Merge pull request #413 from thevibeworks/feat/deva-tmux-412

feat(tmux): deva-tmux — tmux as a built-in module, both transports

Author: lroolle

.gitignore

@@ -4,6 +4,7 @@
 .claude/
 *.bak
 
+/.cctrace
 ### Node ###
 # Logs
 logs

CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- `deva-tmux` (#412): tmux interaction is now a built-in module instead of
+  loose scripts. One in-container CLI, two transports — `ssh` (default:
+  authenticated, reboot-durable, runs the host's tmux client so there is
+  no client/server protocol coupling) and `socat` (fallback: the old
+  unauthenticated TCP daemon, kept for hosts without sshd, loud warning
+  every start). Both land the host server on `/tmp/host-tmux.sock`, so
+  `tmux-bridge` (Layer 2) and `htmux` muscle memory work unchanged.
+  Container->host stays opt-in: `deva.sh --host-tmux` mounts `~/.ssh`
+  read-only and passes `DEVA_HOST_USER`; without it the baked CLI is
+  inert. Host-side lifecycle moved where it belongs: `deva.sh tmux setup`
+  authorizes your key by writing your own `authorized_keys` (killing the
+  in-container docker-mount write from the #406 draft), `deva.sh tmux
+  host-daemon start|stop|status` manages the socat fallback, `deva.sh
+  tmux doctor` diagnoses the host side. `deva-bridge-tmux` is now a compat
+  shim. Verified live against a real host: both transports, bridge
+  lifecycle, native client + Layer 2 through the forwarded socket.
+
 ## [0.15.0] - 2026-07-14
 
 ### Added
@@ -59,7 +77,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   deva validates and reports the captured credentials (subscription type,
   expiry), or removes the placeholder on abort. Combine with `-Q --rm`
   for a clean one-shot provisioning flow.
-
 ## [0.14.0] - 2026-07-10
 
 ### Added

DEV-LOGS.md

@@ -13,6 +13,16 @@
 - Minimal markdown markers, no unnecessary formatting, minimal emojis.
 - Reference issue numbers in the format `#<issue-number>` for easy linking.
 
+# [2026-07-10] Dev Log: deva-tmux — tmux as a built-in module, both transports #412
+- Why: tmux interaction was four loose scripts with zero deva.sh integration; #406 built the right transport (ssh) but deleted the socat fallback and stayed a loose script. Direction split matters: host->container (deva.sh shell) and agent<->agent (tmux-bridge) keep the sandbox; container->host breaks it and must be opt-in.
+- What:
+  - scripts/deva-tmux (new, baked into both images): ls/attach/tmux/bridge/setup/doctor with transport backends — ssh default (authenticated, launchd-durable, host-side tmux client so zero protocol coupling), socat fallback (unauthenticated TCP, warns loudly). DEVA_TMUX_TRANSPORT=auto|ssh|socat; auto probes ssh then socat. Both transports land on /tmp/host-tmux.sock -> tmux-bridge Layer 2 unchanged
+  - inert-without-provisioning is the security property: baked binary + no key + no daemon = no host reach. deva.sh --host-tmux is the opt-in: mounts ~/.ssh ro (dedup-safe, user -v wins), passes DEVA_HOST_USER, launcher's deva-tmux copy overrides the image copy in repo mode (skew insurance)
+  - deva.sh tmux command group (host side): setup writes your OWN authorized_keys — the #406 draft did this from inside the container via a docker host-mount, which is exactly the host-reach pattern the tool exists to gate; moving it host-side dissolved the scariest code. host-daemon start|stop|status wraps the socat daemon (inline fallback when scripts/ absent). doctor for the host view
+  - deva-bridge-tmux -> compat shim (old flags -> env -> deva-tmux bridge start --transport socat --foreground); deva-bridge-tmux-host unchanged; tmux-bridge stays vendored byte-for-byte (read-guard TTL idea goes upstream, not a fork)
+  - found+fixed in live test: backgrounded ssh -N -L inherited the caller's stdout, so `deva-tmux bridge start | tail` hung forever waiting for EOF — the #406 draft had the same latent bug. Bridge children now detach stdio to a state-dir log
+- Result: verified live against a real macOS host from inside the dev container — doctor sees both transports, ssh bridge + socat bridge both land the host server on the socket, native tmux client and tmux-bridge list work through it, lifecycle idempotent, socket cleaned on stop; mount-shape suite asserts off/on/dedup provisioning shapes; shellcheck severity=error clean
+
 # [2026-07-10] Dev Log: repo surface burnish #409
 - Why: product ships four agents but half the storefront said three; agents visiting the repo had no llms.txt; nightly 2026-07-09 failed on a transient ubuntu mirror sync and partially published (base pushed, rust did not — nightly/nightly-rust tags diverged a day)
 - What:

Dockerfile

@@ -240,12 +240,17 @@ RUN --mount=type=cache,target=/home/deva/.npm,uid=${DEVA_UID},gid=${DEVA_GID},sh
 USER root
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+# deva-tmux: container->host tmux CLI (ssh + socat transports). Baked but
+# inert without host-side provisioning (deva.sh --host-tmux / tmux setup).
+COPY scripts/deva-tmux /usr/local/bin/deva-tmux
+# deva-bridge-tmux: compat shim -> deva-tmux bridge --transport socat
 COPY scripts/deva-bridge-tmux /usr/local/bin/deva-bridge-tmux
 # tmux-bridge: vendored from smux (layer-2 agent comms CLI over tmux panes)
 # See scripts/tmux-bridge.VENDORED for upstream commit and SHA256 pin.
 COPY scripts/tmux-bridge /usr/local/bin/tmux-bridge
 
 RUN chmod 755 /usr/local/bin/docker-entrypoint.sh && \
+    chmod 755 /usr/local/bin/deva-tmux && \
     chmod 755 /usr/local/bin/deva-bridge-tmux && \
     chmod 755 /usr/local/bin/tmux-bridge && \
     chmod -R 755 /usr/local/bin/scripts || true

Dockerfile.rust

@@ -157,9 +157,14 @@ RUN --mount=type=cache,target=/home/deva/.npm,uid=${DEVA_UID},gid=${DEVA_GID},sh
 USER root
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+# deva-tmux: container->host tmux CLI (ssh + socat transports). Baked but
+# inert without host-side provisioning (deva.sh --host-tmux / tmux setup).
+COPY scripts/deva-tmux /usr/local/bin/deva-tmux
+# deva-bridge-tmux: compat shim -> deva-tmux bridge --transport socat
 COPY scripts/deva-bridge-tmux /usr/local/bin/deva-bridge-tmux
 
 RUN chmod 755 /usr/local/bin/docker-entrypoint.sh && \
+    chmod 755 /usr/local/bin/deva-tmux && \
     chmod 755 /usr/local/bin/deva-bridge-tmux && \
     chmod -R 755 /usr/local/bin/scripts || true