remote-tmux: multiple servers in one linked-view window

CLI/cmux.swift

@@ -8480,8 +8480,9 @@ struct CMUXCLI {
         )
     }
 
-    /// `cmux ssh-tmux <destination>` — open a dedicated cmux window mirroring a remote
-    /// host's tmux sessions over `tmux -CC` (the remote-tmux beta).
+    /// `cmux ssh-tmux <destination>` — mirror a remote host's tmux sessions over
+    /// `tmux -CC` (the remote-tmux beta). Aggregates into the caller's current window
+    /// by default; `--new-window`/`--into-window` override the target.
     ///
     /// Unlike `cmux ssh`, this carries no cmuxd-remote/relay bootstrap: it only
     /// drives the SSH ControlMaster the mirror multiplexes over. The app's mirror
@@ -8499,6 +8500,8 @@ struct CMUXCLI {
         var port: Int?
         var identityFile: String?
         var noFocus = false
+        var intoWindow: String?
+        var newWindow = false
 
         // Intentional subset of parseSSHCommandOptions: the mirror verb has a
         // different pipeline (no relay/cmuxd bootstrap, no `--` passthrough, no
@@ -8526,6 +8529,15 @@ struct CMUXCLI {
             case "--no-focus":
                 noFocus = true
                 index += 1
+            case "--into-window":
+                guard index + 1 < commandArgs.count else {
+                    throw CLIError(message: "ssh-tmux: --into-window requires a window id or 'current'")
+                }
+                intoWindow = commandArgs[index + 1]
+                index += 2
+            case "--new-window":
+                newWindow = true
+                index += 1
             default:
                 if arg.hasPrefix("-") {
                     throw CLIError(
@@ -8549,6 +8561,32 @@ struct CMUXCLI {
         if let port { params["port"] = port }
         if let identityFile, !identityFile.isEmpty { params["identity_file"] = identityFile }
         if noFocus { params["activate"] = false }
+        // Window targeting. By DEFAULT, aggregate the host into the caller's current
+        // window ("multiple servers in one window") so `cmux ssh-tmux <host>` run from
+        // inside a cmux surface reuses that window instead of spawning a new dedicated
+        // one. `--into-window <id|current>` targets a window explicitly; `--new-window`
+        // forces a fresh dedicated window. Surfaces export CMUX_WORKSPACE_ID (the
+        // workspace id, not the window id), which the app maps to the host window.
+        if intoWindow != nil && newWindow {
+            throw CLIError(message: "ssh-tmux: pass only one of --into-window or --new-window")
+        }
+        if let intoWindow {
+            if intoWindow == "current" {
+                guard let workspaceId = ProcessInfo.processInfo.environment["CMUX_WORKSPACE_ID"],
+                      !workspaceId.isEmpty else {
+                    throw CLIError(message: "ssh-tmux: --into-window current must be run from inside a cmux surface")
+                }
+                params["into_workspace"] = workspaceId
+            } else {
+                params["into_window"] = intoWindow
+            }
+        } else if !newWindow,
+                  let workspaceId = ProcessInfo.processInfo.environment["CMUX_WORKSPACE_ID"],
+                  !workspaceId.isEmpty {
+            // Default: reuse the caller's window. Outside a cmux surface (no
+            // CMUX_WORKSPACE_ID) this falls through to a new window, as does --new-window.
+            params["into_workspace"] = workspaceId
+        }
 
         // The first call runs a non-interactive (BatchMode) discovery in the app,
         // which can take a couple of seconds; show progress so it doesn't look idle.
@@ -14924,11 +14962,17 @@ struct CMUXCLI {
         case "ssh-tmux":
             return String(localized: "cli.help.ssh-tmux", defaultValue: """
             Usage: cmux ssh-tmux <destination> [--port <n>] [--identity <path>] [--no-focus]
+                                  [--into-window <id|current>] [--new-window]
+
+            Mirror a remote host's tmux sessions over tmux control mode (tmux -CC) via
+            SSH: each tmux session becomes a workspace, each window a tab, and a
+            multi-pane window a native split. Requires the "Remote tmux" beta to be
+            enabled in Settings.
 
-            Open a dedicated cmux window that mirrors a remote host's tmux sessions over
-            tmux control mode (tmux -CC) via SSH: each tmux session becomes a workspace,
-            each window a tab, and a multi-pane window a native split. Requires the
-            "Remote tmux" beta to be enabled in Settings.
+            Run from inside a cmux surface, this aggregates the host into your CURRENT
+            window by default (multiple servers, plus local, in one window). Pass
+            --new-window to open a fresh dedicated window instead, or --into-window to
+            target a specific window. Outside a cmux surface it opens a new window.
 
