC7_SETUP_SHELL_MARKER}' "$shell_name"
+  printf '%s%s\n' '${OSC7_SETUP_CONFIG_MARKER}' "$config"
+fi
+host=$(hostname 2>/dev/null || printf localhost)
+printf '\033]7;file://%s%s\a' "$host" "$(__netcatty_osc7_url_path "$PWD")"`;
+
+export const buildOsc7SetupCommand = (): string =>
+  `set +u 2>/dev/null || true; printf "%s\\n" ${quoteForSingleQuotedShellString(POSIX_SETUP_SCRIPT)} | env NETCATTY_ZDOTDIR="$ZDOTDIR" NETCATTY_XDG_CONFIG_HOME="$XDG_CONFIG_HOME" sh\n`;
+
+export const buildOsc7SetupExecCommand = (expectedCwd?: string): string => {
+  const envPrefix = expectedCwd
+    ? `env NETCATTY_OSC7_EXPECTED_CWD=${quoteForSingleQuotedShellString(expectedCwd)} `
+    : "";
+  return `exec ${envPrefix}sh -c ${quoteForSingleQuotedShellString(POSIX_SETUP_SCRIPT)}\n`;
+};
+
+export const OSC7_SETUP_STAGED_MARKER = "__NETCATTY_OSC7_SETUP_STAGED__=";
+
+/** Exact bytes the stage command writes (printf '%s\n' appends the newline). */
+const STAGED_SETUP_SCRIPT_BYTES = `${POSIX_SETUP_SCRIPT}\n`;
+
+let stagedScriptSha256Promise: Promise<string> | null = null;
+
+/**
+ * SHA-256 (hex) of the staged setup script bytes, computed locally so the
+ * typed runner can verify the remote file was not tampered with.
+ */
+export const getOsc7StagedScriptSha256 = (): Promise<string> => {
+  if (!stagedScriptSha256Promise) {
+    stagedScriptSha256Promise = crypto.subtle
+      .digest("SHA-256", new TextEncoder().encode(STAGED_SETUP_SCRIPT_BYTES))
+      .then((digest) =>
+        Array.from(new Uint8Array(digest))
+          .map((byte) => byte.toString(16).padStart(2, "0"))
+          .join(""),
+      );
+  }
+  return stagedScriptSha256Promise;
+};
+
+/**
+ * Exec-channel command that stages the setup script into a world-readable
+ * remote temp file. Typed fallback (#1942) runs that file instead of pasting
+ * the multi-line script into the terminal: the typed command stays a single
+ * line, so it is one history entry that the bash cleanup reliably deletes.
+ */
+export const buildOsc7StageScriptCommand = (): string => {
+  const stageScript = `set -eu
+umask 022
+file=$(mktemp /tmp/.netcatty-osc7-setup.XXXXXX)
+printf '%s\\n' ${quoteForSingleQuotedShellString(POSIX_SETUP_SCRIPT)} > "$file"
+chmod 644 "$file"
+printf '%s%s\\n' '${OSC7_SETUP_STAGED_MARKER}' "$file"`;
+  return `exec sh -c ${quoteForSingleQuotedShellString(stageScript)}\n`;
+};
+
+/**
+ * POSIX runner that executes the staged script without a TOCTOU window: it
+ * reads the file into memory ONCE, deletes it, verifies the local SHA-256 of
+ * the in-memory copy, and only then pipes that same copy to sh. The staged
+ * file stays writable by the login user until this runs, so a same-uid
+ * process could otherwise swap its contents and have the su-target shell
+ * (e.g. root) execute them.
+ */
+const buildVerifiedStagedRunner = (contentSha256: string): string =>
+  `c=$(cat -- "$1" 2>/dev/null); rm -f -- "$1" 2>/dev/null; `
+  + `h=$(printf "%s\\n" "$c" | sha256sum 2>/dev/null | cut -d" " -f1); `
+  + `[ -n "$h" ] || h=$(printf "%s\\n" "$c" | shasum -a 256 2>/dev/null | cut -d" " -f1); `
+  + `[ -n "$h" ] || h=$(printf "%s\\n" "$c" | openssl dgst -sha256 2>/dev/null | sed "s/^.* //"); `
+  + `if [ "x$h" = "x${contentSha256}" ]; then printf "%s\\n" "$c" | sh; `
+  + `else printf "%s\\n" "Netcatty OSC 7 setup: staged script verification failed" >&2; fi`;
+
+/**
+ * Setup command typed into the interactive terminal itself. Used when the
+ * silent exec-channel setup cannot configure the active shell because it is
+ * owned by another user (after `su` / `sudo su`, #1942): typed input runs as
+ * that user, so the config lands in the target user's rc file and OSC 7
+ * reporting resumes for this and every future user-switched shell.
