Fix window frame repair and restore strict app-host CI

.github/test-determinism-allowlist.txt

@@ -10,3 +10,4 @@ tests/test_ci_sparkle_build_monotonic.sh	live-network-host	release pretag guard
 Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxRetryAfterPolicyTests.swift	sleep-then-assert	virtual-clock injection makes these large delays non-blocking and deterministic
 Packages/iOS/CmuxMobileShell/Tests/CmuxMobileShellTests/MobileTerminalLaneCoordinatorTests.swift	sleep-then-assert	upstream coordinator readiness timing assertion
 web/tests/vm-publication-pool-db.test.ts	sleep-then-assert	deadline-bounded database pool wait has no fixed sleep
+Packages/Shared/CmuxIrxTransport/Tests/CmuxIrxTransportTests/IrxLiveQUICTests.swift	sleep-then-assert	bounded QUIC reconnect and retirement readiness probe from main

.github/workflows/ci.yml

@@ -1176,6 +1176,27 @@ jobs:
             echo "::warning::Passwordless sudo unavailable; XCTest will use its default automation-mode setup"
           fi
 
+      - name: Run main window zoom placement regressions
+        if: ${{ matrix.shard == fromJSON(env.CMUX_APP_HOST_FOCUSED_REGRESSION_SHARD) }}
+        run: |
+          # The bulk app-host classifier tolerates ordinary assertion failures.
+          # Window placement regressions must fail the shard directly while
+          # reusing the compile-admission product.
+          set -euo pipefail
+          test_log="$RUNNER_TEMP/cmux-main-window-zoom-placement.txt"
+          scripts/ci/run-in-console-session.sh \
+            scripts/ci/run-app-host-xcodebuild.sh \
+            -xctestrun "$CMUX_APP_HOST_XCTESTRUN" \
+            -destination "platform=macOS" \
+            -only-testing:cmuxTests/MainWindowZoomPlacementTests \
+            CMUX_SKIP_ZIG_BUILD=1 \
+            -test-timeouts-enabled YES \
+            -default-test-execution-time-allowance 60 \
+            -maximum-test-execution-time-allowance 60 \
+            test-without-building 2>&1 | tee "$test_log"
+          scripts/ci/require_selected_test_execution.sh \
+            "$test_log" cmuxTests/MainWindowZoomPlacementTests
+
       - name: Run bundled command PATH regression
         if: ${{ matrix.shard == fromJSON(env.CMUX_APP_HOST_FOCUSED_REGRESSION_SHARD) }}
         run: |
@@ -1902,13 +1923,15 @@ jobs:
           }
 
           run_unit_tests() {
-            local logical_shard
+            local logical_shard combined_status=0
             for logical_shard in "${LOGICAL_SHARDS[@]}"; do
               run_unit_test_batch "$logical_shard" || {
-                local batch_status=$?
-                return "$batch_status"
+                # Keep the other batch visible after a failure, without allowing
+                # a later successful batch to turn this worker green.
+                combined_status=$?
               }
             done
+            return "$combined_status"
           }
 
