Device-list authorization + DO-first control plane (listauth)

.github/workflows/ci.yml

@@ -170,6 +170,13 @@ jobs:
         working-directory: agent-chat
         run: bun test/claude-environment.test.ts
 
+      # The committed control-plane wire types (Swift + TS) must be exactly
+      # what quicktype regenerates from schemas/control-plane/; fails on any
+      # hand edit or schema change without regen. Needs bun (bunx quicktype),
+      # set up above.
+      - name: Validate control-plane generated types
+        run: ./scripts/check-control-plane-types.sh
+
       - name: Set up Python 3.9 for nightly prune compatibility
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxPairingQRCode.swift

@@ -100,10 +100,20 @@ public struct CmxPairingQRCode: Sendable {
             guard let identity = encodableIrohIdentity(of: ticket) else {
                 return nil
             }
-            items = [
+            var irohItems = [
                 "v=\(Self.irohVersion)",
                 "i=\(identity.endpointID)"
             ]
+            // The Mac device id rides along so the decoded ticket can name the
+            // peer intent (`expectedPeerDeviceID`) the irx transport requires
+            // before any dial. Endpoint-only tickets decode with an empty
+            // device id, and a fresh pairing then has no post-handshake source
+            // for it, so every injected physical-device auto-pair fails
+            // `missingPeerIntent` without this field.
+            if let macDeviceID = normalizedNonEmpty(ticket.macDeviceID) {
+                irohItems.append("d=\(percentEncodeQueryValue(macDeviceID))")
+            }
+            items = irohItems
         case .legacyPrivateNetworkCompatibility:
             guard let routes = encodableTailscaleRoutes(of: ticket) else {
                 return nil
@@ -307,13 +317,19 @@ private extension CmxPairingQRCode {
     /// Decode the v3 endpoint-only Iroh grammar.
     func decodeIroh(_ components: URLComponents) throws -> CmxAttachTicket {
         let items = components.queryItems ?? []
-        guard items.count == 2,
+        // `d` (the Mac device id) is optional so pre-existing endpoint-only
+        // URLs keep decoding; everything else stays exact-cardinality strict.
+        guard items.count <= 3,
+              items.allSatisfy({ ["v", "i", "d"].contains($0.name) }),
               items.filter({ $0.name == "v" }).count == 1,
               let endpointID = items.first(where: { $0.name == "i" })?.value,
               items.filter({ $0.name == "i" }).count == 1,
+              items.filter({ $0.name == "d" }).count <= 1,
               let identity = try? CmxIrohPeerIdentity(endpointID: endpointID) else {
             throw MobileSyncPairingPayloadError.invalidURL
         }
+        let macDeviceID = items.first(where: { $0.name == "d" })?.value?
+            .trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
         let route = try CmxAttachRoute(
             id: CmxAttachTransportKind.iroh.rawValue,
             kind: .iroh,
@@ -323,7 +339,7 @@ private extension CmxPairingQRCode {
         let ticket = try CmxAttachTicket(
             workspaceID: "",
             terminalID: nil,
-            macDeviceID: "",
+            macDeviceID: macDeviceID,
             macDisplayName: nil,
             // v3 is intentionally endpoint-only. `nil` means the QR did not
             // make a compatibility claim, unlike v2's explicit unknown value

Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxAttachTicketIrohQRCodeTests.swift

