cmux-tui: reject unsafe session names before socket resolution

cmux-tui/crates/cmux-tui-core/src/server.rs

@@ -468,9 +468,32 @@ pub(crate) fn decode_terminal_host_clear_history(
     fallback_key.map(KeyInput::try_from).transpose()
 }
 
+/// Validate the component used to identify a local session.
+///
+/// Session names become socket file names. Keep legacy names that are still a
+/// single path component, but reject values that can escape the socket root or
+/// carry control and line-separator characters.
+pub fn validate_session_name(session: &str) -> anyhow::Result<()> {
+    let invalid = session.is_empty()
+        || matches!(session, "." | "..")
+        || session.chars().any(|character| {
+            character == '/'
+                || character == '\\'
+                || character == '\0'
+                || character.is_control()
+                || matches!(character, '\u{0085}' | '\u{2028}' | '\u{2029}')
+        });
+    anyhow::ensure!(
+        !invalid,
+        "session name must be a non-empty path component without separators or control characters"
+    );
+    Ok(())
+}
+
 /// Default socket path for a session.
-pub fn default_socket_path(session: &str) -> PathBuf {
-    default_socket_path_in_runtime_dir(session, platform::runtime_dir())
+pub fn default_socket_path(session: &str) -> anyhow::Result<PathBuf> {
+    validate_session_name(session)?;
+    Ok(default_socket_path_in_runtime_dir(session, platform::runtime_dir()))
 }
 
 fn default_socket_path_in_runtime_dir(session: &str, runtime_dir: PathBuf) -> PathBuf {
@@ -4675,7 +4698,11 @@ impl Drop for PendingServer {
 
 /// Bind the socket and accept protocol clients before lifecycle readiness.
 pub fn serve_paused(mux: Arc<Mux>, path: Option<PathBuf>) -> anyhow::Result<PendingServer> {
-    let path = path.unwrap_or_else(|| default_socket_path(&mux.session));
+    validate_session_name(&mux.session)?;
+    let path = match path {
+        Some(path) => path,
+        None => default_socket_path(&mux.session)?,
+    };
     if let Some(dir) = path.parent() {
         std::fs::create_dir_all(dir)?;
         platform::restrict_directory(dir)?;
@@ -12933,6 +12960,29 @@ mod tests {
         );
     }
 
+    #[test]
+    fn session_name_validation_rejects_path_components_and_control_characters() {
+        for session in [
+            "",
+            ".",
+            "..",
+            "../escape",
+            "nested/session",
+            "nested\\session",
+            "bad\0name",
+            "bad\nname",
+            "bad\u{2028}name",
+            "bad\u{2029}name",
+        ] {
+            assert!(validate_session_name(session).is_err(), "accepted {session:?}");
+        }
+        assert!(validate_session_name("main").is_ok());
+        for session in ["legacy name", "名前", "_legacy", "-legacy", "legacy:colon"] {
+            assert!(validate_session_name(session).is_ok(), "rejected {session:?}");
+        }
+        assert!(validate_session_name(&format!("legacy-{}", "x".repeat(200))).is_ok());
+    }
+
     #[test]
     fn journal_filter_rejects_secret_max_sensitivity() {
         let error = JournalStreamFilter::parse(Some(&json!({

cmux-tui/crates/cmux-tui/src/cli.rs

@@ -287,6 +287,14 @@ fn parse_globals(args: &[String]) -> Result<(GlobalArgs, Vec<String>), (UsageErr
             }
         }
     }
+    if let Some(session) = global.session.as_deref()
+        && cmux_tui_core::server::validate_session_name(session).is_err()
+    {
+        return Err((
+            UsageError::new(crate::localization::catalog().startup.invalid_session),
+            global.output,
+        ));
+    }
     Ok((global, command))
 }
 

cmux-tui/crates/cmux-tui/src/cli/lifecycle.rs

@@ -38,7 +38,21 @@ pub(super) fn run(mut global: GlobalArgs, plan: ServerPlan) -> i32 {
         global.session = Some(session);
     }
     let expected_session = global.session.clone();
-    let socket = super::wire::resolve_socket(&global);
+    let socket = match super::wire::resolve_socket(&global) {
+        Ok(socket) => socket,
+        Err(error) => {
+            return super::wire::print_local_error(
+                &json!({
+                    "code": "server.invalid_session",
+                    "message": error,
+                    "details": {},
+                    "retryable": false,
+                }),
+                global.output,
+                2,
+            );
+        }
+    };
     let socket_output = socket.to_string_lossy().into_owned();
     let stream = match transport::connect(&socket) {
         Ok(stream) => stream,