             If the host needs interactive authentication (password, host-key confirmation,
             MFA, or a security-key touch), cmux runs ssh inline in this terminal so you can
@@ -14938,13 +14982,15 @@ struct CMUXCLI {
             settings are honored.
 
             Flags:
-              --port <n>          SSH port
-              --identity <path>   SSH identity file path
-              --no-focus          Open the mirror window without activating it
+              --port <n>                SSH port
+              --identity <path>         SSH identity file path
+              --no-focus                Mirror without activating the window
+              --into-window <id|current>  Aggregate into a specific window (or the caller's)
+              --new-window              Open a new dedicated window instead of reusing the current one
 
             Example:
-              cmux ssh-tmux dev@my-host
-              cmux ssh-tmux my-ssh-alias
+              cmux ssh-tmux dev@my-host                 # aggregate into the current window
+              cmux ssh-tmux my-ssh-alias --new-window   # open a separate window
               cmux ssh-tmux dev@my-host --port 2222 --identity ~/.ssh/id_ed25519
             """)
         case "ssh-session-list":

Packages/macOS/CmuxRemoteSession/Sources/CmuxRemoteSession/Values/RemoteTmuxScreenTitleFilter.swift

@@ -0,0 +1,82 @@
+public import Foundation
+
+/// Strips the GNU screen / tmux window-title escape (`ESC k <title> ESC \`) from a
+/// mirrored pane's output stream.
+///
+/// A remote shell running *inside* tmux sees `TERM=screen*`/`tmux*`, so its prompt
+/// (e.g. oh-my-zsh) sets the title with the screen sequence `\ek<cmd>\e\\` instead of
+/// the xterm OSC. `%output` is the raw pty copy, so tmux forwards the `ESC k` bytes
+/// verbatim and only interprets them for its OWN screen (window name) — its rendered
+/// pane (`capture-pane`) has the title stripped. cmux's mirror surface is an
+/// xterm-style emulator that doesn't recognize `ESC k`, so it would instead print the
+/// title text onto the screen — e.g. `echo "ej"\r\n\ekecho\e\\ej` renders as `echoej`.
+/// To match what the remote tmux actually shows, the mirror interprets/strips the
+/// sequence here (the tab name already tracks tmux's `window_name`).
+///
+/// Stateful across calls: a `%output` chunk can split the sequence at any byte. Like
+/// tmux/screen, `ESC k` is terminated ONLY by ST (`ESC \`), so an unterminated title
+/// consumes until ST — matching tmux's own screen exactly (verified empirically by
+/// diffing cmux's render against `capture-pane`).
+public struct RemoteTmuxScreenTitleFilter {
+    private enum State {
+        case text        // normal passthrough
+        case esc         // saw ESC, holding it until we know if it's `ESC k`
+        case title       // inside `ESC k …`, dropping the title bytes
+        case titleEsc    // inside the title, saw ESC — maybe the `ESC \` terminator
+    }
+
+    private var state: State = .text
+
+    public init() {}
+
+    /// Returns `data` with any `ESC k … ESC \` title sequences removed.
+    public mutating func filter(_ data: Data) -> Data {
+        // Hot path: routeOutput calls this for every %output chunk. When we're not
+        // mid-sequence and the chunk has no ESC, there is nothing to strip — return it
+        // unchanged and skip the per-byte copy + allocation.
+        if state == .text, !data.contains(0x1b) { return data }
+        // Build into a `[UInt8]` buffer (cheaper than per-byte `Data.append`) and wrap
+        // it once at the end.
+        var out = [UInt8]()
+        out.reserveCapacity(data.count)
+        for byte in data {
+            switch state {
+            case .text:
+                if byte == 0x1b {
+                    state = .esc           // hold the ESC; emit it only if it isn't `ESC k`
+                } else {
+                    out.append(byte)
+                }
+            case .esc:
+                if byte == UInt8(ascii: "k") {
+                    state = .title         // `ESC k` → start of title; drop both bytes
+                } else {
+                    out.append(0x1b)       // not a title: emit the held ESC …
+                    if byte == 0x1b {
+                        // another ESC: keep holding it (stay in .esc)
+                    } else {
+                        out.append(byte)   // … followed by this byte
+                        state = .text
+                    }
+                }
+            case .title:
+                // tmux/screen terminate `ESC k` ONLY on ST (`ESC \`), never on BEL —
+                // so a BEL is part of the title and the title runs until ST (matching
+                // what the remote tmux renders). Drop everything until then.
+                if byte == 0x1b {
+                    state = .titleEsc      // maybe the `ESC \` terminator
+                }
+                // otherwise (incl. BEL): title text — drop it
+            case .titleEsc:
+                if byte == 0x5c {
+                    state = .text          // `ESC \` (ST) terminates the title
+                } else if byte == 0x1b {
+                    state = .titleEsc      // consecutive ESC — keep waiting
+                } else {
+                    state = .title         // ESC + other byte: still inside the title
+                }
+            }
+        }
+        return Data(out)
+    }
+}

