Wmux

Headline: a wmux.json pane can now declare a restart policy and the daemon supervises it like an init system — auto-restarted with backoff across process exits, daemon restarts, and full reboots, with a runaway guard so a crash-loop burns backoff instead of tokens (X8). Cold start is 74% faster on the dev machine (5570 → 1176 ms; first contentful paint 5.2 → 0.65 s) after moving the auth-token ACL hardening off the boot critical path, loading the renderer in parallel with the daemon bootstrap, and adaptive readiness polling — with a new wmux doctor to diagnose a slow boot in one command. Plus a lighter idle footprint (lazy buffer allocation, visibility-gated metadata polling, pruned native prebuilds), a refined-terminal sidebar pass, and an awaiting-input signal for Claude Code's AskUserQuestion prompt. Thanks to @matdac6 for three contributions this cycle (#212, #218, #219).

Added

• wmux now signals when Claude Code is waiting on an AskUserQuestion prompt (#212, thanks @matdac6). When Claude Code shows its multi-line boxed question UI inside a wmux pane, the pane's sidebar dot turns yellow and the awaiting-input sound fires — the same signal you already get for single-line approval prompts. Previously "awaiting input" was detected only by the regex AgentDetector, which is anchored to single-line prompts (Do you want to proceed?) and never matched the boxed AskUserQuestion layout, so a user who looked away got no cue that the agent was blocked on them. The fix is signal-based, not another regex: a PreToolUse hook scoped to the AskUserQuestion tool maps to the existing awaiting_input status (guarded on tool_name so a future broad matcher can't tunnel spurious signals). The dot clears automatically when you answer and the agent resumes. No new UI — it reuses the existing status, sound, and dot.
• Cold-start boot-phase instrumentation (S-A). The main process now emits one cheap [boot-trace] line per boot milestone (process spawn → module eval → app-ready → plugin load → daemon bootstrap with spawn/pipe/ping sub-phases → ready end), plus a JSON summary that lands in the daily log file; the daemon exposes its own boot marks through daemon.ping. The perf bench collects both and prints a derived phase-attribution table, so a cold-start regression now points at the guilty phase instead of a single opaque number. First run of the new table immediately attributed ~70% of the measured cold start to the auth-token ACL hardening's synchronous PowerShell shell-outs (one in the main process, one in the daemon) — the optimization target for the follow-up PR. Zero telemetry: stderr and local log files only.
• wmux doctor — one-command diagnostics (#216). A new CLI command that turns the boot-trace instrumentation into a user-facing health check: environment (version, pipes, auth token, data suffix, app-pipe reachability), daemon status over its own control pipe (pid, uptime, sessions, event-loop lag — diagnosable even when the main process is dead), the same boot-phase attribution table the perf bench prints (main + daemon-internal phases, parsed from the daily log's boot summary with a bounded tail read), an antivirus-tax hint when a cold-rescan phase exceeds 1.5 s, and today's error/warn counts for both log files. --json for scripts; exit 1 only when something actually failed. "wmux feels slow / won't start" reports can now begin with one command instead of log archaeology.
• RAM attribution in the perf bench (#217). The bench's flat RAM number now ships with a per-category breakdown (main / renderer / gpu / utility / daemon / conhost / user shells), a --scrollback-lines A/B seed, and a WebGL-context occupancy probe — all additive, nothing gated. First verdict from the data, recorded in bench/README.md: about half the 8-pane footprint is the user's own shells, the scrollback A/B delta on near-empty terminals is ~0 (xterm's buffer is lazily populated), and the GPU process is a single fixed cost — so the planned RAM-diet code work was cancelled by measurement before any code was written.
• Pane supervision — the daemon keeps declared panes alive as exec-style units (X8). A wmux.json pane can now declare restart: on-failure | always (with an optional restartLimit), and the daemon supervises that pane the way an init system supervises a service: when the process exits it is auto-restarted with exponential backoff, and a runaway guard halts supervision after N consecutive short-lived runs (it must be manually rearmed) so a tight crash-loop burns backoff instead of tokens. Because the supervisor is the daemon — which already survives app crashes and machine reboots — supervision is sticky: a supervised loop is restarted across daemon restarts and across a full reboot, so an unattended overnight loop comes back on its own after the machine cycles. Nothing supervises until you trust the file (same wmux.json trust gate); plain panes are unaffected.

