fix(tmux): pidfile hygiene, restore shim option surface

- bridge/host-daemon pidfiles: trust only a numeric PID whose command
  looks like our transport child (ssh/socat) — a stale pidfile with a
  reused PID no longer reports up or gets killed on stop; stale files
  are cleaned with a message
- shim: restore -V/--version, -- end-of-options, and ignore non-option
  args like the old script (only unknown -flags error)

Verified: stale-pidfile stop cleans without killing, bridge lifecycle
still green, shellcheck clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

deva.sh

@@ -1359,35 +1359,52 @@ tmux_host_setup() {
 # The socat fallback daemon exposes the host tmux socket over TCP with NO
 # authentication — any process that can reach the port drives your tmux.
 # Prefer the ssh transport; this exists for hosts without Remote Login.
+# Stale pidfiles + PID reuse would make us report an unrelated process as
+# our daemon (or kill it on stop); only trust a numeric PID whose command
+# looks like the socat daemon.
+tmux_host_daemon_pid() {
+    local pid_file="$1" pid
+    pid="$(cat "$pid_file" 2>/dev/null)" || return 1
+    case "$pid" in '' | *[!0-9]*) return 1 ;; esac
+    kill -0 "$pid" 2>/dev/null || return 1
+    ps -o command= -p "$pid" 2>/dev/null | grep -qE 'socat|deva-bridge-tmux-host' || return 1
+    echo "$pid"
+}
+
 tmux_host_daemon() {
     local action="${1:-status}"
     local state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/deva/tmux"
     local pid_file="$state_dir/host-daemon.pid"
     local daemon="$SCRIPT_DIR/scripts/deva-bridge-tmux-host"
     local bind="${DEVA_BRIDGE_BIND:-127.0.0.1}"
     local port="${DEVA_BRIDGE_PORT:-41555}"
+    local pid
 
     case "$action" in
     status)
-        if [ -f "$pid_file" ] && kill -0 "$(cat "$pid_file")" 2>/dev/null; then
-            echo "host-daemon up (pid $(cat "$pid_file"), ${bind}:${port}) — UNAUTHENTICATED, prefer ssh"
+        if pid=$(tmux_host_daemon_pid "$pid_file"); then
+            echo "host-daemon up (pid $pid, ${bind}:${port}) — UNAUTHENTICATED, prefer ssh"
         else
             echo "host-daemon down"
             return 1
         fi
         ;;
     stop)
         if [ -f "$pid_file" ]; then
-            kill "$(cat "$pid_file")" 2>/dev/null || true
+            if pid=$(tmux_host_daemon_pid "$pid_file"); then
+                kill "$pid" 2>/dev/null || true
+                echo "host-daemon stopped"
+            else
+                echo "host-daemon pidfile was stale; cleaned up"
+            fi
             rm -f "$pid_file"
-            echo "host-daemon stopped"
         else
             echo "host-daemon not running"
         fi
         ;;
     start)
-        if [ -f "$pid_file" ] && kill -0 "$(cat "$pid_file")" 2>/dev/null; then
-            echo "host-daemon already up (pid $(cat "$pid_file"))"
+        if pid=$(tmux_host_daemon_pid "$pid_file"); then
+            echo "host-daemon already up (pid $pid)"
             return 0
         fi
         command -v socat >/dev/null 2>&1 || {

scripts/deva-bridge-tmux

@@ -21,10 +21,14 @@ EOF
 }
 
 QUIET=0
+VERSION="1.0.0"
 
+# Same option surface as the old script: -V/--version, -- ends options,
+# non-option args are ignored (break), only unknown -flags error.
 while [ $# -gt 0 ]; do
     case $1 in
     -h | --help) usage; exit 0 ;;
+    -V | --version) printf '%s %s (deva-tmux shim)\n' "$prog" "$VERSION"; exit 0 ;;
     -q | --quiet) QUIET=1 ;;
     -H | --host)
         [ $# -ge 2 ] || { echo "$prog: missing value for $1" >&2; exit 1; }
@@ -35,7 +39,9 @@ while [ $# -gt 0 ]; do
     -s | --socket)
         [ $# -ge 2 ] || { echo "$prog: missing value for $1" >&2; exit 1; }
         DEVA_TMUX_SOCK="$2"; export DEVA_TMUX_SOCK; shift ;;
-    *) echo "$prog: unknown option: $1" >&2; exit 1 ;;
+    --) shift; break ;;
+    -*) echo "$prog: unknown option: $1" >&2; exit 1 ;;
+    *) break ;;
     esac
     shift
 done

scripts/deva-tmux

@@ -150,8 +150,20 @@ EOF
     exit 1
 }
 
+# A pidfile can go stale and the PID be reused by an unrelated process;
+# only treat it as ours if it is numeric AND the command looks like our
+# transport child (ssh or socat).
+bridge_pid_ours() {
+    local pid
+    pid=$(cat "$BRIDGE_PID" 2>/dev/null) || return 1
+    [[ "$pid" =~ ^[0-9]+$ ]] || return 1
+    kill -0 "$pid" 2>/dev/null || return 1
+    ps -o command= -p "$pid" 2>/dev/null | grep -qE '(^|/| )(ssh|socat) ' || return 1
+    echo "$pid"
+}
+
 bridge_alive() {
-    [[ -S "$BRIDGE_SOCK" && -f "$BRIDGE_PID" ]] && kill -0 "$(cat "$BRIDGE_PID")" 2>/dev/null
+    [[ -S "$BRIDGE_SOCK" && -f "$BRIDGE_PID" ]] && bridge_pid_ours >/dev/null
 }
 
 usage() {
@@ -329,9 +341,14 @@ cmd_bridge() {
         ;;
     stop)
         if [[ -f "$BRIDGE_PID" ]]; then
-            kill "$(cat "$BRIDGE_PID")" 2>/dev/null || true
+            local pid
+            if pid=$(bridge_pid_ours); then
+                kill "$pid" 2>/dev/null || true
+                echo "bridge stopped"
+            else
+                echo "bridge pidfile was stale; cleaned up"
+            fi
             rm -f "$BRIDGE_PID" "$BRIDGE_SOCK"
-            echo "bridge stopped"
         else
             echo "bridge not running"
         fi