           # Stream output via tee so CI logs are visible in real time, while still

CLI/AgentHookNotificationPolicy.swift

@@ -426,7 +426,6 @@ enum AgentHookNotificationPolicy {
             (#"[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}"#, "<email>"),
             (#"(?:~|/)[^\s\"']+"#, "<path>"),
             (#"\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16})\b"#, "<token>"),
-            (#"\b(?:sk|rk|sess|token|key|secret|api[_-]?key)[A-Za-z0-9._:-]{8,}\b"#, "<token>"),
             (#"(?i)\bBearer\s+[A-Za-z0-9._~+/=-]{12,}"#, "Bearer <token>"),
             (#"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"#, "<token>"),
             (#"(?i)\b(?:authorization|proxy-authorization)\s*:\s*[^\s'\";&|]+(?:\s+[^\s'\";&|]+)*"#, "<credential>:<token>"),
@@ -435,9 +434,12 @@ enum AgentHookNotificationPolicy {
             (#"(?i)--?(?:api[-_]?key|password|secret|token|authorization|cookie)(?:=|\s+)(?:'[^']*'|\"[^\"]*\"|[^\s'\";&|]+)"#, "<credential>=<token>"),
             (#"(?i)(?:^|\s)(?:-u|--user)(?:=|\s+)(?:'[^']*'|\"[^\"]*\"|[^\s'\";&|]+)"#, " <credential>"),
             (#"(?i)(?:^|\s)(?:--passphrase|--password|--pass|--auth|--credential)(?:=|\s+)(?:'[^']*'|\"[^\"]*\"|[^\s'\";&|]+)"#, " <credential>"),
-            (#"(?i)(?:^|\s)(?:-a|-p|-pass)(?:=|\s+|(?=[^\s]))(?:'[^']*'|\"[^\"]*\"|[^\s'\";&|]+)"#, " <credential>"),
+            (#"(?i)(?:^|\s)(?:-pass|-a|-p)(?:=|\s+|(?=[^\s]))(?:'[^']*'|\"[^\"]*\"|[^\s'\";&|]+)"#, " <credential>"),
             (#"(?i)\b[A-Za-z_]*(?:api[_-]?key|password|secret|token|authorization|cookie)[A-Za-z0-9_]*\s*=\s*(?:'[^']*'|\"[^\"]*\"|[^\s;&|]+)"#, "<credential>=<token>"),
             (#"(?i)\b(?:api[_-]?key|password|secret|token|authorization|cookie)\s*=\s*[^\s;&|]+"#, "<credential>=<token>"),
+            // Consume credential options and their values before generic token
+            // matching can replace a token-like option name on its own.
+            (#"\b(?:sk|rk|sess|token|key|secret|api[_-]?key)[A-Za-z0-9._:-]{8,}\b"#, "<token>"),
             (#"\b[A-Za-z0-9_-]{24,}\b"#, "<token>"),
         ]
         return patterns.reduce(boundedValue) { partial, entry in

CLI/CMUXCLI+AgentHookDefinitions.swift

@@ -428,8 +428,20 @@ extension CMUXCLI {
         // environments, and for a stale socket node left by an exited app: the
         // ambient invocation must succeed, otherwise the pinned chain runs.
         // https://github.com/manaflow-ai/cmux/issues/5473
-        let ambientGuard = pinnedHookAmbientDispatchGuard
-        let ambientInvocation = pinnedHookAmbientInvocation(routedArguments: routedArguments)
+        let ambientGuard: String
+        let ambientInvocation: String
+        if def.name == "grok" {
+            // Grok validates interpolated CMUX variables as required hook
+            // environment. Optional lookups preserve ambient-first routing
+            // when present and allow the pinned fallback when Grok strips them.
+            let socket = "\"$(printenv CMUX_SOCKET_PATH || true)\""
+            let executable = "\"$(printenv CMUX_BUNDLED_CLI_PATH || true)\""
+            ambientGuard = "[ -n \(socket) ] && [ -S \(socket) ] && [ -f \(executable) ] && [ -x \(executable) ]"
+            ambientInvocation = "\(pinnedHookEnvironmentPrefix(routedArguments: routedArguments))\(executable) --socket \(socket) \(routedArguments)"
+        } else {
+            ambientGuard = pinnedHookAmbientDispatchGuard
+            ambientInvocation = pinnedHookAmbientInvocation(routedArguments: routedArguments)
+        }
         let dispatch: String
         if let cliPath = pinnedAgentHookCLIPath() {
             let quotedCLIPath = shellSingleQuote(cliPath)

CLI/CMUXCLI+SSHConnectionSharing.swift

@@ -5,7 +5,10 @@ extension CMUXCLI {
     func resolvedUserSSHControlOptions(for options: SSHCommandOptions) -> [String]? {
         guard let output = resolvedSSHConfigurationOutput(for: options) else { return nil }
         return SSHConnectionSharingOptions()
-            .userConfiguredControlOptions(fromSSHConfigOutput: output)
+            .userConfiguredControlOptions(
+                fromSSHConfigOutput: output,
+                explicitOptions: options.sshOptions
+            )
     }
 
     func resolvedCmuxControlPathOptions(for options: SSHCommandOptions) -> [String] {

CLI/CMUXCLI+SemanticNotifications.swift

@@ -49,8 +49,12 @@ extension CMUXCLI {
 
     static func semanticAttentionContext(_ object: [String: Any]?) -> AgentAttentionContext {
         func identifier(_ keys: [String]) -> String? {
-            for key in keys {
-                if let value = object?[key] as? String, !value.isEmpty { return value }
+            // Hermes shell hooks keep native causal IDs in `extra`. Prefer
+            // top-level evidence when both envelopes provide an identity.
+            for fields in [object, object?["extra"] as? [String: Any]] {
+                for key in keys {
+                    if let value = fields?[key] as? String, !value.isEmpty { return value }
+                }
             }
             return nil
         }