Changed

• Cold start: the renderer now loads in parallel with the daemon bootstrap (S-A Step 1) (#215) — measured 1436 → 1176 ms (-18%) locally, 1441 → 989 ms (-31%) on CI; first contentful paint 1.08 s → 0.65 s. Since the v2.13 first-keystroke race fix, the boot tail ran strictly serialized: wait for the daemon to spawn and connect, then start loading the renderer — stacking the two longest boot legs (~625 ms renderer, ~464 ms daemon bootstrap) back to back, with the window sitting on a blank background frame the whole time. The bootstrap is now kicked without awaiting and the renderer loads immediately, so the daemon spawn hides behind the renderer load. The race that forced the serialization (a renderer mounting mid handler-swap could mint a local-mode pty id and have its writes silently dropped — "first keystroke doesn't register" on fresh installs) is closed structurally rather than by ordering: the renderer's first ready-state query parks until the daemon-vs-local decision is final, and the pane gate keeps every terminal-create path shut until the startup reconcile completes. The one listener those defenses didn't cover (the late-reconcile trigger on daemon:connected, which previously could not fire before the renderer existed) is now gated on the pane gate, extracted, and unit-tested. Verified against the original regression scenario: 10/10 isolated cold boots with a keystroke fired the instant the terminal mounts, zero drops.
• Cold start: adaptive daemon readiness polling (S-A C1) (#214). After spawning the daemon, the launcher polled for readiness on a fixed 200 ms interval — boot traces showed ~93–199 ms of pure poll quantization between "daemon wrote its pipe file" and "launcher noticed" on every cold start. The poll is now an immediate first check followed by a 40 ms cadence for the first 2 s, backing off to the original 200 ms for slow-machine tails; the same span now measures 6–44 ms per cold run. The zombie-pipe guard, auth-token gate, 15 s budget, and the already-running-daemon yield path are preserved, and the loop is extracted behind a dependency-injected helper with fake-timer tests (it previously had none).
• Cold start: auth-token ACL hardening moved off the boot critical path (S-A) — measured 5570ms → 1436ms (-74%) on the dev machine, first contentful paint 5.2s → 1.1s. The boot traces attributed ~70% of cold start to the token-file ACL hardening's synchronous whoami + PowerShell shell-outs — once in the main process (PipeServer constructor, 2015ms median) and once in the daemon (3465ms, directly on the path the launcher polls). Three changes, none of which weaken the hardening guarantees:
  • Re-hardening an existing token is now deferred and fully asynchronous. The token VALUE doesn't change on re-harden, so an attacker who could exploit the brief deferred window could equally have read the file at any point of its prior on-disk lifetime under the same ACL — and the RPC surface is protected by the token value (timing-safe compare), not by the file ACL. The deferred path uses async execFile/spawn exclusively, so the multi-second shell-out can no longer stall the daemon's event loop either. Verified to converge to the same owner-only DACL (including removal of explicit Everyone ACEs) by the extended scripts/issue-124-acl-dynamic.mjs harness.
  • Freshly created token files are hardened via icacls (~120ms) instead of PowerShell (~1-2s). The #124 objection to icacls — it cannot remove a pre-existing explicit broad ACE — is unreachable on a file that did not exist before the write (it carries only inherited ACEs, which /inheritance:r strips). Overwrites of an existing file (token rotation, empty-file repair) keep the PowerShell-first DACL rebuild. Fail-closed semantics unchanged: if both primitives fail, the un-hardenable token is deleted and the write throws.
  • McpRegistrar no longer rewrites an identical token file at the end of the ready handler (the PipeServer constructor had just written the same value through the same secure path).
• Lighter idle/background footprint — RAM, CPU, and package size (#219, thanks @matdac6). Three independent reductions, all transparent to consumers: the daemon's per-session RingBuffer now allocates 64 KB up front and doubles toward the configured ceiling (default 8 MB) on demand instead of committing the full ceiling per session — idle/quiet sessions hold ~64 KB, chatty ones still grow to the ceiling with no scrollback lost; the 5 s per-PTY metadata poll (git / gh / /proc work that only feeds cosmetic UI) is now gated on shouldPollMetadata() and skipped while the window is destroyed, loading, hidden, or minimized, with the next visible tick refreshing within ≤5 s so staleness stays bounded; and postPackage prunes the non-target node-pty prebuilds (the win32-x64/arm64 ConPTY binaries are ~30 MB each), reclaiming ~28 MB+ per build across both node-pty copies, while defensively keeping everything if the target dir is missing.
• Refined-terminal sidebar aesthetics (#218, thanks @matdac6). A visual pass over the sidebar: the glyph icons (⚙ ⧉ ✕ ▸) across workspace rows, the mini-sidebar, and settings are replaced by a shared stroke-icon SVG module (icons.tsx) so every control scales crisply; the agent-status indicator now routes through AGENT_STATUS_ICON's dotVar/glowClass/mark fields as a colored status dot with an animated glow plus a right-aligned play/pause mark; and token-derived depth, softened popover borders (rounded-lg + color-mix), row/popover enter animations, and a shared focus-ring helper round it out — every motion effect gated behind prefers-reduced-motion. Spec and plan under docs/superpowers/.

