ctl C2: send (queue-until-idle) + status + subtree scoping + --here - #3

…(0.8.1)

A ctl spawn (new window) and --here split sized the worker's pty to a rough
estimate but never resized the window, so the agent painted short (content at
top, blank below) until a manual terminal resize. Both paths now call
resize_window right after spawning, matching the interactive split handlers.
Fixes founder repaint reports #1 (new-window spawn) and #3 (--here didn't push
to bottom).

Verified: python dev.py check green (119 lib + 46 integ).

…fied on real Windows]

Fills the src/reap.rs cfg(not(unix)) stub with the durable Windows teardown layer
from the design spec: one Job Object per session with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE.
Every pane is assigned to it; amux holds the sole non-inheritable handle for its
whole life; the kernel terminates every process in the job — children inherit it,
so grandchildren too — the instant that handle closes, however amux exits,
TerminateProcess included. That is the one death mode no unix layer can match.

- SessionJob (src/reap.rs): no-op on unix; on Windows creates the job (kill-on-close,
  non-inheritable handle per R2), assign() adds a pane, Drop closes the handle.
  Win32 externs + constants + repr(C) structs (IoCounters / JobBasic / JobExtended)
  transcribed from winnt.h; usize for SIZE_T/ULONG_PTR (correct on 32- and 64-bit).
- main.rs: session_job created once in run(), held for the session, each new pane
  assigned in the registry loop. spawn_watchdog + its var are now cfg(unix) — on
  Windows the job replaces the watchdog, which there could not signal a group and
  would block on its pipe forever (R5). amux reap stays as the near-inert manual path.
- R1: create/assign failures degrade to a debug warning and a null-handle no-op; a
  pane is never refused. GetLastError captured immediately after each failing call
  (before CloseHandle) per review.

VERIFIED ON REAL WINDOWS (what the spec's macOS author could not do): acceptance
corruption), #2 clean-quit kills the pane's grandchild, #3 taskkill /F of amux
still takes the tree down via kill-on-close, #6 full dev.py check green (237 tests).
R4 confirmed: hard-killing amux leaves no conhost residue. Adversarially reviewed
(rust-reviewer): verdict ship, layout exact on both bitwidths, handle inheritance
correctly prevented, every failure path a safe no-op, no double-close.

Also (pre-existing, distinct): fixed closing_an_overlay_repaints_the_pane, which
shipped in the unix-teardown work typing a bash-only marker into cmd.exe and could
never pass on Windows (confirmed failing at clean 43e7a6e). Branched the marker for
cmd. Exactly the cargo-check-is-not-a-run gap the spec warned about.

…#3, #4]

#3 — `flush_sends` wrote with `let _ = p.pty.write(text)`. `write(2)` returns a
COUNT and may legitimately accept less than offered: a pty's input buffer is
finite, and in canonical mode a single line is capped near 1 KB. The code threw
that count away, marked the send delivered, and 400 ms later wrote the Enter
that submits it — so a long task arrived as a fragment while ctl had already
replied ok:true. The review reproduced it four times on its own dispatches:
~800-byte sends vanished, ~70-byte ones worked.

PendingSend now carries `written`, advances by what was actually accepted, and
stamps `text_written_at` only once the last byte lands, so Enter can never
submit a fragment. Resuming across ticks rather than looping until complete is
deliberate: this runs on the single event loop, and the review's own suggested
`write_all` would block every pane until the target drained its buffer — trading
silent truncation for a session-wide freeze, which is finding #5's class.

#4 — `sanitize_spawn_argv` was a denylist of three literal names, and a denylist
guarding this surface fails by omission. `--allowed-tools` (claude's own
documented alias of the governed `--allowedTools`) passed straight through, and
so did `--mcp-config`, `--plugin-dir`, `--plugin-url` and `--settings`, each of
which reaches code execution OUTSIDE the tool-permission system: an stdio MCP
server is a command claude launches at startup, a plugin carries hooks. None of
those names appears anywhere else in amux, so a worker could pass one verbatim
in every mode, plan included.

Inverted to a per-vendor allowlist. `vet_spawn_argv` refuses an unlisted flag
outright instead of quietly cleaning it, and refuses an agent stem amux has no
trust posture for (gemini, aider, cursor-agent) since it could not cap what such
an agent may do. Governed flags still strip-and-report rather than refuse —
asking for one is not an attack, it is amux's to set.

Scoped narrowly, after a first attempt was too broad: a NON-agent command (sh,
cmd) carries no permission flags to escape through, and whether it may be
spawned at all is the spawn allowlist's decision, not this function's. The first
version refused shells and broke six integration tests that spawn `sh` as a
worker — a supported, tested use. Deferring is both correct and narrower.

macOS 26.6.2: ./dev.py check green — 310 tests, 0 failures, clippy clean.
Type-checks for x86_64-pc-windows-msvc.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_017KoBz1RcGsUbYdMSCR7LaK