Make control sessions work on the reattach path too

et reaches a live session two ways: bootstrapping a new one over SSH,
and reattaching to one already saved under --name. Only the first ran
the control listener, so a control session whose client had died was
reattached and then immediately killed: the reattach path builds a
terminal console and calls run() with noexit unset, which appends
'; exit'.

Hoist console creation and control-socket setup above the branch, and
give both paths one driver. A control session now behaves the same
however it got there.

Move the live control files (socket, session-end note) to ~/.et/control
rather than sharing ~/.et/sessions with the saved records. Sharing one
flat directory reads well until a name collides: a session may legally
be named 'foo.sock', which is exactly the path session 'foo' wants for
its socket, and a listing cannot tell the two apart without reserving
suffixes from the session namespace. A sibling directory leaves that
namespace entirely to SessionStore, which is unmodified.

Author: Kronuz

src/terminal/ControlConsole.cpp

@@ -6,9 +6,9 @@ namespace et {
 
 namespace {
 const int kDefaultRows = 24;
-// 132 columns is the standard "wide" terminal (the VT100/VT220 132-column mode);
-// it is a better default than 80 for a session whose viewer hasn't sized it yet,
-// since attach/observe only learn the real width once someone connects.
+// 132 columns is the standard "wide" terminal (the VT100/VT220 132-column
+// mode); it is a better default than 80 for a session whose viewer hasn't sized
+// it yet, since attach/observe only learn the real width once someone connects.
 const int kDefaultCols = 132;
 
 int64_t nowSeconds() { return (int64_t)time(NULL); }

src/terminal/ControlConsole.hpp

@@ -13,29 +13,30 @@ namespace et {
  * of from a local TTY.  It is the seam that lets the *unmodified*
  * TerminalClient::run() loop be controlled by an external tool (etctl):
  *
- *   * getFd() returns the read end of an internal pipe.  run() selects on it and
- *     forwards whatever appears as TERMINAL_BUFFER input, so injectInput() bytes
- *     (keystrokes, 0x03, 0x04, escape sequences, anything) reach the remote PTY
- *     exactly as if typed.
+ *   * getFd() returns the read end of an internal pipe.  run() selects on it
+ * and forwards whatever appears as TERMINAL_BUFFER input, so injectInput()
+ * bytes (keystrokes, 0x03, 0x04, escape sequences, anything) reach the remote
+ * PTY exactly as if typed.
  *   * write() is the output sink: run() hands every TERMINAL_BUFFER it receives
  *     here, and we append the raw bytes to a non-destructive scrollback that
  *     readOutput() serves by cursor.
- *   * getTerminalInfo() returns a settable size; setSize() changes it, and run()
- *     emits a TERMINAL_INFO (resize) on its next poll.
+ *   * getTerminalInfo() returns a settable size; setSize() changes it, and
+ * run() emits a TERMINAL_INFO (resize) on its next poll.
  *   * setup()/teardown() are no-ops: there is no TTY to put in raw mode.
  *
- * The pipe is kernel-synchronized; the scrollback is internally locked; the size
- * is guarded here.  run() touches this object on its main thread (getFd reads,
- * write, getTerminalInfo); the control listener touches it on another thread
- * (injectInput, readOutput, setSize) — a clean producer/consumer split.
+ * The pipe is kernel-synchronized; the scrollback is internally locked; the
+ * size is guarded here.  run() touches this object on its main thread (getFd
+ * reads, write, getTerminalInfo); the control listener touches it on another
+ * thread (injectInput, readOutput, setSize) — a clean producer/consumer split.
  */
 class ControlConsole : public Console {
  public:
-  explicit ControlConsole(size_t scrollbackCapBytes =
-                              SessionScrollback::kDefaultCapBytes);
+  explicit ControlConsole(
+      size_t scrollbackCapBytes = SessionScrollback::kDefaultCapBytes);
   virtual ~ControlConsole();
 
-  // --- Console interface (called by TerminalClient::run on its main thread) ---
+  // --- Console interface (called by TerminalClient::run on its main thread)
+  // ---
   std::optional<TerminalInfo> getTerminalInfo() override;
   virtual void setup() {}
   virtual void teardown() {}

