add multi-session support and auto-open TUI on MCP connection

[JeremyDev87]

Summary

Closes #485

Replace single-session TUI client with MultiSessionManager that handles multiple concurrent MCP server connections via IPC, and add TuiAutoLauncher to automatically open the TUI in a new terminal window when an MCP server starts.

New modules

Module	Purpose
MultiSessionManager	Connect, poll, and disconnect multiple IPC sessions with MAX_SESSIONS=10 limit, per-session EventBus wiring, and onSessionAdded/onSessionRemoved lifecycle hooks
TuiAutoLauncher	Platform-aware terminal detection (macOS: iTerm2, WezTerm, Terminal.app; Linux: kitty, alacritty, gnome-terminal, xterm) with SAFE_PATH_PATTERN allowlist and escapeAppleScript defense-in-depth
SessionTabBar	Pure + Ink components for session tab navigation with globalState color indicators and keyboard shortcuts (arrow keys, 1-9)
useMultiSessionState	React hook tracking per-session globalState via AGENT_ACTIVATED/AGENT_DEACTIVATED events with counter-based logic and Math.max(0, ...) underflow guard
MultiSessionApp	Top-level component with key-based session isolation to prevent cross-session React state contamination

Modified modules

Module	Change
DashboardApp	Added externalState prop for multi-session mode (bypasses internal useDashboardState when provided)
runTui	Refactored from single TuiIpcClient to MultiSessionManager with renderMultiSession entry point
main.ts	initIpc now returns ipcServer reference; added launchAutoTui helper for both SSE and stdio modes
init.constants.ts	Added CODINGBUDDY_AUTO_TUI=1 to Claude settings env entries

Security hardening

• SAFE_PATH_PATTERN (/^[a-zA-Z0-9._\-/]+$/): Allowlist-based input validation for codingbuddyBin and TERMINAL env var, blocking all shell metacharacters by default
• escapeAppleScript: Defense-in-depth escaping (\ → " → \r → \n → \t) with correct backslash-first ordering to prevent double-escaping
• MAX_SESSIONS=10: Resource exhaustion prevention enforced on both connectAll (break at limit) and poll (skip new connections at limit)
• Socket path validation: Canonical path check via getSocketPath(pid) prevents registry poisoning

Test plan

• MultiSessionManager: 11 tests — connectAll, poll (add/remove), getSession, startPolling/stopPolling, disconnectAll, MAX_SESSIONS enforcement, onMessage→EventBus wiring, onError→connected=false
• TuiAutoLauncher: 15 tests — disabled, client-already-connected, macOS (iTerm2/WezTerm/Terminal.app/custom bin), Linux (TERMINAL env/which fallback/no-terminal), unsupported platform, spawn options, spawn-failed, defaults, SAFE_PATH_PATTERN rejection (7 injection vectors + unsafe TERMINAL env)
• SessionTabBar (pure): 16 tests — rendering, truncation, globalState indicators, overflow, layout modes
• SessionTabBar (Ink): 4 tests — render, active indicator, empty state, layout propagation
• useMultiSessionState: 15 tests — initialization, session add/remove, switching (direct/index/next/prev), EventBus subscriptions (activate→RUNNING, deactivate→IDLE/ERROR, replaced→IDLE, multi-agent counter, underflow guard, dynamic session subscription, cleanup)
• MultiSessionApp: 3 tests — render, keyboard input, session switching
• DashboardApp: externalState propagation test
• runTui: 5 tests — no instances, no connected sessions, successful render, bundle load failure, missing renderMultiSession
• All 3820 tests pass (165 files, 0 failures)
• TypeScript strict mode: 0 errors

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codingbuddy-landing	Ready	Preview, Comment	Feb 17, 2026 4:07pm