cmux-tui/crates/cmux-tui/src/cli/raw.rs

@@ -31,7 +31,13 @@ pub(super) fn run(global: GlobalArgs, plan: RawCommandPlan) -> i32 {
             return 2;
         }
     };
-    let socket = resolve_socket(&global);
+    let socket = match resolve_socket(&global) {
+        Ok(socket) => socket,
+        Err(error) => {
+            eprintln!("cmux: {error}");
+            return 2;
+        }
+    };
     let stream = match transport::connect(&socket) {
         Ok(stream) => stream,
         Err(error) => {
@@ -132,18 +138,19 @@ fn read_line_limited(
         .map_err(|error| format!("protocol error: raw response is not UTF-8: {error}"))
 }
 
-fn resolve_socket(global: &GlobalArgs) -> PathBuf {
+fn resolve_socket(global: &GlobalArgs) -> Result<PathBuf, String> {
     if let Some(path) = &global.socket {
-        return path.clone();
+        return Ok(path.clone());
     }
     for name in ["CMUX_TUI_SOCKET", "CMUX_MUX_SOCKET"] {
         if let Some(path) = std::env::var_os(name)
             && !path.is_empty()
         {
-            return PathBuf::from(path);
+            return Ok(PathBuf::from(path));
         }
     }
     cmux_tui_core::server::default_socket_path(global.session.as_deref().unwrap_or("main"))
+        .map_err(|_| crate::localization::catalog().startup.invalid_session.to_string())
 }
 
 #[cfg(test)]

cmux-tui/crates/cmux-tui/src/cli/wire.rs

@@ -57,7 +57,13 @@ pub(super) fn run(global: GlobalArgs, mut plan: RequestPlan) -> i32 {
     let request_id =
         request["id"].as_str().expect("locally built request IDs are strings").to_string();
 
-    let socket = resolve_socket(&global);
+    let socket = match resolve_socket(&global) {
+        Ok(socket) => socket,
+        Err(error) => {
+            eprintln!("cmux: {error}");
+            return 2;
+        }
+    };
     let stream = match transport::connect(&socket) {
         Ok(stream) => stream,
         Err(error) => {
@@ -685,21 +691,23 @@ fn human_key_rank(key: &str) -> usize {
     }
 }
 
-pub(super) fn resolve_socket(global: &GlobalArgs) -> PathBuf {
+pub(super) fn resolve_socket(global: &GlobalArgs) -> Result<PathBuf, String> {
     if let Some(path) = &global.socket {
-        return path.clone();
+        return Ok(path.clone());
     }
     if let Some(session) = &global.session {
-        return cmux_tui_core::server::default_socket_path(session);
+        return cmux_tui_core::server::default_socket_path(session)
+            .map_err(|_| crate::localization::catalog().startup.invalid_session.to_string());
     }
     for name in ["CMUX_TUI_SOCKET", "CMUX_MUX_SOCKET"] {
         if let Some(path) = std::env::var_os(name)
             && !path.is_empty()
         {
-            return PathBuf::from(path);
+            return Ok(PathBuf::from(path));
         }
     }
     cmux_tui_core::server::default_socket_path("main")
+        .map_err(|_| crate::localization::catalog().startup.invalid_session.to_string())
 }
 
 #[cfg(test)]

