A pane whose pane_current_path contains a newline — a directory whose name has one — makes Server.panes and Server.windows raise ValueError: zip() argument 2 is shorter than argument 1 for the entire server, healthy panes included.

Reproduce

$ mkdir -p "/tmp/evil"$'\n'"dir"
$ tmux -L probe new-session -d -s base
$ tmux -L probe new-window -d -t base -c "/tmp/evil"$'\n'"dir"

>>> server = libtmux.Server(socket_name="probe")
>>> server.sessions   # may work, see below
>>> server.windows
ValueError: zip() argument 2 is shorter than argument 1
>>> server.panes
ValueError: zip() argument 2 is shorter than argument 1

Cause

fetch_objs iterated stdout one line per object:

outputs = [parse_output(line, list_cmd, tmux_version) for line in proc.stdout]

tmux writes one record per line, but a value containing a newline splits that record across two output lines. Each fragment then reaches parse_output with fewer values than the template has fields, and its zip(..., strict=True) raises.

Two properties make this worse than a single bad pane:

• Every pane row carries pane_current_path, and every pane-targeting lookup enumerates panes, so one directory breaks resolution for all of them.
• The blast radius moves with the active pane. Session and window rows resolve pane_* against the session's active pane, so the same server appears to work or fail depending on which pane the user last selected — which is why sessions above may or may not raise.

Fix

Records are regrouped on the field separator instead of on newlines. This is exact rather than merely better: the -F template from get_output_format terminates every field with a separator, so one record holds exactly len(fields) separators and a newline is never one of them. Nothing is split on newlines any more, so a value may contain any number of them, in any position. The newline that terminated the previous record survives the rejoin glued to the next record's first value, and is stripped as the delimiter it is.

Regrouping also makes a forged separator detectable. A value that contains the separator itself previously corrupted the parse silently; a value count that is not a whole number of records now raises a LibTmuxException naming the cause.

Tests

_split_records is covered for a newline in the first, middle, and last field, consecutive newlines, a poisoned record between clean ones, empty values, zero records, and the forged-separator error.

Verified end to end against a real poisoned server: sessions, windows, and panes all enumerate, and the value round-trips exactly as '/tmp/evil\ndir'.

Provenance

Found while auditing libtmux-mcp, where an agent that cd-ed a pane into such a directory could not repair it through the MCP at all — every tool that could have moved the pane back needed the same enumeration.

tests/test_server.py::test_new_session_shell_env fails in my local environment before and after this change (new-session: command too long, caused by an unusually large environment being passed as -e flags); it is unrelated.