Fix set-window-status from sandbox containers via RPC branch resolution

The workmux stub inside containers had no tmux context (no TMUX_PANE),
so set-window-status silently failed. Pass WORKMUX_BRANCH env to containers,
include it in the RPC payload, and resolve the tmux pane ID on the host
before spawning the workmux binary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: centdix

backend/src/docker.ts

@@ -66,8 +66,9 @@ args = sys.argv[2:]
 host = os.environ.get("WORKMUX_RPC_HOST", "host.docker.internal")
 port = os.environ.get("WORKMUX_RPC_PORT", "5111")
 token = os.environ.get("WORKMUX_RPC_TOKEN", "")
+branch = os.environ.get("WORKMUX_BRANCH", "")
 
-payload = {"command": cmd, "args": args}
+payload = {"command": cmd, "args": args, "branch": branch}
 data = json.dumps(payload).encode()
 req = urllib.request.Request(
     f"http://{host}:{port}/rpc/workmux",
@@ -240,6 +241,7 @@ export function buildDockerRunArgs(
   args.push("-e", `WORKMUX_RPC_HOST=host.docker.internal`);
   args.push("-e", `WORKMUX_RPC_PORT=${rpcPort}`);
   args.push("-e", `WORKMUX_RPC_TOKEN=${rpcSecret}`);
+  args.push("-e", `WORKMUX_BRANCH=${opts.branch}`);
 
   // Image + command.
   args.push(sandboxConfig.image, "sleep", "infinity");
@@ -331,7 +333,7 @@ export async function launchContainer(opts: LaunchContainerOpts): Promise<string
   // Inject workmux stub so agents inside the container can call host-side workmux.
   const stub = buildWorkmuxStub();
   const injectProc = Bun.spawn(
-    ["docker", "exec", "-i", name, "sh", "-c",
+    ["docker", "exec", "-u", "root", "-i", name, "sh", "-c",
      "cat > /usr/local/bin/workmux && chmod +x /usr/local/bin/workmux"],
     { stdin: "pipe", stdout: "pipe", stderr: "pipe" },
   );

backend/src/rpc.ts

@@ -4,10 +4,43 @@ import { jsonResponse } from "./http";
 interface RpcRequest {
   command: string;
   args?: string[];
+  branch?: string;
 }
 
 type RpcResponse = { ok: true; output: string } | { ok: false; error: string }
 
+/** Build env with TMUX set so workmux can resolve agent states outside tmux. */
+function tmuxEnv(): Record<string, string | undefined> {
+  if (Bun.env.TMUX) return Bun.env;
+  const tmpdir = Bun.env.TMUX_TMPDIR || "/tmp";
+  const uid = process.getuid?.() ?? 1000;
+  return { ...Bun.env, TMUX: `${tmpdir}/tmux-${uid}/default,0,0` };
+}
+
+/**
+ * Resolve the tmux pane ID for a worktree window (wm-{branch}).
+ * Returns the first pane ID, or null if the window doesn't exist.
+ */
+async function resolvePaneId(branch: string): Promise<string | null> {
+  const proc = Bun.spawn(
+    ["tmux", "list-panes", "-a", "-F", "#{window_name}\t#{pane_id}"],
+    { stdout: "pipe", stderr: "pipe", env: tmuxEnv() },
+  );
+  const [stdout, , exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  if (exitCode !== 0) return null;
+
+  const target = `wm-${branch}`;
+  for (const line of stdout.trim().split("\n")) {
+    const [windowName, paneId] = line.split("\t");
+    if (windowName === target && paneId) return paneId;
+  }
+  return null;
+}
+
 export async function handleWorkmuxRpc(req: Request): Promise<Response> {
   const secret = await loadRpcSecret();
   const authHeader = req.headers.get("Authorization");
@@ -23,15 +56,26 @@ export async function handleWorkmuxRpc(req: Request): Promise<Response> {
     return jsonResponse({ ok: false, error: "Invalid JSON" } satisfies RpcResponse, 400);
   }
 
-  const { command, args = [] } = raw;
+  const { command, args = [], branch } = raw;
   if (!command) {
     return jsonResponse({ ok: false, error: "Missing command" } satisfies RpcResponse, 400);
   }
 
   try {
+    // Build spawn environment. For set-window-status from a container,
+    // resolve the tmux pane ID so the workmux binary can target the right window.
+    const env = tmuxEnv();
+    if (command === "set-window-status" && branch) {
+      const paneId = await resolvePaneId(branch);
+      if (paneId) {
+        env.TMUX_PANE = paneId;
+      }
+    }
+
     const proc = Bun.spawn(["workmux", command, ...args], {
       stdout: "pipe",
       stderr: "pipe",
+      env,
     });
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(proc.stdout).text(),