@@ -94,12 +94,16 @@ private func compactIrohQRHostPortRoute() throws -> CmxAttachRoute {
         routeDisclosureMode: .irohIdentityOnly,
         pairingURLScheme: compactIrohQRTarget
     ))
+    // The Mac device id is deliberately part of the minimal grammar: the
+    // decoded ticket must name the peer intent (`expectedPeerDeviceID`) the
+    // irx transport requires before it will dial, and a fresh pairing has no
+    // other source for it. It identifies but never authorizes; admission
+    // stays the only authority.
     #expect(
         pairingURL
-            == "\(compactIrohQRTarget.rawValue)://attach?v=3&i=\(compactIrohQREndpointID)"
+            == "\(compactIrohQRTarget.rawValue)://attach?v=3&i=\(compactIrohQREndpointID)&d=mac-1"
     )
     #expect(!pairingURL.contains("payload="))
-    #expect(!pairingURL.contains("mac-1"))
     #expect(!pairingURL.contains(privateAddress))
     #expect(!pairingURL.contains(relayURL))
     #expect(!pairingURL.contains(websocketURL))
@@ -118,7 +122,7 @@ private func compactIrohQRHostPortRoute() throws -> CmxAttachRoute {
         )
     )
     #expect(pairingDecoded.routes == [expectedPairingRoute])
-    #expect(pairingDecoded.macDeviceID.isEmpty)
+    #expect(pairingDecoded.macDeviceID == "mac-1")
     #expect(pairingDecoded.macDisplayName == nil)
     #expect(pairingDecoded.macUserID == nil)
     // Endpoint-only v3 codes intentionally omit compatibility metadata. Keep
@@ -146,7 +150,10 @@ private func compactIrohQRHostPortRoute() throws -> CmxAttachRoute {
     )
     #expect(pairingURL.utf8.count < beforeURL.utf8.count)
     #expect(afterModules < beforeModules)
-    #expect(afterModules <= 41)
+    // 45 = one QR version above the endpoint-only 41: the `d` device-id field
+    // buys working irx peer intent for one version step, still far below the
+    // 57-module compact v1 payload.
+    #expect(afterModules <= 45)
 
     let tailscaleOnly = try CmxAttachTicket(
         workspaceID: "",
@@ -164,3 +171,22 @@ private func compactIrohQRHostPortRoute() throws -> CmxAttachRoute {
         )
     }
 }
+
+@Test func identityOnlyQRDecodeToleratesLegacyURLsWithoutDeviceID() throws {
+    // Pre-`d` encoders mint exactly `v` + `i`. Those URLs must keep decoding
+    // (empty device id), and a duplicated or unknown parameter still fails.
+    let base = "\(compactIrohQRTarget.rawValue)://attach?v=3&i=\(compactIrohQREndpointID)"
+    let legacy = try #require(URLComponents(string: base))
+    let decoded = try CmxPairingQRCode().decode(legacy)
+    #expect(decoded.macDeviceID.isEmpty)
+    #expect(decoded.routes.count == 1)
+
+    let doubledDevice = try #require(URLComponents(string: base + "&d=a&d=b"))
+    #expect(throws: MobileSyncPairingPayloadError.invalidURL) {
+        _ = try CmxPairingQRCode().decode(doubledDevice)
+    }
+    let unknownParameter = try #require(URLComponents(string: base + "&x=1"))
+    #expect(throws: MobileSyncPairingPayloadError.invalidURL) {
+        _ = try CmxPairingQRCode().decode(unknownParameter)
+    }
+}

Packages/Shared/CmuxAuthRuntime/Sources/CmuxAuthRuntime/Coordinator/AuthCoordinator.swift

@@ -250,6 +250,25 @@ public final class AuthCoordinator {
         await checkExistingSession()
     }
 
+    /// Supersede parked timed-out auth phases before an explicit interactive
+    /// attempt (a pairing attempt, a tapped retry). One Stack call hung on a
+    /// dead pooled connection times its phase out and dampens it for 30s;
+    /// without this, the very next user action fails in milliseconds with
+    /// ``AuthError/timedOut`` even though a fresh request would succeed. The
+    /// timed-out operation was already cancelled at its deadline and its
+    /// writes are dropped by the sign-in chokepoint, so releasing its slot is
+    /// safe; live operations keep their exclusivity.
+    public func supersedeTimedOutAuthPhases() async {
+        // Both dampers: sign-in exchanges park in the phase registry, and
+        // token-touching work (access-token fetches, session probes) parks in
+        // the coordinator's own timed-out states. Token-touching phases allow
+        // concurrent actives by construction (write safety is generational,
+        // via finishTokenTouchingPhase), so dropping the damper alone is
+        // sufficient there.
+        await phaseTimeoutRegistry.supersedeTimedOutPhases()
+        timedOutTokenTouchingPhaseStates.removeAll()
+    }
+
     // MARK: - Sign-in flows
 
     /// Send a sign-in code to `email`, or run the debug `42` shortcut.

