Fix lost Cloud terminal sizing claims after hidden restore

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/DiagnosticLocalization.swift

@@ -2,6 +2,8 @@ import Foundation
 
 /// Resolves diagnostic copy from the shared package's locale catalog.
 struct DiagnosticLocalization: Sendable {
+    private final class BundleFinder {}
+
     let locale: Locale
     private let bundle: Bundle
 
@@ -23,21 +25,45 @@ struct DiagnosticLocalization: Sendable {
     }
 
     private static func bundle(for locale: Locale) -> Bundle {
-        languageBundle(for: locale) ?? .module
+        languageBundle(for: locale) ?? packageResourceBundle ?? .main
     }
 
     private static func languageBundle(for locale: Locale) -> Bundle? {
+        guard let packageResourceBundle else { return nil }
         let identifiers = Bundle.preferredLocalizations(
-            from: Bundle.module.localizations,
+            from: packageResourceBundle.localizations,
             forPreferences: [locale.identifier]
         )
         for identifier in identifiers {
-            guard let path = Bundle.module.path(
+            guard let path = packageResourceBundle.path(
                 forResource: identifier,
                 ofType: "lproj"
             ), let bundle = Bundle(path: path) else { continue }
             return bundle
         }
         return nil
     }
+
+    /// SwiftPM normally synthesizes `Bundle.module` for this lookup. That
+    /// accessor traps when a tagged app is replaced while its previous process
+    /// is still starting, because the old process can briefly observe a bundle
+    /// whose package resources have moved. Keep the lookup optional so
+    /// diagnostics fall back to their supplied English defaults instead of
+    /// turning startup telemetry into a process-wide fatal error.
+    private static let packageResourceBundle: Bundle? = {
+        let bundleName = "CMUXMobileCore_CMUXMobileCore"
+        let resourceRoots = [
+            Bundle.main.resourceURL,
+            Bundle(for: BundleFinder.self).resourceURL,
+            Bundle.main.bundleURL,
+        ]
+        for root in resourceRoots {
+            guard let root else { continue }
+            let url = root.appendingPathComponent(bundleName + ".bundle")
+            if let bundle = Bundle(url: url) {
+                return bundle
+            }
+        }
+        return nil
+    }()
 }

Packages/Shared/CmuxIrohTransport/Package.swift

@@ -18,7 +18,7 @@ let package = Package(
         .package(path: "../CMUXMobileCore"),
         .package(
             url: "https://github.com/manaflow-ai/iroh-ffi.git",
-            exact: "1.0.2-cmux.7.ios17.2"
+            exact: "1.0.2-cmux.7.ios17.3"
         ),
     ],
     targets: [

Packages/Shared/CmuxIrxTransport/Package.swift

@@ -21,7 +21,7 @@ let package = Package(
         .package(path: "../CmuxIrohTransport"),
         .package(
             url: "https://github.com/manaflow-ai/iroh-ffi.git",
-            exact: "1.0.2-cmux.7.ios17.2"
+            exact: "1.0.2-cmux.7.ios17.3"
         ),
     ],
     targets: [

Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurface+RemoteReplay.swift

@@ -0,0 +1,23 @@
+public import Foundation
+import GhosttyKit
+
+extension TerminalSurface {
+    /// Enqueues replacement output and refreshes after the parser has applied it.
+    ///
+    /// A Cloud snapshot is a replacement state, so refreshing when its bytes
+    /// are merely admitted can present the previous IOSurface contents. The
+    /// completion runs after the generation FIFO has parsed the bytes.
+    @MainActor
+    public func processRemoteReplay(
+        _ data: Data,
+        onApplied: @escaping @MainActor @Sendable () -> Void
+    ) {
+        guard !data.isEmpty,
+              let surface = liveSurfaceForGhosttyAccess(reason: "remoteReplay") else {
+            processRemoteOutput(data)
+            return
+        }
+        flushPendingRemoteOutput(to: surface)
+        remoteOutputLane.enqueue(data, to: surface, onApplied: onApplied)
+    }
+}

Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurfaceRemoteOutputLane.swift

@@ -30,7 +30,11 @@ final class TerminalSurfaceRemoteOutputLane: @unchecked Sendable {
     }
 
     /// Enqueues one ordered output batch and its refresh signal.
-    func enqueue(_ data: Data, to surface: ghostty_surface_t) {
+    func enqueue(
+        _ data: Data,
+        to surface: ghostty_surface_t,
+        onApplied: (@MainActor @Sendable () -> Void)? = nil
+    ) {
         guard !data.isEmpty else { return }
         // Raw pointers are represented as bits across the Sendable queue
         // boundary; the lane fence owns the native lifetime until this work
@@ -51,6 +55,9 @@ final class TerminalSurfaceRemoteOutputLane: @unchecked Sendable {
                     ghostty_surface_process_output(surface, baseAddress, UInt(rawBuffer.count))
                 }
                 ghostty_surface_refresh(surface)
+                if let onApplied {
+                    Task { @MainActor in onApplied() }
+                }
             }
         }
     }