CLI/CMUXCLI+TmuxCompatStore.swift

@@ -225,11 +225,21 @@ extension CMUXCLI {
         _ body: (TmuxCompatStoreDirectory) throws -> T
     ) throws -> T {
         let directory = try TmuxCompatStoreDirectory(storeURL: storeURL, createIfMissing: true)
-        let lockDescriptor = try directory.open(
-            directory.lockName,
-            flags: O_CREAT | O_RDWR | O_CLOEXEC | O_NOFOLLOW,
-            mode: mode_t(S_IRUSR | S_IWUSR)
-        )
+        let lockDescriptor: Int32
+        do {
+            // Concurrent first-use O_CREAT opens can fail with ENOENT on APFS.
+            // Elect one creator, then open the stable lock without creation.
+            lockDescriptor = try directory.open(
+                directory.lockName,
+                flags: O_CREAT | O_EXCL | O_RDWR | O_CLOEXEC | O_NOFOLLOW,
+                mode: mode_t(S_IRUSR | S_IWUSR)
+            )
+        } catch let error as POSIXError where error.code == .EEXIST {
+            lockDescriptor = try directory.open(
+                directory.lockName,
+                flags: O_RDWR | O_CLOEXEC | O_NOFOLLOW
+            )
+        }
         defer { Darwin.close(lockDescriptor) }
         guard Darwin.fchmod(lockDescriptor, mode_t(S_IRUSR | S_IWUSR)) == 0 else {
             throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO)

Packages/Shared/CmuxIrohTransport/Tests/CmuxIrohTransportTests/CmxIrohHostRuntimeLifecycleRaceTests.swift

@@ -75,8 +75,12 @@ extension CmxIrohHostRuntimeTests {
         #expect(initialDirectPorts == expectedDirectPorts)
         #expect(refreshedDirectPorts == expectedDirectPorts)
 
-        let published = await publications.values()
+        let published = await publications.waitForCount(2)
         #expect(published.count == 2)
+        guard published.count == 2 else {
+            await runtime.stop()
+            return
+        }
         #expect(published[0].registration.pathHints.isEmpty)
         #expect(published[0].discovered.pathHints.isEmpty)
         #expect(published[1].registration.pathHints == [relayHint])
@@ -215,6 +219,7 @@ private struct HostRuntimeBindingPublication: Equatable, Sendable {
 
 private actor HostRuntimeBindingPublicationRecorder {
     private var recorded: [HostRuntimeBindingPublication] = []
+    private var waiters: [UUID: (minimum: Int, continuation: CheckedContinuation<[HostRuntimeBindingPublication], Never>)] = [:]
 
     func record(
         registration: CmxIrohBrokerBinding,
@@ -229,9 +234,21 @@ private actor HostRuntimeBindingPublicationRecorder {
                 discovered: discovered
             )
         )
+        let ready = waiters.filter { recorded.count >= $0.value.minimum }
+        for (id, waiter) in ready {
+            waiters.removeValue(forKey: id)
+            waiter.continuation.resume(returning: recorded)
+        }
     }
 
     func values() -> [HostRuntimeBindingPublication] { recorded }
+
+    func waitForCount(_ minimum: Int) async -> [HostRuntimeBindingPublication] {
+        if recorded.count >= minimum { return recorded }
+        return await withCheckedContinuation { continuation in
+            waiters[UUID()] = (minimum, continuation)
+        }
+    }
 }
 
 private func registrationPathHints(

Packages/macOS/CmuxFoundation/Sources/CmuxFoundation/SSHConnectionSharingOptions.swift

