Fix nested tmux selection handling (#104)

Author: acmore

cmd/okdev-sshd/main.go

@@ -181,7 +181,7 @@ func terminalBootstrapScript() string {
 
 func devTmuxBootstrapScript() string {
 	return strings.Join([]string{
-		`if command -v tmux >/dev/null 2>&1; then if [ -n "${SSH_AUTH_SOCK:-}" ]; then tmux set-environment -g SSH_AUTH_SOCK "$SSH_AUTH_SOCK" >/dev/null 2>&1 || true; else tmux set-environment -gu SSH_AUTH_SOCK >/dev/null 2>&1 || true; fi; if [ -f /var/okdev/dev.tmux.conf ]; then exec tmux -f /var/okdev/dev.tmux.conf new-session -A -s okdev; fi; exec tmux new-session -A -s okdev; fi`,
+		`if command -v tmux >/dev/null 2>&1; then if [ -f /var/okdev/dev.tmux.conf ]; then tmux source-file /var/okdev/dev.tmux.conf >/dev/null 2>&1 || true; fi; if ! tmux has-session -t okdev >/dev/null 2>&1; then if [ -f /var/okdev/dev.tmux.conf ]; then tmux -f /var/okdev/dev.tmux.conf new-session -d -s okdev >/dev/null 2>&1 || tmux new-session -d -s okdev >/dev/null 2>&1; else tmux new-session -d -s okdev >/dev/null 2>&1; fi; fi; if [ -n "${SSH_AUTH_SOCK:-}" ]; then tmux set-environment -g SSH_AUTH_SOCK "$SSH_AUTH_SOCK" >/dev/null 2>&1 || true; else tmux set-environment -gu SSH_AUTH_SOCK >/dev/null 2>&1 || true; fi; if [ "${OKDEV_NESTED_TMUX:-0}" = "1" ]; then tmux set -g mouse off >/dev/null 2>&1 || true; tmux set -g set-clipboard off >/dev/null 2>&1 || true; else tmux set -g mouse on >/dev/null 2>&1 || true; tmux set -g set-clipboard on >/dev/null 2>&1 || true; fi; exec tmux attach-session -t okdev; fi`,
 		`echo 'warning: tmux not available in dev container; continuing without tmux' >&2`,
 	}, "; ")
 }

cmd/okdev-sshd/main_test.go

@@ -157,7 +157,17 @@ func TestBuildInteractiveLoginScriptWithoutWorkspaceOrTmux(t *testing.T) {
 
 func TestDevTmuxBootstrapScriptIncludesFallbackWarning(t *testing.T) {
 	script := devTmuxBootstrapScript()
-	for _, want := range []string{"tmux", "warning: tmux not available", "set-environment -g SSH_AUTH_SOCK"} {
+	for _, want := range []string{
+		"tmux",
+		"warning: tmux not available",
+		"set-environment -g SSH_AUTH_SOCK",
+		"has-session -t okdev",
+		"attach-session -t okdev",
+		"source-file /var/okdev/dev.tmux.conf",
+		`"${OKDEV_NESTED_TMUX:-0}" = "1"`,
+		"set -g mouse off",
+		"set -g mouse on",
+	} {
 		if !strings.Contains(script, want) {
 			t.Fatalf("expected tmux bootstrap script to contain %q: %s", want, script)
 		}

docs/command-reference.md

@@ -70,6 +70,7 @@
 - Opens a shell or runs a command in one or more session pods.
 - Without `-- command...`, opens an interactive shell on the pinned target pod.
 - With `-- command...`, runs the command across all running pods by default, with output prefixed by short pod name.
+- The `-- command...` path is non-interactive fanout execution, not a terminal session. TTY-dependent programs such as `watch`, `top`, `htop`, or full-screen TUIs are not expected to work there; use `okdev ssh` or `okdev exec` without `-- command...` to open an interactive shell first.
 - `--pod`: target specific pods by name (repeatable or comma-separated).
 - `--role`: target pods by `okdev.io/workload-role` label (case-insensitive).
 - `--label`: target pods by arbitrary label `key=value` (repeatable, AND logic).