Packages/macOS/CmuxRemoteSession/Tests/CmuxRemoteSessionTests/RemoteTmuxScreenTitleFilterTests.swift

@@ -0,0 +1,78 @@
+import Foundation
+import Testing
+@testable import CmuxRemoteSession
+
+/// Tests the screen/tmux window-title escape stripper used on mirrored `%output`.
+/// A remote shell inside tmux (TERM=screen*/tmux*) sets its title with
+/// `ESC k <title> ST`; cmux's xterm-style mirror surface would print the title text
+/// otherwise (the `echoej` bug). The filter must drop the sequence, survive chunk
+/// splits, and leave everything else byte-identical.
+///
+/// Assertions compare raw `Data` (not UTF-8-decoded strings): the filter is a
+/// byte-stream transform, and `String(decoding:as:)` silently replaces invalid
+/// UTF-8 — which would mask a byte-corruption regression instead of failing.
+@Suite struct RemoteTmuxScreenTitleFilterTests {
+    private func run(_ chunks: [String]) -> Data {
+        var f = RemoteTmuxScreenTitleFilter()
+        var out = Data()
+        for c in chunks { out.append(f.filter(Data(c.utf8))) }
+        return out
+    }
+    private func run(_ s: String) -> Data { run([s]) }
+
+    private func bytes(_ s: String) -> Data { Data(s.utf8) }
+
+    private let ESC = "\u{1b}"
+
+    @Test func stripsStTerminatedTitleBetweenText() {
+        // The exact echoej repro: command output `ej` preceded by `ESC k echo ESC \`.
+        let input = "\(ESC)kecho\(ESC)\\ej"
+        #expect(run(input) == bytes("ej"))
+    }
+
+    @Test func belDoesNotTerminateTitleMatchingTmux() {
+        // tmux/screen end `ESC k` only on ST (`ESC \`), never BEL. A BEL is swallowed
+        // as title text and the title runs until ST — matching the remote's rendering.
+        #expect(run("a\(ESC)kfoo\u{07}bar\(ESC)\\Z") == bytes("aZ"))  // ST ends it; BEL consumed
+        #expect(run("a\(ESC)kfoo\u{07}bar") == bytes("a"))            // no ST: rest consumed
+    }
+
+    @Test func stripsMultipleTitlesAndKeepsSurroundingText() {
+        // Prompt sets title to `~`, command sets it to `echo`, output is `ej`.
+        let input = "\(ESC)k~\(ESC)\\prompt \(ESC)kecho\(ESC)\\ej\r\n"
+        #expect(run(input) == bytes("prompt ej\r\n"))
+    }
+
+    @Test func survivesChunkSplitsAtEveryBoundary() {
+        let full = "X\(ESC)kabc\(ESC)\\Y"
+        let allBytes = Array(full.utf8)
+        // Split the stream after each byte and confirm the result is always "XY".
+        for cut in 1..<allBytes.count {
+            var f = RemoteTmuxScreenTitleFilter()
+            var out = Data()
+            out.append(f.filter(Data(allBytes[0..<cut])))
+            out.append(f.filter(Data(allBytes[cut...])))
+            #expect(out == bytes("XY"), "split at \(cut)")
+        }
+    }
+
+    @Test func preservesCsiAndOtherEscapes() {
+        // Color SGR and cursor moves must pass through untouched.
+        let input = "\(ESC)[32mgreen\(ESC)[0m\(ESC)[2J\(ESC)[H"
+        #expect(run(input) == bytes(input))
+    }
+
+    @Test func preservesEscFollowedByNonK() {
+        // `ESC \` (ST) on its own, and an OSC title, are not `ESC k` and pass through.
+        #expect(run("\(ESC)\\done") == bytes("\(ESC)\\done"))
+        #expect(run("\(ESC)]0;title\u{07}x") == bytes("\(ESC)]0;title\u{07}x"))
+    }
+
+    @Test func plainTextUnchanged() {
+        #expect(run("echo \"ej\"\r\nej\r\n") == bytes("echo \"ej\"\r\nej\r\n"))
+    }
+
+    @Test func titleImmediatelyFollowedByMoreTitle() {
+        #expect(run("\(ESC)ka\(ESC)\\\(ESC)kb\(ESC)\\Z") == bytes("Z"))
+    }
+}

Packages/macOS/CmuxSettings/Sources/CmuxSettings/Keys/BetaFeaturesCatalogSection.swift