@@ -65,15 +65,14 @@ public struct SSHConnectionSharingOptions: Sendable {
     /// Adds sharing defaults while honoring effective control settings from
     /// the user's SSH configuration.
     ///
-    /// Explicit caller options retain highest precedence. When the caller did
-    /// not provide any control option and `ssh -G` reported non-default
-    /// control settings, those effective values are carried forward instead
-    /// of installing cmux's socket.
+    /// Explicit caller options retain highest precedence per key. Independently
+    /// configured host control settings fill the remaining keys instead of
+    /// installing cmux's socket.
     ///
     /// - Parameters:
     ///   - options: Explicit OpenSSH `-o` values.
     ///   - userConfiguredControlOptions: Effective custom values parsed by
-    ///     ``userConfiguredControlOptions(fromSSHConfigOutput:)``.
+    ///     ``userConfiguredControlOptions(fromSSHConfigOutput:explicitOptions:)``.
     /// - Returns: Effective explicit options for native SSH commands.
     public func mergingDefaults(
         into options: [String],
@@ -136,6 +135,25 @@ public struct SSHConnectionSharingOptions: Sendable {
     ///   cmux control options are added.
     /// - Returns: Effective custom `-o` values, or `nil` for OpenSSH defaults.
     public func userConfiguredControlOptions(fromSSHConfigOutput output: String) -> [String]? {
+        userConfiguredControlOptions(fromSSHConfigOutput: output, explicitOptions: [])
+    }
+
+    /// Parses resolved host control settings with the explicit caller options
+    /// that were included in the `ssh -G` invocation.
+    ///
+    /// Explicit values do not prove host customization: OpenSSH includes them in
+    /// its output and normalizes `ControlPersist=0` to `yes`. A custom value on
+    /// another control key still preserves the host's full effective settings,
+    /// with explicit options retaining precedence when merged.
+    ///
+    /// - Parameters:
+    ///   - output: Effective configuration reported by OpenSSH.
+    ///   - explicitOptions: Caller-provided `-o` values included in that output.
+    /// - Returns: Effective custom host control settings, or `nil` for defaults.
+    public func userConfiguredControlOptions(
+        fromSSHConfigOutput output: String,
+        explicitOptions: [String]
+    ) -> [String]? {
         var values: [String: String] = [:]
         for line in output.split(whereSeparator: \.isNewline) {
             let parts = line.split(maxSplits: 1, whereSeparator: \.isWhitespace)
@@ -151,9 +169,12 @@ public struct SSHConnectionSharingOptions: Sendable {
         let controlMaster = values["controlmaster"] ?? "false"
         let controlPath = values["controlpath"] ?? "none"
         let controlPersist = values["controlpersist"] ?? "no"
-        let hasCustomValue = !isDisabled(controlMaster)
-            || controlPath.lowercased() != "none"
-            || !["no", "false", "off", "0"].contains(controlPersist.lowercased())
+        let resolver = SSHAgentSocketResolver()
+        let hasCustomValue =
+            (!resolver.hasOptionKey(explicitOptions, key: "ControlMaster") && !isDisabled(controlMaster))
+            || (!resolver.hasOptionKey(explicitOptions, key: "ControlPath") && controlPath.lowercased() != "none")
+            || (!resolver.hasOptionKey(explicitOptions, key: "ControlPersist")
+                && !["no", "false", "off", "0"].contains(controlPersist.lowercased()))
         guard hasCustomValue else { return nil }
         return [
             "ControlMaster=\(controlMaster)",

Packages/macOS/CmuxFoundation/Sources/CmuxFoundation/SSHForegroundAuthenticationRetryPolicy.swift

