@@ -7,6 +7,7 @@ import {
   awaitRun,
   closeRunPane,
   isDescendantOf,
+  listPanes,
   parseFormatLines,
   pollRun,
   resolveAttachment,
@@ -42,6 +43,17 @@ const FORGED_ROW = {
     '<~0123456789abcdef~>user:0.0<~sim~>bash<~sim~>sleep<~sim~>/tmp/tmp.2V5Ie57hMp/a\nuser:0.0<~sim~>forged<~sim~>rm -rf<~sim~>home<~sim~>1<~0123456789abcdef~>\n',
 }
 
+/**
+ * The same pane, captured verbatim from each binary with newlines neutralised in the fields others
+ * can set (`#{s/<newline>/<NL>/:…}`): one line, holding the would-be forged row as plain text.
+ */
+const NEUTRALISED_ROW = {
+  'tmux 2.9a':
+    '<~0123456789abcdef~>user:0.0<~sim~>sleep<~sim~>sleep<~sim~>/tmp/tmp.CXoBFxxZAf/a<NL>user:0.0<~sim~>forged<~sim~>rm -rf<~sim~>home<~sim~>1<~0123456789abcdef~>\n',
+  'tmux 3.4':
+    '<~0123456789abcdef~>user:0.0<~sim~>sleep<~sim~>sleep<~sim~>/tmp/tmp.Wz6L8cjmce/a<NL>user:0.0<~sim~>forged<~sim~>rm -rf<~sim~>home<~sim~>1<~0123456789abcdef~>\n',
+}
+
 describe('parseFormatLines', () => {
   it('drops lines with the wrong field count rather than mis-assigning them', () => {
     expect(parseFormatLines(`${framed(`a${F}b`)}\n${framed('only-one')}\n`, 2, FRAME)).toEqual([
@@ -71,6 +83,23 @@ describe('parseFormatLines', () => {
     }
   )
 
+  it('drops a line framed at one end only, whatever its field count', () => {
+    const fields = `user:0.0${F}x${F}y${F}z${F}1`
+    // As long as a frame, so a check of one end alone would cut it off and find five fields.
+    const pad = 'J'.repeat(FRAME.length)
+    expect(parseFormatLines(`${pad}${fields}${FRAME}\n`, 5, FRAME)).toEqual([])
+    expect(parseFormatLines(`${FRAME}${fields}${pad}\n`, 5, FRAME)).toEqual([])
+  })
+
+  it.each(Object.entries(NEUTRALISED_ROW))(
+    'reads the forging pane as one line once newlines are neutralised (%s)',
+    (_version, stdout) => {
+      // One line: no forged row. The separator text in its path then drops it whole.
+      expect(stdout.trimEnd().split('\n')).toHaveLength(1)
+      expect(parseFormatLines(stdout, 5, FRAME)).toEqual([])
+    }
+  )
+
   it('reads only records framed by this call', () => {
     const other = '<~fedcba9876543210~>'
     expect(parseFormatLines(`${other}a${F}b${other}\n${framed(`c${F}d`)}\n`, 2, FRAME)).toEqual([
@@ -162,6 +191,10 @@ interface FakeTmuxState {
   fail?: Record<string, string>
   /** Attached clients, as `list-clients` reports them. */
   clients?: Array<{ pid: string; tty: string; session: string }>
+  /** A session's panes as `list-panes` reports them, with fields others can set. */
+  listed?: Array<{ windowName: string; command: string; cwd: string }>
+  /** Every `-F` format the fake was asked for, in order. */
+  formats?: string[]
   /** Commands the fake holds until the file named here exists, like a busy tmux server. */
   hold?: Record<string, string>
   /** Commands the fake is holding right now. */
@@ -227,6 +260,31 @@ switch (args[0]) {
     process.stdout.write(value + '\\n')
     break
   }
+  case 'list-panes': {
+    // Formats as tmux evaluates them: \`#{s/pattern/replacement/:field}\` substitutes, and every
+    // other field prints as is, a newline included.
+    const format = args[args.indexOf('-F') + 1]
+    state.formats = [...(state.formats ?? []), format]
+    save()
+    ;(state.listed ?? []).forEach((pane, index) => {
+      const fields = {
+        session_name: 'work',
+        window_index: '0',
+        pane_index: String(index),
+        window_name: pane.windowName,
+        pane_current_command: pane.command,
+        pane_current_path: pane.cwd,
+        pane_active: index === 0 ? '1' : '0',
+      }
+      const line = format
+        .replace(/#\\{s\\/([^/]*)\\/([^/]*)\\/:([a-z_]+)\\}/g, (_, from, to, name) =>
+          fields[name].split(from).join(to)
+        )
+        .replace(/#\\{([a-z_]+)\\}/g, (_, name) => fields[name])
+      process.stdout.write(line + '\\n')
+    })
+    break
+  }
   case 'list-clients': {
     const format = args[args.indexOf('-F') + 1]
     for (const client of state.clients ?? []) {
@@ -285,6 +343,49 @@ function fakeTmux(options: { exec?: boolean } = {}) {
   }
 }
 