Packages/Shared/CmuxAuthRuntime/Sources/CmuxAuthRuntime/Coordinator/AuthPhaseTimeoutRegistry.swift

@@ -57,4 +57,22 @@ actor AuthPhaseTimeoutRegistry {
         activePhases[key] = nil
         timedOutPhases[key] = nil
     }
+
+    /// Supersede every parked timed-out phase for an explicit interactive
+    /// attempt. A timed-out phase's operation was already cancelled at its
+    /// deadline and the sign-in write chokepoint drops a cancelled flow's
+    /// token writes, so the damper's only remaining job is suppressing
+    /// AUTOMATIC retry hammering; an explicit user action (a pairing attempt,
+    /// a tapped retry) is entitled to reclaim the phase immediately. Only the
+    /// timed-out operation's slot is released: a live, untimed-out operation
+    /// keeps refusing concurrent begins exactly as before.
+    func supersedeTimedOutPhases() {
+        for (key, state) in timedOutPhases {
+            activePhases[key]?.remove(state.id)
+            if activePhases[key]?.isEmpty == true {
+                activePhases[key] = nil
+            }
+        }
+        timedOutPhases.removeAll()
+    }
 }

Packages/Shared/CmuxAuthRuntime/Tests/CmuxAuthRuntimeTests/AuthCoordinatorTimeoutTests.swift

@@ -254,6 +254,37 @@ import Testing
         await waitUntilTokenTouchingCleanupFinished(coordinator)
     }
 
+    @Test func explicitSupersedeUnblocksTimedOutAccessTokenPhaseImmediately() async throws {
+        // One launch-time Stack call hung on a dead pooled connection arms
+        // the token-touching damper; a pairing attempt seconds later must be
+        // able to supersede it instead of fast-failing for the damper's
+        // remaining window.
+        let clock = ManualTestClock()
+        let user = CMUXAuthUser(id: "u1", primaryEmail: "a@b.com", displayName: "A")
+        let client = HangingLaunchTokenProbeAuthClient(user: user)
+        let coordinator = makeCoordinator(client: client, clock: clock)
+
+        let first = Task { try await coordinator.accessToken() }
+        await client.accessTokenDidStart()
+        await clock.waitUntilSleepers()
+        clock.advance(by: Self.testTimeouts.network)
+        await #expect(throws: AuthError.timedOut) { try await first.value }
+
+        // Damper armed (default 30s window): an automatic retry fast-fails.
+        let second = Task { try await coordinator.accessToken() }
+        await #expect(throws: AuthError.timedOut) { try await second.value }
+        #expect(await client.accessStartCount == 1)
+
+        // An explicit interactive attempt supersedes and runs a fresh probe.
+        await coordinator.supersedeTimedOutAuthPhases()
+        await client.releaseHangingAccessTokenProbe()
+        await waitUntilTokenTouchingCleanupFinished(coordinator)
+        await #expect(throws: AuthError.networkError) {
+            try await coordinator.accessToken()
+        }
+        #expect(await client.accessStartCount == 2)
+    }
+
     @Test func timedOutAccessTokenPhaseRetriesAfterBoundedReset() async throws {
         let clock = ManualTestClock()
         let user = CMUXAuthUser(id: "u1", primaryEmail: "a@b.com", displayName: "A")

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientRuntime+Lifecycle.swift

@@ -114,7 +114,7 @@ extension CmxIrohClientRuntime {
     }
 
     static func isConnectivity(_ error: any Error) -> Bool {
-        (error as? CmxIrohTrustBrokerClientError) == .connectivity
+        (error as? CmxIrohTrustBrokerClientError)?.isConnectivity == true
     }
 
     /// Failures that may fall back to the verified offline policy cache.