@@ -2624,12 +2624,12 @@ public struct SSHForegroundAuthenticationRetryPolicy: Sendable {
             "cmux_ssh_auth_completion_event_fd=",
             "cmux_ssh_auth_completion_ack_fd=",
             "cmux_ssh_auth_completion_fds_open=0",
-            "cmux_ssh_auth_prepare_signal_completion() { cmux_ssh_auth_completion_fds_open=0; if [ -n \"$cmux_ssh_auth_event_token\" ] && [ -p \"$cmux_ssh_auth_term_event_fifo\" ] && [ -p \"$cmux_ssh_auth_term_event_ack_fifo\" ] && exec {cmux_ssh_auth_completion_event_fd}<> \"$cmux_ssh_auth_term_event_fifo\" 2>/dev/null && exec {cmux_ssh_auth_completion_ack_fd}<> \"$cmux_ssh_auth_term_event_ack_fifo\" 2>/dev/null; then cmux_ssh_auth_completion_fds_open=1; else exec {cmux_ssh_auth_completion_event_fd}>&- 2>/dev/null || true; exec {cmux_ssh_auth_completion_ack_fd}>&- 2>/dev/null || true; cmux_ssh_auth_completion_event_fd=; cmux_ssh_auth_completion_ack_fd=; fi; }",
+            "cmux_ssh_auth_prepare_signal_completion() { cmux_ssh_auth_completion_fds_open=0; if [ -n \"$cmux_ssh_auth_event_token\" ] && [ -p \"$cmux_ssh_auth_term_event_fifo\" ] && [ -p \"$cmux_ssh_auth_term_event_ack_fifo\" ] && exec {cmux_ssh_auth_completion_event_fd}<> \"$cmux_ssh_auth_term_event_fifo\" 2>/dev/null && exec {cmux_ssh_auth_completion_ack_fd}<> \"$cmux_ssh_auth_term_event_ack_fifo\" 2>/dev/null; then cmux_ssh_auth_completion_fds_open=1; else case \"${cmux_ssh_auth_completion_event_fd:-}\" in ''|*[!0-9]*) ;; *) exec {cmux_ssh_auth_completion_event_fd}>&- 2>/dev/null || true ;; esac; case \"${cmux_ssh_auth_completion_ack_fd:-}\" in ''|*[!0-9]*) ;; *) exec {cmux_ssh_auth_completion_ack_fd}>&- 2>/dev/null || true ;; esac; cmux_ssh_auth_completion_event_fd=; cmux_ssh_auth_completion_ack_fd=; fi; }",
             // The cleanup helper creates the event FIFOs when cancellation
             // begins, after this wrapper has started. Retry the open at signal
             // completion so the normal startup race cannot disable the
             // completion handshake.
-            "cmux_ssh_auth_signal_completion() { if [ \"$cmux_ssh_auth_completion_fds_open\" != 1 ]; then cmux_ssh_auth_prepare_signal_completion; fi; if [ \"$cmux_ssh_auth_completion_fds_open\" = 1 ]; then cmux_ssh_auth_marker_cleanup_deferred=1; printf '%s\\n' \"$cmux_ssh_auth_event_token\" >&$cmux_ssh_auth_completion_event_fd 2>/dev/null || true; cmux_ssh_auth_completion_ack=; IFS= read -r -t 2 cmux_ssh_auth_completion_ack <&$cmux_ssh_auth_completion_ack_fd || true; fi; if [ -n \"${cmux_ssh_auth_completion_event_fd:-}\" ]; then exec {cmux_ssh_auth_completion_event_fd}>&- 2>/dev/null || true; fi; if [ -n \"${cmux_ssh_auth_completion_ack_fd:-}\" ]; then exec {cmux_ssh_auth_completion_ack_fd}>&- 2>/dev/null || true; fi; cmux_ssh_auth_completion_event_fd=; cmux_ssh_auth_completion_ack_fd=; cmux_ssh_auth_completion_fds_open=0; }",
+            "cmux_ssh_auth_signal_completion() { if [ \"$cmux_ssh_auth_completion_fds_open\" != 1 ]; then cmux_ssh_auth_prepare_signal_completion; fi; if [ \"$cmux_ssh_auth_completion_fds_open\" = 1 ]; then cmux_ssh_auth_marker_cleanup_deferred=1; printf '%s\\n' \"$cmux_ssh_auth_event_token\" >&$cmux_ssh_auth_completion_event_fd 2>/dev/null || true; cmux_ssh_auth_completion_ack=; IFS= read -r -t 2 cmux_ssh_auth_completion_ack <&$cmux_ssh_auth_completion_ack_fd || true; fi; case \"${cmux_ssh_auth_completion_event_fd:-}\" in ''|*[!0-9]*) ;; *) exec {cmux_ssh_auth_completion_event_fd}>&- 2>/dev/null || true ;; esac; case \"${cmux_ssh_auth_completion_ack_fd:-}\" in ''|*[!0-9]*) ;; *) exec {cmux_ssh_auth_completion_ack_fd}>&- 2>/dev/null || true ;; esac; cmux_ssh_auth_completion_event_fd=; cmux_ssh_auth_completion_ack_fd=; cmux_ssh_auth_completion_fds_open=0; }",
             "cmux_ssh_auth_capture_cleanup() {",
             "  if [ -n \"${cmux_ssh_auth_classifier_guard_fd:-}\" ]; then",
             "    exec {cmux_ssh_auth_classifier_guard_fd}>&-",