docs/quickstart.md

@@ -209,6 +209,8 @@ okdev resolves the target cluster in this order:
 
 - SSH connects to the `dev` container via `okdev-sshd` on port 2222.
 - `okdev ssh` uses tmux by default with a built-in okdev profile (history, mouse, vi-copy, status bar) using the standard `Ctrl-b` prefix.
+- When you launch `okdev ssh` from inside a local tmux session, the inner okdev tmux disables mouse mode so normal drag-selection still works in the outer terminal/tmux.
+- That nested-tmux mouse setting is shared per remote okdev tmux session. Separate okdev sessions do not affect each other, but if one client attaches from local tmux and another attaches to the same remote session from a plain terminal, the most recent attach decides whether inner tmux mouse mode is on or off.
 - The generated `ssh okdev-<session>` host entry bypasses tmux by default for a plain shell.
 - Use `okdev ssh --no-tmux` to bypass tmux for a single `okdev ssh` connection, or set `spec.ssh.persistentSession: false` to disable it globally.
 - The managed SSH host entry uses tight proxy keepalive settings so hung sessions fail fast instead of freezing.

internal/cli/ssh.go

@@ -169,9 +169,7 @@ func newSSHCmd(opts *Options) *cobra.Command {
 					KeepAliveTimeout:  time.Duration(cc.cfg.Spec.SSH.KeepAliveTimeout) * time.Second,
 					KeepAliveCountMax: cc.cfg.Spec.SSH.KeepAliveCountMax,
 				}
-				if noTmux {
-					tm.Env = map[string]string{"OKDEV_NO_TMUX": "1"}
-				}
+				tm.Env = buildSSHSessionEnv(noTmux)
 				tmRef.Store(tm)
 				tm.SetReconnectTargetProvider(func(_ context.Context) (string, int, error) {
 					pfMu.Lock()
@@ -823,6 +821,21 @@ func shouldReconnectShell(err error, connected bool) bool {
 		strings.Contains(msg, "i/o timeout")
 }
 
+func buildSSHSessionEnv(noTmux bool) map[string]string {
+	env := map[string]string{}
+	if noTmux {
+		env["OKDEV_NO_TMUX"] = "1"
+		return env
+	}
+	if strings.TrimSpace(os.Getenv("TMUX")) != "" {
+		env["OKDEV_NESTED_TMUX"] = "1"
+	}
+	if len(env) == 0 {
+		return nil
+	}
+	return env
+}
+
 type sshSessionProber interface {
 	ExecContext(ctx context.Context, cmd string) ([]byte, error)
 }

internal/cli/ssh_test.go

@@ -42,3 +42,22 @@ func TestResolveLocalSSHAgentSocket(t *testing.T) {
 		t.Fatal("expected non-socket SSH_AUTH_SOCK error")
 	}
 }
+
+func TestBuildSSHSessionEnv(t *testing.T) {
+	t.Setenv("TMUX", "")
+	if got := buildSSHSessionEnv(false); got != nil {
+		t.Fatalf("expected nil env outside tmux, got %#v", got)
+	}
+
+	t.Setenv("TMUX", "/tmp/tmux-1000/default,123,0")
+	if got := buildSSHSessionEnv(false); got["OKDEV_NESTED_TMUX"] != "1" {
+		t.Fatalf("expected nested tmux marker, got %#v", got)
+	}
+
+	if got := buildSSHSessionEnv(true); got["OKDEV_NO_TMUX"] != "1" {
+		t.Fatalf("expected no-tmux marker, got %#v", got)
+	}
+	if got := buildSSHSessionEnv(true); got["OKDEV_NESTED_TMUX"] != "" {
+		t.Fatalf("did not expect nested marker when tmux is disabled, got %#v", got)
+	}
+}