mosaicstack/stack
1
0
Fork 0
Code Issues 74 Pull Requests 1 Actions Packages Projects Releases 15 Wiki Activity

tmux/agent-send.sh: stamps a false sender whenever the sender's session is not on the destination socket #808

New Issue
Closed
opened 2026-07-16 21:48:40 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-07-16 21:48:40 +00:00
Owner
Copy Link

Summary

agent-send.sh auto-detects the sender's session with tmux display-message -p '#S'.
When the caller is not inside a tmux pane, tmux does not fail — it falls back to
the most-recently-active session on the socket. The wrapper accepts that value and
stamps it into the addressing preamble, so the message arrives claiming to come from
an agent that did not send it.

This defeats the stated purpose of the addressing standard. From tools/tmux/README.md:

Why: a fresh or context-wiped agent always knows who sent a message and to whom.
No ambiguity about origin or lane after a tmux wipe / session restart.

A silently-wrong source label is worse than no label: the recipient cannot tell it is
wrong, and the documented "replies FLIP the preamble" convention then routes the reply
to the wrong agent — often back to the recipient itself.

Affected file

packages/mosaic/framework/tools/tmux/agent-send.sh (lines ~124-132):

if [ -z "$SRC_LABEL" ]; then
  tmux_cmd=(tmux)
  if [ -n "$SOCKET_NAME" ]; then
    tmux_cmd+=(-L "$SOCKET_NAME")
  fi
  src_host=$(hostname -s 2>/dev/null || echo "?")
  src_sess=$("${tmux_cmd[@]}" display-message -p '#S' 2>/dev/null || echo "?")
  SRC_LABEL="${src_host}:${src_sess}"
fi

The || echo "?" fallback never fires, because display-message succeeds — it
just answers about a session the caller has nothing to do with.

Reproduce

From any shell that is not inside tmux, with at least one session on the socket:

$ echo "${TMUX:-<not in tmux>}"
<not in tmux>

$ tmux -L <socket> display-message -p '#S'
<some-arbitrary-session>     # <-- not the sender; whatever was last active

Then send to a peer and inspect the delivered preamble:

$ agent-send.sh -L <socket> -s peer-b -m "hello"

The recipient sees [<host>:peer-a -> <host>:peer-b] hello — where peer-a is an
uninvolved session that happened to be most-recently-active. Observed in practice
sending from an orchestrator process running outside tmux: every message was
attributed to an unrelated worker seat.

Expected vs actual

  • Expected: either an accurate source label, or a clearly-marked non-agent
    source, or a hard error demanding -S.
  • Actual: a plausible-looking but false agent attribution, with no signal that
    it is wrong.

Suggested fix

Only trust display-message when the caller is genuinely inside a pane, and prefer
the identity the launcher already exports. start-agent-session.sh exports
MOSAIC_AGENT_NAME into the pane, so it is the more reliable source:

if [ -z "$SRC_LABEL" ]; then
  src_host=$(hostname -s 2>/dev/null || echo "?")
  if [ -n "${MOSAIC_AGENT_NAME:-}" ]; then
    src_sess="$MOSAIC_AGENT_NAME"
  elif [ -n "${TMUX:-}" ]; then
    src_sess=$(tmux display-message -p '#S' 2>/dev/null || echo "?")
  else
    src_sess="?"        # honest unknown; never guess
  fi
  SRC_LABEL="${src_host}:${src_sess}"
fi

Note the dropped -L "$SOCKET_NAME": inside a pane the caller's own session lives on
whatever socket it is on, which is not necessarily the destination socket passed via
-L. Using the destination socket to look up the sender is part of what makes the
current lookup wrong.

Whether an unknown source should be ? or a hard error is a design call —
failing loudly may be preferable, since a message with no verifiable origin is
exactly what the addressing standard exists to prevent.

Notes

A regression test would need to invoke the script from outside tmux with a live
session present on the socket, and assert the preamble does not name it.

## Summary `agent-send.sh` auto-detects the sender's session with `tmux display-message -p '#S'`. When the caller is **not inside a tmux pane**, tmux does not fail — it falls back to the most-recently-active session on the socket. The wrapper accepts that value and stamps it into the addressing preamble, so the message arrives claiming to come from an agent that did not send it. This defeats the stated purpose of the addressing standard. From `tools/tmux/README.md`: > Why: a fresh or context-wiped agent always knows who sent a message and to whom. > No ambiguity about origin or lane after a tmux wipe / session restart. A silently-wrong source label is worse than no label: the recipient cannot tell it is wrong, and the documented "replies FLIP the preamble" convention then routes the reply to the wrong agent — often back to the recipient itself. ## Affected file `packages/mosaic/framework/tools/tmux/agent-send.sh` (lines ~124-132): ```bash if [ -z "$SRC_LABEL" ]; then tmux_cmd=(tmux) if [ -n "$SOCKET_NAME" ]; then tmux_cmd+=(-L "$SOCKET_NAME") fi src_host=$(hostname -s 2>/dev/null || echo "?") src_sess=$("${tmux_cmd[@]}" display-message -p '#S' 2>/dev/null || echo "?") SRC_LABEL="${src_host}:${src_sess}" fi ``` The `|| echo "?"` fallback never fires, because `display-message` **succeeds** — it just answers about a session the caller has nothing to do with. ## Reproduce From any shell that is not inside tmux, with at least one session on the socket: ```bash $ echo "${TMUX:-<not in tmux>}" <not in tmux> $ tmux -L <socket> display-message -p '#S' <some-arbitrary-session> # <-- not the sender; whatever was last active ``` Then send to a peer and inspect the delivered preamble: ```bash $ agent-send.sh -L <socket> -s peer-b -m "hello" ``` The recipient sees `[<host>:peer-a -> <host>:peer-b] hello` — where `peer-a` is an uninvolved session that happened to be most-recently-active. Observed in practice sending from an orchestrator process running outside tmux: every message was attributed to an unrelated worker seat. ## Expected vs actual - **Expected:** either an accurate source label, or a clearly-marked non-agent source, or a hard error demanding `-S`. - **Actual:** a plausible-looking but false agent attribution, with no signal that it is wrong. ## Suggested fix Only trust `display-message` when the caller is genuinely inside a pane, and prefer the identity the launcher already exports. `start-agent-session.sh` exports `MOSAIC_AGENT_NAME` into the pane, so it is the more reliable source: ```bash if [ -z "$SRC_LABEL" ]; then src_host=$(hostname -s 2>/dev/null || echo "?") if [ -n "${MOSAIC_AGENT_NAME:-}" ]; then src_sess="$MOSAIC_AGENT_NAME" elif [ -n "${TMUX:-}" ]; then src_sess=$(tmux display-message -p '#S' 2>/dev/null || echo "?") else src_sess="?" # honest unknown; never guess fi SRC_LABEL="${src_host}:${src_sess}" fi ``` Note the dropped `-L "$SOCKET_NAME"`: inside a pane the caller's own session lives on whatever socket it is on, which is not necessarily the destination socket passed via `-L`. Using the destination socket to look up the *sender* is part of what makes the current lookup wrong. Whether an unknown source should be `?` or a hard error is a design call — failing loudly may be preferable, since a message with no verifiable origin is exactly what the addressing standard exists to prevent. ## Notes A regression test would need to invoke the script from outside tmux with a live session present on the socket, and assert the preamble does not name it.
jason.woltje changed title from tmux/agent-send.sh: stamps a false sender in the preamble when invoked outside a tmux pane to tmux/agent-send.sh: stamps a false sender whenever the sender's session is not on the destination socket 2026-07-16 21:51:53 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#808
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?