+ *
+ * The command hash-verifies and runs the staged script (see
+ * buildOsc7StageScriptCommand / buildVerifiedStagedRunner) inside a POSIX
+ * `sh -c` child, and forwards shell-local (possibly unexported) ZDOTDIR /
+ * XDG_CONFIG_HOME via the NETCATTY_* overrides the setup script already
+ * honors, mirroring buildOsc7SetupCommand.
+ */
+export const buildOsc7TypedSetupCommand = (
+  shell: Osc7SetupShell,
+  scriptPath: string,
+  contentSha256: string,
+): string => {
+  const quotedPath = quoteForSingleQuotedShellString(scriptPath);
+  const quotedRunner = quoteForSingleQuotedShellString(buildVerifiedStagedRunner(contentSha256));
+  if (shell === "bash") {
+    const run = `env NETCATTY_OSC7_FORCE_SHELL=bash sh -c ${quotedRunner} sh ${quotedPath}`;
+    return `${run}; . "${DOLLAR}HOME/.bashrc" >/dev/null 2>&1; osc7_cwd 2>/dev/null; true; ${BASH_DELETE_MARKED_HISTORY_COMMAND}\r`;
+  }
+  if (shell === "zsh") {
+    const run = `env NETCATTY_OSC7_FORCE_SHELL=zsh NETCATTY_ZDOTDIR="${DOLLAR}{ZDOTDIR:-}" sh -c ${quotedRunner} sh ${quotedPath}`;
+    // Leading space keeps the command out of history when HIST_IGNORE_SPACE is set.
+    return ` ${run}; . "${DOLLAR}{ZDOTDIR:-${DOLLAR}HOME}/.zshrc" >/dev/null 2>&1; osc7_cwd 2>/dev/null; true\r`;
+  }
+  const run = `env NETCATTY_OSC7_FORCE_SHELL=fish NETCATTY_XDG_CONFIG_HOME="${DOLLAR}XDG_CONFIG_HOME" sh -c ${quotedRunner} sh ${quotedPath}`;
+  return ` ${run}; source (test -n "${DOLLAR}XDG_CONFIG_HOME"; and echo "${DOLLAR}XDG_CONFIG_HOME"; or echo "${DOLLAR}HOME/.config")/fish/config.fish >/dev/null 2>&1; __netcatty_osc7_cwd 2>/dev/null; true\r`;
+};
+
+const isOsc7SetupShell = (value: string): value is Osc7SetupShell =>
+  value === "bash" || value === "zsh" || value === "fish";
+
+const readMarkerLine = (stdout: string, marker: string): string | null => {
+  const line = stdout.split(/\r?\n/).find((entry) => entry.startsWith(marker));
+  return line ? line.slice(marker.length).trim() : null;
+};
+
+export const parseOsc7SetupMetadata = (stdout: string): Osc7SetupMetadata | null => {
+  const shell = readMarkerLine(stdout, OSC7_SETUP_SHELL_MARKER);
+  const configPath = readMarkerLine(stdout, OSC7_SETUP_CONFIG_MARKER);
+  if (!shell || !isOsc7SetupShell(shell) || !configPath) return null;
+  return { shell, configPath };
+};
+
+/** Shell of the other-user foreground shell reported by the setup script, if any. */
+export const parseOsc7SetupOtherUserShell = (stdout: string): string | null =>
+  readMarkerLine(stdout, OSC7_SETUP_OTHER_USER_MARKER);
+
+/** Remote path of the staged setup script, if the stage command reported one. */
+export const parseOsc7SetupStagedPath = (stdout: string): string | null => {
+  const path = readMarkerLine(stdout, OSC7_SETUP_STAGED_MARKER);
+  return path && path.startsWith("/") ? path : null;
+};
+
+export const extractOsc7SetupTerminalData = (stdout: string): string => {
+  const escape = String.fromCharCode(0x1b);
+  const bell = String.fromCharCode(0x07);
+  const prefix = `${escape}]7;`;
+  let offset = 0;
+  let output = "";
+
+  while (offset < stdout.length) {
+    const start = stdout.indexOf(prefix, offset);
+    if (start < 0) break;
+    const bodyStart = start + prefix.length;
+    const bellEnd = stdout.indexOf(bell, bodyStart);
+    const stEnd = stdout.indexOf(`${escape}\\`, bodyStart);
+    const hasBellEnd = bellEnd >= 0;
+    const hasStEnd = stEnd >= 0;
+    if (!hasBellEnd && !hasStEnd) break;
+
+    const useBell = hasBellEnd && (!hasStEnd || bellEnd < stEnd);
+    const end = useBell ? bellEnd : stEnd;
