linux(socket): implement surface.action / tab.action (rename, pin, mark_read)

[Jesssullivan]

Summary

Implements surface.action and its tab.action alias in the Linux daemon's socket dispatcher, mirroring macOS v2TabAction. Closes the most-requested per-surface metadata gap.

Supported actions (all map directly to existing fields on Panel in cmux-linux/src/workspace.zig):

Action	Effect
rename	Panel.custom_title = title
clear_name	Panel.custom_title = null
pin / unpin	Panel.is_pinned = true/false
mark_read	Panel.is_manually_unread = false
mark_unread	Panel.is_manually_unread = true

Tab-relative close/new actions (close_left, close_right, close_others, new_terminal_right, new_browser_right, reload, duplicate) are recognized but return a structured "action not implemented on linux" error — so callers can detect a parity gap vs. a typo without guessing.

workspace_id, surface_id, and tab_id parameters all mirror the macOS shape. When surface_id/tab_id are omitted, the focused surface is used.

The handler is registered for both surface.action and tab.action because Linux currently uses a 1:1 panel:pane mapping (one surface per pane = one "tab").

Test plan

• Pure-socket Python test added: tests_v2/test_surface_action_rename.py
  • Exercises every supported action against a fresh, isolated workspace
  • Verifies rename round-trips through surface.list
  • Verifies the tab.action alias hits the same handler
  • Verifies focused-surface fallback (no surface_id)
  • Cleans up its own workspace
• No GUI/CLI binary dependency — runs unchanged on both macOS and Linux daemons
• Linux CI socket tests pick up the new test automatically (current scripts/run-socket-tests.sh blacklist has no exclusion for test_surface_action_*)
• After test(socket): allowlist runner + Phase 1 candidate gate #217 (Phase 1 allowlist) merges, follow-up commit will add test_surface_action_rename to BASELINE

Notes

• Title echo uses the existing std.fmt.allocPrint pattern (matches handleSurfaceList etc.). The pre-existing JSON-injection vulnerability in title echoing is left unchanged here; addressing it across the dispatcher is a separate cleanup PR.
• Sidebar UI refresh is invoked after each mutation via window.getSidebar().refresh() — same pattern as handleWorkspaceRename.

Refs: TIN-183
Closes part of #216

[greptile-apps]

Greptile Summary

This PR implements surface.action / tab.action in the Linux socket dispatcher, covering rename, clear_name, pin/unpin, and mark_read/mark_unread — all mapping directly to existing Panel fields. The three issues flagged in the previous review round (JSON injection in the rename echo, dangling pointer on alloc failure, and workspace leak in the test) are all correctly addressed.

Confidence Score: 5/5

Safe to merge; all previous P0/P1 findings are resolved and remaining findings are minor test-quality suggestions.

The three blocking issues from the prior review round — JSON injection, dangling-pointer on alloc failure, and workspace leak in the test — are all correctly fixed. The new handler follows the established buf.writer(alloc) / writeJsonString pattern consistently. Remaining findings are P2: one vacuous assertion in the unsupported-action test branch, and a missing surface.list round-trip check for the focused-surface fallback path.

tests_v2/test_surface_action_rename.py — minor test coverage gaps in the unsupported-action and focused-surface fallback branches.

Important Files Changed

Filename	Overview
cmux-linux/src/socket.zig	Adds handleSurfaceAction for surface.action/tab.action; all three previous P0/P1 concerns (JSON injection in rename echo, dangling pointer on alloc failure, and memory layout) are addressed correctly — uses writeJsonString, alloc-before-free ordering, and matches the existing buf.writer(alloc) pattern throughout the file.
tests_v2/test_surface_action_rename.py	Comprehensive happy-path coverage; workspace leak is fixed with try/finally. Two minor test-quality gaps: the unsupported-action assertion is vacuous (accepts both error and success), and the focused-surface fallback rename is not verified via surface.list.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Dispatcher as socket.zig dispatcher
    participant Handler as handleSurfaceAction
    participant WS as Workspace / panels map
    participant Sidebar

    Client->>Dispatcher: surface.action / tab.action
    Dispatcher->>Handler: route

    Handler->>WS: resolve workspace (workspace_id or selected)
    Handler->>WS: resolve panel (surface_id → tab_id → focused_panel_id)

    alt action = rename
        Handler->>WS: alloc.dupe(title), free old custom_title
        Handler->>Sidebar: refresh()
        Handler-->>Client: {action:rename, surface_id, title} via writeJsonString
    else action = clear_name
        Handler->>WS: free old, custom_title = null
        Handler->>Sidebar: refresh()
        Handler-->>Client: {action:clear_name, surface_id}
    else action = pin / unpin
        Handler->>WS: is_pinned = true/false
        Handler->>Sidebar: refresh()
        Handler-->>Client: {action:pin/unpin, pinned:true/false}
    else action = mark_read / mark_unread
        Handler->>WS: is_manually_unread = false/true
        Handler->>Sidebar: refresh()
        Handler-->>Client: {action:mark_read/mark_unread, surface_id}
    else close_left/right/others/new_*/reload/duplicate
        Handler-->>Client: {error: action not implemented on linux}
    else unknown action
        Handler-->>Client: {error: unsupported action, supported:[...]}
    end

Loading

_{Reviews (2): Last reviewed commit: "linux(socket): address Greptile P1s on s..." | Re-trigger Greptile}

[Jesssullivan]

Thanks Greptile — both P1 findings and the P2 test cleanup gap fixed in commit 01e3be2:

• Use-after-free on alloc failure (line 1277): allocate dupe first, then free old. panel.custom_title is never assigned a stale pointer.
• JSON injection in title echo (line 1283): title and action (in the unimplemented + unsupported error envelopes) are now escaped via the existing writeJsonString helper. The rename echo uses an ArrayList + writer pattern so ", \\, and control characters in user-supplied titles cannot break the JSON envelope.
• Workspace leaked on test failure (test line 197): refactored the assertion body into _run_assertions(c, ws_id) and moved cleanup into a finally: block so partial failures cannot leak workspaces between test runs on the same daemon.

Same alloc-then-free / escape-on-echo patterns also applied preemptively to handleWorkspaceAction on PR #221 (commit 3b0b92a).