fix(relay): close cancelled PTY resources

[lawrencecchen]

Summary

• retain a cancellation-aware owner through the spawn_blocking PTY handoff
• kill and reap PTY and pipe children with bounded cleanup and process-group escalation
• close control probes and cover handoff ownership behavior with focused tests

Base: fix/tui-tunnel-security-followup (stacked follow-up to PR #11119).

Verification

• rustfmt +1.95 --edition 2024 --check on changed relay files
• hosted verify-cmux-tui-hosted.sh --filter chatmux_relay pending for current head

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Cancelled tunnel opens previously could leave PTY/pipe children, control sockets, or daemon processes behind; cleanup is now bounded, rerun-safe, and identity-fenced, killing process groups with escalating waits and removing a socket only when its device/inode matches the daemon this relay spawned. Authority revocation fails closed, so validated opened and output frames are re-checked at enqueue and cannot cross the revocation boundary.

• PTY spawn_blocking handoffs retain a cancellation owner; child process groups are reaped with bounded waits, escalating to detached fallback reapers.
• Daemon cleanup shares core's .spawn-lock, now O_NOFOLLOW, owner-only, and migrated to 0600 on open; rerunning cleanup skips sockets owned by a replacement daemon and only unlinks inode-matched, non-symlink sockets.
• Authority transitions serialize validation and attachment removal, release the barrier before blocking callbacks, and return trust_revoked for cancelled opens.

^{Written for commit fea1073. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux166	Ready	Preview	Aug 28, 2026 10:41pm
cmux41	Ready	Preview	Aug 28, 2026 10:41pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 49f6fea1-bde9-4f29-a846-0b66295e8c7a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[lawrencecchen]

Fleet instruction update for head fea10730ded8e814035118dbf6f86574189a936e: this PR is classified other. No macOS build tag is claimed. The current controller app recipe does not establish iOS/test readiness; that requires the appropriate validated recipe. Use cmux-ci for supported jobs, retain the returned ID and receipt, and wait on the same ID after any timeout. Do not use retired maclease allocation or post credentials. Exact-head tags will be posted only after the applicable build succeeds.