cmux-tui/crates/cmux-tui/src/localization.rs

@@ -918,6 +918,7 @@ const fn decimal_width(mut value: u16) -> usize {
 #[derive(Debug, PartialEq, Eq)]
 pub(crate) struct StartupMessages {
     schema_too_new: &'static str,
+    pub invalid_session: &'static str,
     pub session_socket: &'static str,
     pub stop_newer_server: &'static str,
     pub no_server_listening: &'static str,
@@ -1032,6 +1033,7 @@ static ENGLISH: Catalog = Catalog {
     japanese: false,
     startup: StartupMessages {
         schema_too_new: "cannot open session \"{session}\" with cmux {version}: its saved state is incompatible with this build",
+        invalid_session: "the session name is invalid; use a non-empty name without path separators or control characters",
         session_socket: "session socket",
         stop_newer_server: "a newer cmux server owns this saved session; stop it before retrying:",
         no_server_listening: "no server is listening on this socket",
@@ -1190,7 +1192,7 @@ edits shell files. Authenticate with the configured host before retrying.
         migration_failed: "Could not reconnect the machine; please try again",
         pairing_code_unavailable: "Pairing code could not be displayed securely. Run this command from an interactive terminal and retry",
         runtime_failed: "The machine agent could not start or continue; check its configuration",
-        invalid_session: "The session name is invalid; use a short name without spaces or control characters",
+        invalid_session: "The session name is invalid; use an ASCII name up to 128 bytes with letters, digits, dots, hyphens, underscores, or colons",
         identity_unavailable: "The private machine identity is unavailable; check that --state points to a private writable file",
         registration_already_running: "A machine agent is already sharing this session; stop it before starting another",
         cloud_configuration_invalid: "The cloud connection settings are invalid; check the host, user, port, and identity file",
@@ -1622,6 +1624,7 @@ static JAPANESE: Catalog = Catalog {
     japanese: true,
     startup: StartupMessages {
         schema_too_new: "cmux {version} ではセッション \"{session}\" を開けません。保存状態はこのビルドと互換性がありません",
+        invalid_session: "セッション名が無効です。英数字、ドット、ハイフン、アンダースコア、コロンを使った 128 バイト以内の ASCII 名を使用してください",
         session_socket: "セッションソケット",
         stop_newer_server: "新しい cmux サーバーがこの保存済みセッションを所有しています。再試行する前に停止:",
         no_server_listening: "このソケットを待ち受けているサーバーはありません",
@@ -1780,7 +1783,7 @@ cmux machine-agent - ローカルの cmux セッションをリモートサー
         migration_failed: "マシンを再接続できませんでした。もう一度お試しください",
         pairing_code_unavailable: "ペアリングコードを安全に表示できませんでした。対話型端末でこのコマンドを実行して再試行してください",
         runtime_failed: "machine-agent を開始または続行できませんでした。設定を確認してください",
-        invalid_session: "セッション名が無効です。空白や制御文字を含まない短い名前を使用してください",
+        invalid_session: "セッション名が無効です。パス区切り文字や制御文字を含まない空でない名前を使用してください",
         identity_unavailable: "非公開のマシン ID を使用できません。--state が非公開で書き込み可能なファイルを指していることを確認してください",
         registration_already_running: "このセッションは別の machine-agent が共有中です。停止してからもう一度開始してください",
         cloud_configuration_invalid: "クラウド接続設定が無効です。ホスト、ユーザー、ポート、ID ファイルを確認してください",

cmux-tui/crates/cmux-tui/src/machine_agent/mod.rs

@@ -98,8 +98,13 @@ fn run_agent(args: Args) -> anyhow::Result<()> {
         StderrReporter::new().map_err(|_| anyhow::Error::msg(messages.runtime_failed))?;
     let session = SessionName::new(args.session.clone())
         .map_err(|_| anyhow::Error::msg(messages.invalid_session))?;
-    let socket =
-        args.socket.unwrap_or_else(|| cmux_tui_core::server::default_socket_path(&args.session));
+    cmux_tui_core::server::validate_session_name(&args.session)
+        .map_err(|_| anyhow::Error::msg(messages.invalid_session))?;
+    let socket = match args.socket {
+        Some(path) => path,
+        None => cmux_tui_core::server::default_socket_path(&args.session)
+            .map_err(|_| anyhow::Error::msg(messages.invalid_session))?,
+    };
     let state = args
         .state
         .map_or_else(default_state_path, Ok)

cmux-tui/crates/cmux-tui/src/main.rs

@@ -762,6 +762,8 @@ fn parse_args_result(args: impl IntoIterator<Item = String>) -> Result<Args, Str
     if out.agent_browser_provider {
         return Err(format!("--agent-browser-provider is unsupported on {}", std::env::consts::OS));
     }
+    cmux_tui_core::server::validate_session_name(&out.session)
+        .map_err(|_| localization::catalog().startup.invalid_session.to_string())?;
     Ok(out)
 }
 
@@ -1503,8 +1505,10 @@ fn run_terminal_host_process(args: &[String]) -> anyhow::Result<()> {
 }
 