Fixed

• Token ACL hardening silently degraded to icacls when wmux was launched from PowerShell 7 (Store install). The inherited PSModulePath leads with pwsh 7's Core-edition Modules directory, so the Windows PowerShell 5.1 child failed to auto-load its own Microsoft.PowerShell.Management/Security modules (CommandNotFoundException on Get-Item), and the #124 DACL rebuild — the only primitive that removes pre-existing explicit broad ACEs — never ran, falling back to icacls on every boot. The 5.1 child now gets PSModulePath stripped from its environment so it reconstructs its own default module path regardless of which shell spawned wmux. Found via the new boot traces: the measured "hardening cost" on a pwsh7-launched dev box was actually a failing PowerShell plus the fallback.

Contributors

• @matdac6 — three contributions this cycle, on top of the workspace Rename context-menu item (#184): the AskUserQuestion awaiting-input notification (#212) — a clean signal-based fix with a root-cause writeup, a tool_name guard against spurious signals, and tests on the wmux side; the refined-terminal sidebar aesthetics pass (#218); and the lighter idle footprint across RAM, CPU, and package size (#219). Thank you!

What's Changed

• perf: cold-start boot-phase instrumentation (S-A) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/210
• perf(security): move token ACL hardening off the boot critical path (S-A) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/213
• feat(hooks): notify on Claude Code AskUserQuestion (awaiting-input via PreToolUse) by @matdac6 in https://github.com/openwong2kim/wmux/pull/212
• perf(daemon): adaptive readiness-poll cadence after daemon spawn (S-A C1) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/214
• perf(boot): load renderer in parallel with daemon bootstrap (S-A Step 1) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/215
• feat(cli): wmux doctor — one-command boot/daemon/log diagnostics by @openwong2kim in https://github.com/openwong2kim/wmux/pull/216
• perf(bench): RAM attribution by process category + scrollback A/B (S-A) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/217
• perf: lighter idle footprint (RAM + CPU + package size) by @matdac6 in https://github.com/openwong2kim/wmux/pull/219
• feat(sidebar): refined-terminal aesthetics pass by @matdac6 in https://github.com/openwong2kim/wmux/pull/218
• feat: X8 pane supervision — daemon-side init system for agent panes by @openwong2kim in https://github.com/openwong2kim/wmux/pull/220
• docs(changelog): credit @matdac6 for #218 + #219 by @openwong2kim in https://github.com/openwong2kim/wmux/pull/221
• chore(release): v3.3.0 by @openwong2kim in https://github.com/openwong2kim/wmux/pull/222

Full Changelog: https://github.com/openwong2kim/wmux/compare/v3.2.0...v3.3.0