+    const terminatorLength = useBell ? 1 : 2;
+    output += stdout.slice(start, end + terminatorLength);
+    offset = end + terminatorLength;
+  }
+
+  return output;
+};
+
+export const buildOsc7ReloadCommand = (metadata: Osc7SetupMetadata | null): string | null => {
+  if (!metadata) return null;
+  const sourceCommand = `source ${quoteForSingleQuotedShellString(metadata.configPath)} >/dev/null 2>&1`;
+  const emitCommand = metadata.shell === "fish" ? "__netcatty_osc7_cwd" : "osc7_cwd";
+  if (metadata.shell === "bash") {
+    return `${sourceCommand}; ${emitCommand} 2>/dev/null; true; ${BASH_DELETE_MARKED_HISTORY_COMMAND}\r`;
+  }
+  return ` ${sourceCommand}; ${emitCommand} 2>/dev/null; true\r`;
+};
+
+export const runOsc7SetupAction = async ({
+  status,
+  sessionId,
+  setupCommand,
+  setupOsc7Tracking,
+  writeToSession,
+  writeLocalTerminalData,
+}: RunOsc7SetupActionOptions): Promise<Osc7SetupRunResult> => {
+  if (status !== "connected") {
+    return { success: false, error: "Terminal is not connected" };
+  }
+  if (!setupOsc7Tracking) {
+    return { success: false, error: "Directory tracking setup is unavailable" };
+  }
+
+  const result = await setupOsc7Tracking(sessionId, setupCommand);
+
+  // The exec channel cannot configure a shell owned by another user (after
+  // su / sudo su). Stage the setup script into a remote temp file over the
+  // exec channel, then type a short single-line command into the terminal to
+  // run it as that user (#1942).
+  const otherUserShell = parseOsc7SetupOtherUserShell(result.stdout || "");
+  if (otherUserShell) {
+    if (!isOsc7SetupShell(otherUserShell)) {
+      return {
+        ...result,
+        success: false,
+        error: `Directory tracking does not support the current shell (${otherUserShell})`,
+      };
+    }
+    const stageResult = await setupOsc7Tracking(sessionId, buildOsc7StageScriptCommand());
+    const stagedPath =
+      stageResult.success && (typeof stageResult.code !== "number" || stageResult.code === 0)
+        ? parseOsc7SetupStagedPath(stageResult.stdout || "")
+        : null;
+    if (!stagedPath) {
+      return {
+        ...stageResult,
+        success: false,
+        error: stageResult.error || stageResult.stderr?.trim() || "Directory tracking setup failed",
+      };
+    }
+    const contentSha256 = await getOsc7StagedScriptSha256();
+    const typedCommand = buildOsc7TypedSetupCommand(otherUserShell, stagedPath, contentSha256);
+    writeToSession(sessionId, typedCommand, {
+      automated: true,
+      logRewrite: { sentCommand: typedCommand, displayCommand: "" },
+    });
+    return { ...result, success: true, sentToTerminal: true };
+  }
+
+  if (!result.success || (typeof result.code === "number" && result.code !== 0)) {
+    return {
+      ...result,
+      success: false,
+      error: result.error || result.stderr?.trim() || "Directory tracking setup failed",
+    };
+  }
+
+  const metadata = parseOsc7SetupMetadata(result.stdout || "");
+  const reloadCommand = buildOsc7ReloadCommand(metadata);
+  if (!reloadCommand) {
+    return {
+      ...result,
+      success: false,
+      error: "Directory tracking setup did not return reload metadata",
+    };
+  }
+
+  const terminalData = extractOsc7SetupTerminalData(result.stdout || "");
+  if (terminalData) {
+    writeLocalTerminalData?.(terminalData);
+  }
+  writeToSession(sessionId, reloadCommand, {
+    automated: true,
+    logRewrite: { sentCommand: reloadCommand, displayCommand: "" },
+  });
+
+  return { ...result, success: true, reloadCommand };
+};