 fn run_attach(args: Args) -> anyhow::Result<()> {
-    let socket_path =
-        args.socket.unwrap_or_else(|| cmux_tui_core::server::default_socket_path(&args.session));
+    let socket_path = match args.socket {
+        Some(path) => path,
+        None => cmux_tui_core::server::default_socket_path(&args.session)?,
+    };
     let config = config::load();
     let messages = &localization::catalog().attach;
     let terminal = args
@@ -1594,8 +1598,10 @@ fn run_relay(args: Args) -> anyhow::Result<()> {
     if args.provider_cli_requested() {
         anyhow::bail!("relay cannot also select a machine provider");
     }
-    let socket_path =
-        args.socket.unwrap_or_else(|| cmux_tui_core::server::default_socket_path(&args.session));
+    let socket_path = match args.socket {
+        Some(path) => path,
+        None => cmux_tui_core::server::default_socket_path(&args.session)?,
+    };
     let stream = cmux_tui_core::platform::transport::connect(&socket_path).map_err(|error| {
         anyhow::anyhow!("cannot connect relay to session socket {}: {error}", socket_path.display())
     })?;
@@ -1776,10 +1782,10 @@ fn run_server(
     let ws_token = args.ws_token.clone().or(config.server.ws_token.clone());
     // Compute the socket path up front so a normal interactive launch can
     // reuse an existing local session and surface children inherit it.
-    let socket_path = args
-        .socket
-        .clone()
-        .unwrap_or_else(|| cmux_tui_core::server::default_socket_path(&args.session));
+    let socket_path = match args.socket.clone() {
+        Some(path) => path,
+        None => cmux_tui_core::server::default_socket_path(&args.session)?,
+    };
     if args.should_attach_existing(&ws_addr, &ws_token)
         && socket_path.exists()
         && let Ok(remote) = RemoteSession::connect(&socket_path)
@@ -2574,6 +2580,32 @@ mod remote_args_tests {
         assert_eq!(args.remote_http.as_deref(), Some("127.0.0.1:8765"));
     }
 
+    #[test]
+    fn session_names_reject_path_components_and_control_characters() {
+        for session in [
+            "",
+            ".",
+            "..",
+            "../escape",
+            "nested/session",
+            "nested\\session",
+            "bad\0name",
+            "bad\nname",
+        ] {
+            let arguments = ["--session", session].map(str::to_string);
+            let error = parse_args_result(arguments)
+                .expect_err("unsafe session name was accepted before socket resolution");
+            assert!(error.contains("session"), "unexpected error for {session:?}: {error}");
+        }
+
+        for session in ["legacy name", "名前", "_legacy", "-legacy", &"x".repeat(200)] {
+            let arguments = ["--session", session].map(str::to_string);
+            parse_args_result(arguments).unwrap_or_else(|error| {
+                panic!("legacy-safe session name {session:?} was rejected: {error}")
+            });
+        }
+    }
+
     #[test]
     fn malformed_relay_endpoint_errors_do_not_echo_credentials() {
         let error = relay_daemon_options(

cmux-tui/crates/cmux-tui/src/remote_cli.rs

@@ -2107,17 +2107,22 @@ fn ensure_daemon(
     link: &Path,
     mux_socket_override: Option<&Path>,
 ) -> anyhow::Result<()> {
+    cmux_tui_core::server::validate_session_name(session)
+        .map_err(|_| anyhow!(catalog().startup.invalid_session))?;
     let _lock = lock_daemon_start(session_state)?;
     if UnixStream::connect(link).is_ok() {
         return Ok(());
     }
 
     let executable = std::env::current_exe()?;
     let log_path = session_state.join("daemon.log");
-    let mux_socket = mux_socket_override
+    let mux_socket = match mux_socket_override
         .map(Path::to_path_buf)
         .or_else(|| std::env::var_os("CMUX_MUX_SOCKET").map(PathBuf::from))
-        .unwrap_or_else(|| cmux_tui_core::server::default_socket_path(session));
+    {
+        Some(path) => path,
+        None => cmux_tui_core::server::default_socket_path(session)?,
+    };
     if UnixStream::connect(&mux_socket).is_err() {
         let log = OpenOptions::new().create(true).append(true).open(&log_path)?;
         let mut mux_owner = Command::new(&executable);

cmux-tui/crates/cmux-tui/tests/cli.rs

@@ -745,12 +745,25 @@ fn local_server_lifecycle_rejects_machine_before_socket_access() {
     }
 }
 
+#[test]
+fn invalid_session_is_rejected_before_socket_access() {
+    let socket = unique_temp_dir("invalid-session-socket").join("must-not-connect.sock");
+    let output = Command::new(bin())
+        .args(["--session", "../escape", "server", "status", "--socket", socket.to_str().unwrap()])
+        .output()
+        .unwrap();
+    assert_eq!(output.status.code(), Some(2));
+    let error = String::from_utf8(output.stderr).unwrap();
+    assert!(error.contains("session name is invalid"), "{error}");
+    assert!(!error.contains("cannot connect"), "{error}");
+}
+
 #[cfg(unix)]
 #[test]
 fn explicit_session_overrides_an_inherited_socket_route() {
     let unique = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos();
     let session = format!("explicit-route-{unique}");
-    let socket = cmux_tui_core::server::default_socket_path(&session);
+    let socket = cmux_tui_core::server::default_socket_path(&session).unwrap();
     fs::create_dir_all(socket.parent().unwrap()).unwrap();
     let _ = fs::remove_file(&socket);
     let _socket_guard = SocketFileGuard(socket.clone());