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohOnlineAdmissionRegistry.swift

@@ -531,6 +531,6 @@ public actor CmxIrohOnlineAdmissionRegistry {
     }
 
     private static func isConnectivity(_ error: any Error) -> Bool {
-        (error as? CmxIrohTrustBrokerClientError) == .connectivity
+        (error as? CmxIrohTrustBrokerClientError)?.isConnectivity == true
     }
 }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohRegistryContextProvider.swift

@@ -1128,6 +1128,6 @@ public actor CmxIrohRegistryContextProvider: CmxIrohClientContextProvider {
     }
 
     private static func isConnectivity(_ error: any Error) -> Bool {
-        (error as? CmxIrohTrustBrokerClientError) == .connectivity
+        (error as? CmxIrohTrustBrokerClientError)?.isConnectivity == true
     }
 }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohTrustBrokerClient.swift

@@ -812,8 +812,11 @@ public actor CmxIrohTrustBrokerClient: CmxIrohRelayPolicyServing {
             // and indistinguishable from an unreachable broker for every
             // caller policy (retry, cached-policy fallback, verified-policy
             // preservation), so classify it as connectivity, not as a
-            // definitive authentication failure.
-            throw CmxIrohTrustBrokerClientError.connectivity
+            // definitive authentication failure. A URL-loading failure from
+            // the source's own refresh call keeps its code for attribution.
+            throw CmxIrohTrustBrokerClientError.connectivity(
+                (error as? URLError).map(CmxIrohBrokerConnectivityCause.init)
+            )
         }
         guard let pair = capturedPair else {
             throw CmxIrohTrustBrokerClientError.missingAuthentication
@@ -838,7 +841,9 @@ public actor CmxIrohTrustBrokerClient: CmxIrohRelayPolicyServing {
             } catch is CancellationError {
                 throw CancellationError()
             } catch {
-                throw CmxIrohTrustBrokerClientError.connectivity
+                throw CmxIrohTrustBrokerClientError.connectivity(
+                    (error as? URLError).map(CmxIrohBrokerConnectivityCause.init)
+                )
             }
             guard let recovered else { throw error }
             return try await performAuthenticatedRequest(
@@ -923,7 +928,9 @@ public actor CmxIrohTrustBrokerClient: CmxIrohRelayPolicyServing {
         do {
             (data, response) = try await transport.data(for: request)
         } catch let error as URLError where Self.isConnectivityFailure(error.code) {
-            throw CmxIrohTrustBrokerClientError.connectivity
+            throw CmxIrohTrustBrokerClientError.connectivity(
+                CmxIrohBrokerConnectivityCause(error)
+            )
         }
         guard let http = response as? HTTPURLResponse else {
             throw CmxIrohTrustBrokerClientError.nonHTTPResponse

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohTrustBrokerClientError.swift