src/terminal/ControlListener.cpp

@@ -1,4 +1,5 @@
-// Make struct ucred / SO_PEERCRED visible on glibc (Linux peer-credential check).
+// Make struct ucred / SO_PEERCRED visible on glibc (Linux peer-credential
+// check).
 #if defined(__linux__) && !defined(_GNU_SOURCE)
 #define _GNU_SOURCE
 #endif
@@ -104,7 +105,8 @@ bool ControlListener::peerAuthorized(int connFd) const {
   // Only the owning user may drive the session, even if perms were loosened.
   uid_t peerUid = (uid_t)-1;
 #ifdef __linux__
-  // Linux reports peer credentials through SO_PEERCRED (getpeereid is BSD-only).
+  // Linux reports peer credentials through SO_PEERCRED (getpeereid is
+  // BSD-only).
   struct ucred cred;
   socklen_t len = sizeof(cred);
   if (::getsockopt(connFd, SOL_SOCKET, SO_PEERCRED, &cred, &len) != 0) {

src/terminal/ControlListener.hpp

@@ -17,8 +17,8 @@ namespace et {
  * router bridge, but speaks the (unencrypted, local) control framing.
  *
  * Connections are short-lived: one request, one response, close.  Streaming
- * reads (etctl read --follow / observe) are done by the client polling CTL_READ,
- * so the daemon keeps no per-reader state.
+ * reads (etctl read --follow / observe) are done by the client polling
+ * CTL_READ, so the daemon keeps no per-reader state.
  */
 class ControlListener {
  public:

src/terminal/ControlPaths.hpp

@@ -6,15 +6,16 @@
 
 /*
  * Local, per-user discovery for control sessions.  Backgrounded `et --ctl`
- * sessions each own a socket at ~/.et/sessions/<name>.sock; `etctl sessions`
+ * sessions each own a socket at ~/.et/control/<name>.sock; `etctl sessions`
  * enumerates that directory.  The directory is created 0700 and the sockets are
  * 0600, so another local user can neither see nor open them.
  *
- * That is the same directory a named session's record lives in, deliberately: a
- * session's socket and its saved record are two artifacts of one named thing,
- * so they share a directory rather than each inventing their own.  The records
- * are bare names and the sockets are suffixed, so neither listing sees the
- * other's files.
+ * It is a sibling of the saved-session directory rather than the same one.
+ * Co-locating them reads well until a name collides: `~/.et/sessions/<name>` is
+ * one file per session, and a session may legally be named "foo.sock", which is
+ * exactly where session "foo" wants its socket.  Keeping the live control files
+ * in their own directory leaves the saved-session namespace entirely to
+ * SessionStore, so neither side has to reserve names from the other.
  */
 namespace et {
 namespace control_paths {
@@ -36,8 +37,11 @@ inline void mkdirp0700(const string& dir) {
 #endif
 }
 
-// The directory holding a session's socket, alongside its saved record.
-inline string controlDir() { return sessionDirPath(); }
+// The directory holding live control sockets, beside the saved-session
+// directory rather than inside it.
+inline string controlDir() {
+  return fs::path(sessionDirPath()).parent_path().string() + "/control";
+}
 
 // Resolve (and materialize) the control directory.
 inline string ensureControlDir() {

src/terminal/ControlProtocol.hpp

@@ -15,29 +15,30 @@
  *   [1 byte opcode][4 byte big-endian payload length][payload bytes]
  *
  * Requests carry ET's native vocabulary verbatim where one exists: WRITE is a
- * raw TERMINAL_BUFFER payload, RESIZE is a TerminalInfo protobuf.  READ/INFO/KILL
- * are the only additions, for things ET has no native packet for (read-at-cursor,
- * liveness, end-session).
+ * raw TERMINAL_BUFFER payload, RESIZE is a TerminalInfo protobuf.
+ * READ/INFO/KILL are the only additions, for things ET has no native packet for
+ * (read-at-cursor, liveness, end-session).
  */
 namespace et {
 
 enum ControlOpcode : uint8_t {
   // Requests (etctl -> daemon)
   CTL_WRITE = 1,   // payload: raw input bytes to inject
   CTL_RESIZE = 2,  // payload: TerminalInfo protobuf
-  CTL_READ = 3,    // payload: 8-byte big-endian int64 cursor (<0 => from oldest)
-  CTL_INFO = 4,    // payload: empty
-  CTL_KILL = 5,    // payload: empty
-  CTL_SNIFF = 6,    // payload: 8-byte int64 record cursor (<0 => from oldest)
-  CTL_WRITE_SECRET =
-      7,  // payload: raw input bytes; like CTL_WRITE but redacted from transcript
+  CTL_READ = 3,   // payload: 8-byte big-endian int64 cursor (<0 => from oldest)
+  CTL_INFO = 4,   // payload: empty
+  CTL_KILL = 5,   // payload: empty
+  CTL_SNIFF = 6,  // payload: 8-byte int64 record cursor (<0 => from oldest)
+  CTL_WRITE_SECRET = 7,  // payload: raw input bytes; like CTL_WRITE but
+                         // redacted from transcript
 