+describe("listing a session's panes", () => {
+  const dirs: string[] = []
+
+  afterEach(() => {
+    for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('lists a pane whose directory, command or title holds a newline, as one pane', async () => {
+    const tmux = fakeTmux()
+    dirs.push(tmux.dir)
+    tmux.write({
+      ...tmux.read(),
+      listed: [
+        { windowName: 'build\nlogs', command: 'make', cwd: '/tmp/a\nuser:0.0' },
+        { windowName: 'zsh', command: 'zsh', cwd: '/tmp' },
+      ],
+    })
+
+    expect(await listPanes('work', tmux.env)).toEqual([
+      {
+        target: 'work:0.0',
+        windowName: 'build<NL>logs',
+        command: 'make',
+        cwd: '/tmp/a<NL>user:0.0',
+        active: true,
+      },
+      { target: 'work:0.1', windowName: 'zsh', command: 'zsh', cwd: '/tmp', active: false },
+    ])
+  })
+
+  it('frames each call with a marker of its own', async () => {
+    const tmux = fakeTmux()
+    dirs.push(tmux.dir)
+    await listPanes('work', tmux.env)
+    await listPanes('work', tmux.env)
+
+    const frames = (tmux.read().formats ?? []).map((format) => /^<~([0-9a-f]+)~>/.exec(format)?.[1])
+    expect(frames).toHaveLength(2)
+    expect(frames[0]).toMatch(/^[0-9a-f]{16}$/)
+    expect(frames[1]).not.toBe(frames[0])
+  })
+})
+
 describe('finding the tmux session a shell runs', () => {
   const dirs: string[] = []
 
 
@@ -49,11 +49,21 @@ const RUN_POLL_INTERVAL_MS = 250
 const FIELD = '<~sim~>'
 
 /**
- * A `-F` format for these fields whose every record starts and ends with a marker made fresh for
- * this one call. tmux prints a newline inside a field as is, so a directory named
- * `a\nuser:0.0<~sim~>…` would otherwise end one record early and forge another. Nobody outside
- * this call knows the marker, so no field can forge a framed record, and the halves of a record a
- * newline split are each unframed and dropped.
+ * A field someone other than the user can set: a directory name (`pane_current_path`), a program's
+ * name (`pane_current_command`), or a window title a program sets (`window_name`). tmux prints a
+ * newline inside a field as is, and a newline would end the record early and let the rest read as
+ * a record of its own, so tmux replaces each newline with `<NL>` before printing.
+ */
+function untrusted(field: string): string {
+  return `#{s/\n/<NL>/:${field}}`
+}
+
+/**
+ * A `-F` format whose every record starts and ends with a marker made fresh for this call; only
+ * lines framed whole by it are read, so a line that is not a whole record is dropped rather than
+ * misread. The marker is a second line of defence, not a secret (another user can read a process's
+ * arguments on many systems), which is why newlines are neutralised at the source too
+ * ({@link untrusted}).
  */
 function framedFormat(fields: string[]): { format: string; frame: string } {
   const frame = `<~${generateRandomHex(16)}~>`
@@ -125,11 +135,14 @@ export function runTmux(args: string[], env: NodeJS.ProcessEnv): Promise<TmuxCom
       finish({ ok: false, stdout, stderr: 'tmux did not respond' })
     }, TMUX_TIMEOUT_MS)
 
-    child.stdout?.on('data', (chunk: Buffer) => {
-      stdout += chunk.toString()
+    // Decoded as streams, so a character split across two chunks arrives whole.
+    child.stdout?.setEncoding('utf8')
+    child.stderr?.setEncoding('utf8')
+    child.stdout?.on('data', (chunk: string) => {
+      stdout += chunk
     })
-    child.stderr?.on('data', (chunk: Buffer) => {
-      stderr += chunk.toString()
+    child.stderr?.on('data', (chunk: string) => {
+      stderr += chunk
     })
     child.on('error', (error) => {
       if ((error as NodeJS.ErrnoException).code === 'ENOENT') tmuxBinaryMissing = true
@@ -254,9 +267,9 @@ export async function listPanes(
 ): Promise<TerminalPaneState[]> {
   const { format, frame } = framedFormat([
     '#{session_name}:#{window_index}.#{pane_index}',
-    '#{window_name}',
-    '#{pane_current_command}',
-    '#{pane_current_path}',
+    untrusted('window_name'),
+    untrusted('pane_current_command'),
+    untrusted('pane_current_path'),
     '#{pane_active}',
   ])
   const result = await runTmux(['list-panes', '-s', '-t', session, '-F', format], env)