Sources/Cloud/CloudTuiManualMirrorSession.swift

@@ -23,7 +23,6 @@ final class CloudTuiManualMirrorSession {
     private(set) var remoteSurfaceID: UInt64
     let inputRouter: CloudTuiManualIOInputRouter
     let imagePaste = CloudImagePasteCoordinator()
-
     private let operations: CloudOperationRecorder?
     private var diagnosticContext: CloudOperationContext?
     private var creationAttachment: CloudCreationAttachment?
@@ -50,6 +49,9 @@ final class CloudTuiManualMirrorSession {
     private var attachResponseReceived = false
     private var claimInFlight = false
     private var geometryClaimed = false
+    private var geometryClaimBlockedByPeer = false
+    private var explicitGeometryClaimPending = false
+    private var geometryClaimLossPending = false
     private var geometryClaimEligible: Bool
     /// Older daemons do not know `set-client-sizing`. In that case the
     /// recorded `resize-surface` report is still useful, so the scheduler can
@@ -58,7 +60,6 @@ final class CloudTuiManualMirrorSession {
     /// Retained for diagnostics and for a future targeted detach. Closing the
     /// socket is still the cleanup fence for peers without lease support.
     private var remoteLease: String?
-    private var replayNeedsReset = false
     /// The last sidecar fed to the local surface; the next one is applied as a delta from it.
     private var appliedRemoteColors = CloudTuiRemoteColors()
     private var hasReceivedRemoteReplay = false
@@ -240,8 +241,8 @@ final class CloudTuiManualMirrorSession {
                     )
                 }
             }
-            geometryClaimed = false
-            geometryClaimEligible = false
+            (geometryClaimed, geometryClaimBlockedByPeer, geometryClaimLossPending) = (false, false, false)
+            explicitGeometryClaimPending = false
             claimUnsupported = false
             claimInFlight = false
             discardPendingSizingRequests()
@@ -286,9 +287,6 @@ final class CloudTuiManualMirrorSession {
     /// a reset screen.
     private func tearDownConnection() {
         watchdog.cancel()
-        if hasReceivedRemoteReplay {
-            replayNeedsReset = true
-        }
         connectTask?.cancel()
         connectTask = nil
         eventTask?.cancel()
@@ -300,7 +298,8 @@ final class CloudTuiManualMirrorSession {
         pendingRequests.removeAll(keepingCapacity: true)
         attachResponseReceived = false
         claimInFlight = false
-        geometryClaimed = false
+        (geometryClaimed, geometryClaimBlockedByPeer, geometryClaimLossPending) = (false, false, false)
+        explicitGeometryClaimPending = false
         claimUnsupported = false
         remoteLease = nil
         serverCapabilities.removeAll(keepingCapacity: true)
@@ -426,10 +425,7 @@ final class CloudTuiManualMirrorSession {
     /// is also used by the composed explicit-input callback.
     func claimGeometry() {
         guard surface?.isRendererPortalVisible == true else { return }
-        geometryClaimEligible = true
-        // Another local projection may have claimed the shared terminal since
-        // our last report. Treat an explicit focus/input edge as a fresh claim
-        // opportunity instead of trusting the stale local flag.
+        (geometryClaimEligible, geometryClaimBlockedByPeer, explicitGeometryClaimPending, geometryClaimLossPending) = (true, false, true, false)
         geometryClaimed = false
         claimUnsupported = false
         sendClaimIfNeeded()
@@ -569,15 +565,17 @@ final class CloudTuiManualMirrorSession {
                 inputRouter.updateSurfaceID(surfaceID)
             }
             guard surfaceID == remoteSurfaceID else { return }
-            applyReplay(bytes, reset: replayNeedsReset)
-            applyColors(colors)
-            replayNeedsReset = false
+            // A snapshot replaces the local VT state. Reset first so cells,
+            // cursor state, alternate-screen mode, and SGR from a prior
+            // restore cannot survive where the replacement is shorter.
+            applyReplay(bytes, colors: colors)
             hasReceivedRemoteReplay = true
             diagnosticReplayReceived = true
             if phase == .attached { finishDiagnostics() }
             updatePresentationEpisode()
             synchronizePresentation()
             lastRemoteGrid = CloudTuiManualIOGrid(columns: columns, rows: rows)
+            if geometryClaimLossPending { geometryClaimLossPending = false; geometryClaimBlockedByPeer = !explicitGeometryClaimPending && lastRemoteGrid != resizeScheduler.desired; geometryClaimed = geometryClaimed && !geometryClaimBlockedByPeer }
             reconcileRemoteGrid()
         case let .output(surfaceID, bytes, colors):
             guard surfaceID == remoteSurfaceID else { return }
@@ -588,14 +586,14 @@ final class CloudTuiManualMirrorSession {
             // `resized` carries a replacement replay, not an incremental
             // output chunk. Resetting first prevents old rows/cursor state from
             // surviving a shrink or a reconnect.
-            applyReplay(bytes, reset: true)
-            applyColors(colors)
+            applyReplay(bytes, colors: colors)
             hasReceivedRemoteReplay = true
             diagnosticReplayReceived = true
             if phase == .attached { finishDiagnostics() }
             updatePresentationEpisode()
             synchronizePresentation()
             lastRemoteGrid = CloudTuiManualIOGrid(columns: columns, rows: rows)
+            if geometryClaimLossPending { geometryClaimLossPending = false; geometryClaimBlockedByPeer = !explicitGeometryClaimPending && lastRemoteGrid != resizeScheduler.desired; geometryClaimed = geometryClaimed && !geometryClaimBlockedByPeer }
             reconcileRemoteGrid()
         case let .colorsChanged(surfaceID, colors):
             guard surfaceID == remoteSurfaceID else { return }
@@ -623,16 +621,19 @@ final class CloudTuiManualMirrorSession {
             break
         }
     }
-
-    private func applyReplay(_ bytes: Data, reset: Bool) {
-        if reset {
-            // Drop every remote color before the reset rather than trusting
-            // RIS to do it: the replay's own sidecar re-applies the authored
-            // set in full, so the pane ends in the same state either way.
-            applyColors(CloudTuiRemoteColors())
-            surface?.processRemoteOutput(Self.replayReset)
+    private func applyReplay(_ bytes: Data, colors: CloudTuiRemoteColors?) {
+        // A sidecar replaces authored colors; an absent sidecar preserves them.
+        // Restore the authoritative set after resetting the replacement VT state.
+        let replayColors = colors ?? appliedRemoteColors
+        var replay = CloudTuiRemoteColors().oscDelta(from: appliedRemoteColors)
+        replay.append(Self.replayReset)
+        replay.append(bytes)
+        replay.append(replayColors.oscBytes)
+        appliedRemoteColors = replayColors
+        guard let surface else { return }
+        surface.processRemoteReplay(replay) { [weak surface] in
+            surface?.forceRefresh(reason: "cloud.replay.applied")
         }
-        surface?.processRemoteOutput(bytes)
     }
 