@@ -60,5 +60,22 @@ public struct BetaFeaturesCatalogSection: SettingCatalogSection {
         userDefaultsKey: "remoteTmux.beta.enabled"
     )
 
+    /// Remote tmux linked-view mode: an experimental transport for hosts whose
+    /// `sshd` caps each connection to a single concurrent session
+    /// (`MaxSessions 1`, e.g. hosts with per-connection 2FA). Instead of one `tmux -CC` control
+    /// client per remote session — which needs one concurrent SSH session each
+    /// and so fails past the first — cmux drives ONE control client attached to a
+    /// hidden, cmux-owned aggregate "view" session and `link-window`s every
+    /// mirrored session's windows into it. All workspaces then stream live over
+    /// the single allowed connection (one auth), while the real tmux sessions are
+    /// preserved for `tmux ls` / `tmux attach` interop. Defaults off; requires
+    /// ``remoteTmux`` to be on. While off, remote tmux uses the per-session
+    /// control connections unchanged.
+    public let remoteTmuxLinkedView = DefaultsKey<Bool>(
+        id: "remoteTmux.linkedView.beta.enabled",
+        defaultValue: false,
+        userDefaultsKey: "remoteTmux.linkedView.beta.enabled"
+    )
+
     public init() {}
 }

Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/BetaFeaturesSection.swift

@@ -12,13 +12,15 @@ public struct BetaFeaturesSection: View {
     @State private var extensions: DefaultsValueModel<Bool>
     @State private var customSidebars: DefaultsValueModel<Bool>
     @State private var remoteTmux: DefaultsValueModel<Bool>
+    @State private var remoteTmuxLinkedView: DefaultsValueModel<Bool>
 
     public init(defaultsStore: UserDefaultsSettingsStore, catalog: SettingCatalog) {
         _feed = State(initialValue: DefaultsValueModel(store: defaultsStore, key: catalog.betaFeatures.rightSidebarFeed))
         _dock = State(initialValue: DefaultsValueModel(store: defaultsStore, key: catalog.betaFeatures.rightSidebarDock))
         _extensions = State(initialValue: DefaultsValueModel(store: defaultsStore, key: catalog.betaFeatures.extensions))
         _customSidebars = State(initialValue: DefaultsValueModel(store: defaultsStore, key: catalog.betaFeatures.customSidebars))
         _remoteTmux = State(initialValue: DefaultsValueModel(store: defaultsStore, key: catalog.betaFeatures.remoteTmux))
+        _remoteTmuxLinkedView = State(initialValue: DefaultsValueModel(store: defaultsStore, key: catalog.betaFeatures.remoteTmuxLinkedView))
     }
 
     public var body: some View {
@@ -38,6 +40,8 @@ public struct BetaFeaturesSection: View {
                 customSidebarsRow
                 SettingsCardDivider()
                 remoteTmuxRow
+                SettingsCardDivider()
+                remoteTmuxLinkedViewRow
             }
         }
         .task { startObservingSettings() }
@@ -50,6 +54,7 @@ public struct BetaFeaturesSection: View {
             extensions,
             customSidebars,
             remoteTmux,
+            remoteTmuxLinkedView,
         ]
         models.forEach { $0.startObserving() }
     }
@@ -138,6 +143,24 @@ public struct BetaFeaturesSection: View {
                 .accessibilityIdentifier("SettingsBetaRemoteTmuxToggle")
         }
     }
+
+    @ViewBuilder
+    private var remoteTmuxLinkedViewRow: some View {
+        SettingsCardRow(
+            configurationReview: .settingsOnly,
+            searchAnchorID: "setting:betaFeatures:remoteTmuxLinkedView",
+            String(localized: "settings.betaFeatures.remoteTmuxLinkedView", defaultValue: "Remote tmux linked view"),
+            subtitle: remoteTmuxLinkedView.current
+                ? String(localized: "settings.betaFeatures.remoteTmuxLinkedView.subtitleOn", defaultValue: "Mirrors a host's tmux sessions over a single ssh connection by linking every session's windows into one cmux-owned view. Use for hosts that allow only one session per connection (e.g. per-connection 2FA). Requires Remote tmux.")
+                : String(localized: "settings.betaFeatures.remoteTmuxLinkedView.subtitleOff", defaultValue: "Uses a separate ssh connection per remote tmux session until you enable this. Requires Remote tmux.")
+        ) {
+            Toggle("", isOn: Binding(get: { remoteTmuxLinkedView.current }, set: { remoteTmuxLinkedView.set($0) }))
+                .labelsHidden()
+                .controlSize(.small)
+                .disabled(!remoteTmux.current)
+                .accessibilityIdentifier("SettingsBetaRemoteTmuxLinkedViewToggle")
+        }
+    }
 }
 
 /// Small warning callout with a yellow triangle, used at the top of