@@ -1,13 +1,64 @@
 public import CMUXMobileCore
+public import Foundation
+
+/// Underlying URL-loading failure carried by connectivity-class broker
+/// errors, so journals and caller retry policies can distinguish a dead
+/// kept-alive connection (NSURLErrorNetworkConnectionLost) from DNS loss,
+/// timeouts, or a token source that could not produce a coherent pair.
+public struct CmxIrohBrokerConnectivityCause: Equatable, Sendable,
+    CustomStringConvertible
+{
+    /// NSURLErrorDomain code, e.g. -1005.
+    public let urlErrorCode: Int
+
+    public init(urlErrorCode: Int) {
+        self.urlErrorCode = urlErrorCode
+    }
+
+    public init(_ error: URLError) {
+        self.init(urlErrorCode: error.code.rawValue)
+    }
+
+    /// Whether this is the connection-reuse failure class: a pooled
+    /// keep-alive connection the server closed while it sat idle, surfaced
+    /// only when the next request's first read fails. URLSession never
+    /// transparently retries a request whose body bytes were already written
+    /// (Apple QA1941), so idempotent callers retry once themselves; the
+    /// failed attempt already purged the dead pooled connection.
+    public var isConnectionReuseFailure: Bool {
+        urlErrorCode == URLError.Code.networkConnectionLost.rawValue
+    }
+
+    public var description: String { "\(symbolicName)(\(urlErrorCode))" }
+
+    private var symbolicName: String {
+        switch URLError.Code(rawValue: urlErrorCode) {
+        case .timedOut: "timedOut"
+        case .cannotFindHost: "cannotFindHost"
+        case .cannotConnectToHost: "cannotConnectToHost"
+        case .networkConnectionLost: "networkConnectionLost"
+        case .dnsLookupFailed: "dnsLookupFailed"
+        case .notConnectedToInternet: "notConnectedToInternet"
+        case .internationalRoamingOff: "internationalRoamingOff"
+        case .callIsActive: "callIsActive"
+        case .dataNotAllowed: "dataNotAllowed"
+        case .cannotLoadFromNetwork: "cannotLoadFromNetwork"
+        default: "urlError"
+        }
+    }
+}
 
 /// Failures at the authenticated HTTP trust-broker boundary.
 public enum CmxIrohTrustBrokerClientError:
     CmxRetryAfterProviding,
     Equatable,
     Sendable
 {
-    /// The authenticated broker could not be reached through the current network.
-    case connectivity
+    /// The authenticated broker could not be reached through the current
+    /// network. Carries the underlying URL-loading classification when one
+    /// exists; a `nil` cause is a token source that could not read a
+    /// coherent credential pair for a non-network reason.
+    case connectivity(CmxIrohBrokerConnectivityCause?)
     case invalidBaseURL
     case missingAuthentication
     case invalidAuthentication
@@ -87,4 +138,43 @@ public enum CmxIrohTrustBrokerClientError:
         guard case let .rateLimited(_, retryAfterSeconds) = self else { return nil }
         return retryAfterSeconds
     }
+
+    /// Whether this is any connectivity-class failure, regardless of the
+    /// underlying cause detail. Callers deciding retry or cached-state
+    /// policy match on this instead of value equality, which would treat
+    /// differently-attributed connectivity failures as distinct.
+    public var isConnectivity: Bool {
+        if case .connectivity = self { return true }
+        return false
+    }
+}
+
+extension CmxIrohTrustBrokerClientError: CustomStringConvertible {
+    /// Journal-stable rendering: identical to the previously synthesized
+    /// text for every case, except that an attributed connectivity failure
+    /// appends its URL-loading cause, e.g.
+    /// `connectivity(networkConnectionLost(-1005))`.
+    public var description: String {
+        switch self {
+        case .connectivity(nil):
+            "connectivity"
+        case let .connectivity(cause?):
+            "connectivity(\(cause))"
+        case .invalidBaseURL:
+            "invalidBaseURL"
+        case .missingAuthentication:
+            "missingAuthentication"
+        case .invalidAuthentication:
+            "invalidAuthentication"
+        case .nonHTTPResponse:
+            "nonHTTPResponse"
+        case let .rateLimited(code, retryAfterSeconds):
+            "rateLimited(code: \(String(describing: code)), "
+                + "retryAfterSeconds: \(retryAfterSeconds))"
+        case let .rejected(statusCode, code):
+            "rejected(statusCode: \(statusCode), code: \(String(describing: code)))"
+        case .invalidResponse:
+            "invalidResponse"
+        }
+    }
 }