     /// The replay is theme-portable: it carries no palette or default-color
@@ -829,15 +830,12 @@ final class CloudTuiManualMirrorSession {
                 transitionToDisconnected(reason: .rejected("attachment superseded"))
                 return
             }
-            if outcome == "passive" {
-                // Another view owns this terminal's geometry. Keep the local
-                // sample, but make the explicit claim the next operation so a
-                // focused pane can take authority back deterministically.
-                geometryClaimed = false
+            if outcome == "passive" || (accepted == false && geometryClaimed && lastRemoteGrid != nil && lastRemoteGrid != requestedGrid) {
+                (geometryClaimed, geometryClaimBlockedByPeer, geometryClaimLossPending) = (false, !explicitGeometryClaimPending, false)
                 claimUnsupported = false
+            } else if accepted == false && geometryClaimed && lastRemoteGrid == nil {
+                geometryClaimLossPending = true
             }
-            // A report is useful even when it was passive. Hold the newest
-            // sample while the explicit geometry claim is in flight.
             let next = resizeScheduler.acknowledge(
                 requestedGrid,
                 canSend: geometryClaimed || claimUnsupported
@@ -853,6 +851,7 @@ final class CloudTuiManualMirrorSession {
             claimInFlight = false
             if ok, surface?.isRendererPortalVisible == true {
                 geometryClaimed = true
+                explicitGeometryClaimPending = false
                 claimUnsupported = false
             } else if Self.isUnsupportedClaimError(error) {
                 // Keep compatibility with protocol-v5/v6 peers. Their
@@ -971,10 +970,11 @@ final class CloudTuiManualMirrorSession {
               surface?.isRendererPortalVisible == true,
               surface?.isNativeViewInRealWindow == true,
               geometryClaimEligible,
+              !geometryClaimBlockedByPeer,
               !geometryClaimed,
               !claimUnsupported,
               !claimInFlight,
-              resizeScheduler.inFlight != nil || resizeScheduler.lastAcknowledged != nil,
+              resizeScheduler.lastAcknowledged != nil,
               let connection else { return }
         manualMirrorLogger.info("geometry terminal=\(self.terminalID, privacy: .private(mask: .hash)) decision=claim")
         claimInFlight = true

Sources/Workspace.swift

@@ -639,11 +639,6 @@ extension Workspace {
                     )
                 }
                 guard let effectiveRestorableAgent else { return nil }
-                let confirmedRuntimeProcessIdentities = confirmedRuntimeAgentProcessIdentities(
-                    for: effectiveRestorableAgent,
-                    panelId: panelId,
-                    currentProcessIdentity: currentAgentProcessIdentity
-                )
                 let matchingObservation = restorableAgentObservation?.matchingAgentSession(
                     kind: effectiveRestorableAgent.kind.rawValue,
                     sessionId: effectiveRestorableAgent.sessionId
@@ -655,6 +650,11 @@ extension Workspace {
                 ) {
                     return true
                 }
+                let confirmedRuntimeProcessIdentities = confirmedRuntimeAgentProcessIdentities(
+                    for: effectiveRestorableAgent,
+                    panelId: panelId,
+                    currentProcessIdentity: currentAgentProcessIdentity
+                )
                 guard let matchingObservation else { return false }
                 if let resumeBinding {
                     return matchingObservation.wasRunningForSnapshot(