   // Responses (daemon -> etctl)
   CTL_OK = 64,         // payload: empty
   CTL_ERR = 65,        // payload: error message (utf-8)
   CTL_READ_RESP = 66,  // payload: [8B nextCursor][1B truncated][data...]
   CTL_INFO_RESP = 67,  // payload: "key=value\n" lines
-  CTL_SNIFF_RESP = 68,  // payload: [8B next][1B trunc][rec: 1B dir,4B len,bytes]*
+  CTL_SNIFF_RESP =
+      68,  // payload: [8B next][1B trunc][rec: 1B dir,4B len,bytes]*
 };
 
 namespace control_proto {

src/terminal/SessionScrollback.hpp

@@ -32,7 +32,7 @@ struct ScrollbackRead {
  * already uses in htm's TerminalHandler (a deque<string> buffer plus a byte
  * count); the only additions are a monotonic absolute cursor and FIFO eviction.
  *
- * Cursors are absolute byte offsets from the start of the session.  `headOffset`
+ * Cursors are absolute byte offsets from the start of the session. `headOffset`
  * is the offset just past the most recent byte (the live cursor); `baseOffset`
  * is the offset of the oldest byte still retained.  Both only ever increase.
  */
@@ -87,9 +87,8 @@ class SessionScrollback {
     for (const auto& chunk : chunks) {
       const int64_t chunkEnd = chunkStart + static_cast<int64_t>(chunk.size());
       if (chunkEnd > cursor) {
-        const size_t from = cursor > chunkStart
-                                ? static_cast<size_t>(cursor - chunkStart)
-                                : 0;
+        const size_t from =
+            cursor > chunkStart ? static_cast<size_t>(cursor - chunkStart) : 0;
         result.data.append(chunk, from, std::string::npos);
       }
       chunkStart = chunkEnd;

src/terminal/SessionTombstone.hpp

@@ -1,6 +1,7 @@
 #ifndef __ET_SESSION_TOMBSTONE_HPP__
 #define __ET_SESSION_TOMBSTONE_HPP__
 
+#include "ControlPaths.hpp"
 #include "Headers.hpp"
 #include "SessionStore.hpp"
 
@@ -12,8 +13,8 @@
  * "you never opened it" or "something removed it". The daemon knows the reason
  * at the moment it exits; the tombstone is where it leaves that reason behind.
  *
- * It lives beside the session's saved record, under the name it ended as, and
- * is suffixed so a session listing never mistakes a note for a session.
+ * It lives with the session's control socket, under the name it ended as, in
+ * the control directory rather than the saved-session one.
  */
 namespace et {
 namespace session_tombstone {
@@ -22,13 +23,14 @@ inline string pathForName(const string& name) {
   if (!isValidSessionName(name)) {
     throw std::runtime_error("invalid session name '" + name + "'");
   }
-  return sessionDirPath() + "/" + name + ".gone";
+  return control_paths::controlDir() + "/" + name + ".gone";
 }
 
 // Record why a session ended. Best effort: a session that cannot leave a note
 // is no worse off than one that never wrote one.
 inline void write(const string& name, const string& reason) {
   try {
+    control_paths::ensureControlDir();
     std::ofstream out(pathForName(name), std::ios::trunc);
     if (!out) {
       return;

src/terminal/SessionTranscript.hpp

@@ -33,9 +33,9 @@ struct TranscriptRead {
  * A bounded, ordered log of both injected input and produced output, used by
  * `etctl peep` to tap the byte exchange (» sent / « received).  Records are
  * appended in processing order and addressed by a monotonic record index; the
- * ring evicts oldest records once a byte cap is exceeded.  This is separate from
- * the SessionScrollback (which is output-only and serves `read`), so peep can
- * show the two directions interleaved without disturbing reads.
+ * ring evicts oldest records once a byte cap is exceeded.  This is separate
+ * from the SessionScrollback (which is output-only and serves `read`), so peep
+ * can show the two directions interleaved without disturbing reads.
  */
 class SessionTranscript {
  public:

src/terminal/TerminalClient.hpp

@@ -157,9 +157,7 @@ class TerminalClient {
   // flips this to false during a drop and back to true once it reconnects, so
   // it distinguishes "link down" from "the daemon is gone" (the latter shows as
   // an unreachable control socket).
-  bool isConnected() {
-    return connection && !connection->isDisconnected();
-  }
+  bool isConnected() { return connection && !connection->isDisconnected(); }
 
  protected:
   /** @brief Console wrapper used for local terminal input/output. */