Struct TuiRegistry 

pub struct TuiRegistry { /* private fields */ }

Daemon-wide registry of connected TUI clients. Source of truth for live TUI connection state. Not persisted — rebuilt on each daemon start from incoming initialize handshakes.

Implementations

impl TuiRegistry

pub fn new(config_dir: &Path) -> Self

Create a registry that signs with a subkey of the install key at <config_dir>/.secret_key, the key the secret store encrypts config secrets with. The key is provisioned if absent, through the secret store’s own creation path, so a fresh install can serve remote RPC (which requires signed identities). If it cannot be read or created (for example a corrupt key file, which is never replaced), signing stays off and remote RPC is refused.

pub fn for_config(config: &Config) -> Self

The registry for a daemon running config. The install key lives next to config.toml (the directory Config::save hands the secret store), not in data_dir.

pub fn signing_is_enabled(&self) -> bool

Whether HMAC signing is enabled (.secret_key was loaded).

pub fn generate_tui_id() -> String

Generate a short TUI ID: tui_ + 8 hex chars (4 random bytes).

pub fn generate_unique_tui_id(&self) -> String

Generate a TUI ID that is not currently in the registry.

pub fn sign(&self, tui_id: &str) -> Option<String>

Sign a TUI ID with HMAC-SHA256. Returns None if signing is disabled.

pub fn verify(&self, tui_id: &str, sig: &str) -> bool

Verify a TUI ID + signature. Returns true if:

• Signing is disabled (trust all), OR
• The signature is valid.

pub fn register(&self, entry: TuiEntry) -> TuiEpoch

Register a connected TUI, displacing any earlier registration of the same id. Returns the epoch this registration owns; the caller must quote it back to Self::unregister so a late teardown cannot evict a successor.

pub fn unregister(&self, tui_id: &str, epoch: TuiEpoch)

Unregister a disconnected TUI, but ONLY while epoch is still the live registration for that id.

A reconnect adopts the same id under a new epoch, and the displaced connection’s teardown can run at any point after that — it may still be draining, or parked in a bounded write. Removing by key alone would let that late teardown evict the connection that replaced it.

pub fn list(&self) -> Vec<TuiEntry>

Snapshot of all connected TUIs.

pub fn env_for_registration( &self, tui_id: &str, epoch: TuiEpoch, ) -> Option<HashMap<String, String>>

Return a clone of the environment captured by ONE registration of a TUI: the entry for tui_id, and only while epoch is still the live registration for that id.

The captured environment carries the user’s real shell, credential sockets included, so it is readable only by the connection that captured it. Quoting the epoch is what makes that true across a reconnect: a superseded connection holds the same id as its successor, and without the epoch it would read the successor’s environment. This mirrors Self::unregister, which quotes the epoch for the same reason in the other direction.