test: give the bundled-CLI product tests their own host-free target and CI lane

.github/workflows/ci-guards.yml

@@ -782,6 +782,7 @@ jobs:
           python3 tests/test_e2e_warm_derived_data.py
           python3 tests/test_seed_derived_data.py
           python3 tests/test_ci_product_publication.py
+          python3 tests/test_ci_cli_product_routing.py
 
       - name: Validate Python R2 appcast upload guard
         if: ${{ matrix.group == 'release-tooling' }}

.github/workflows/ci.yml

@@ -1025,7 +1025,7 @@ jobs:
       - browser
       - guards
       - web
-    if: ${{ !cancelled() && github.event_name == 'pull_request' && needs.changes.result == 'success' && needs.static-preflight.result == 'success' && needs.changes.outputs.macos != 'false' && (needs.changes.outputs.full_suite == 'true' || needs.changes.outputs.compile_admitted != 'true') }}
+    if: ${{ !cancelled() && github.event_name == 'pull_request' && needs.changes.result == 'success' && needs.static-preflight.result == 'success' && (needs.changes.outputs.macos != 'false' || needs.changes.outputs.cli == 'true') && (needs.changes.outputs.full_suite == 'true' || needs.changes.outputs.cli == 'true' || needs.changes.outputs.compile_admitted != 'true') }}
     runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
     timeout-minutes: 5
     permissions: {}
@@ -1060,9 +1060,8 @@ jobs:
     # Packages/ still needs the package-test lane, which is not part of compile
     # admission and would otherwise be skipped whenever the app-host product is
     # already admitted or the macOS area is neutral (a Packages/iOS package
-    # outside the desktop closure). Every other job in the called workflow stays
-    # gated on inputs.macos, so nothing else wakes up with it.
-    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.static-preflight.result == 'success' && (needs.macos-admission-gate.result == 'success' || needs.macos-admission-gate.result == 'skipped') && ((needs.changes.outputs.macos != 'false' && (needs.changes.outputs.full_suite == 'true' || needs.changes.outputs.unit_suite == 'true' || needs.changes.outputs.compile_admitted != 'true')) || needs.changes.outputs.swift_packages == 'true') }}
+    # outside the desktop closure). Other jobs retain their macos/cli gates.
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.static-preflight.result == 'success' && (needs.macos-admission-gate.result == 'success' || needs.macos-admission-gate.result == 'skipped') && (((needs.changes.outputs.macos != 'false' || needs.changes.outputs.cli == 'true') && (needs.changes.outputs.full_suite == 'true' || needs.changes.outputs.unit_suite == 'true' || needs.changes.outputs.cli == 'true' || needs.changes.outputs.compile_admitted != 'true')) || needs.changes.outputs.swift_packages == 'true') }}
     permissions:
       actions: read
       id-token: write
@@ -1072,6 +1071,7 @@ jobs:
     uses: ./.github/workflows/ci-macos.yml
     with:
       macos: ${{ needs.changes.outputs.macos }}
+      cli: ${{ needs.changes.outputs.cli }}
       full_suite: ${{ needs.changes.outputs.full_suite }}
       unit_suite: ${{ needs.changes.outputs.unit_suite }}
       unit_selectors: ${{ needs.changes.outputs.unit_selectors }}
@@ -1141,11 +1141,12 @@ jobs:
           # product and full_suite stayed false.
           unit_suite = outputs.get("unit_suite") == "true"
           macos_work_required = swift_packages or (
-              macos_route == "true"
-              and (
+              (
                   unit_suite
+                  or outputs.get("cli") == "true"
                   or not (full_suite == "false" and compile_admitted == "true")
               )
+              and (macos_route == "true" or outputs.get("cli") == "true")
           )
           if macos_work_required:
               if macos_result != "success":

Packages/macOS/CmuxSettings/Sources/CmuxSettings/Values/AgentNotifyCategory.swift

@@ -0,0 +1,18 @@
+/// Category an agent hook attaches to a notification so the app can gate
+/// delivery by user config. Mirrors the CLI's `ClaudeNotifyCategory`; serialized
+/// into the `notify_target_async` payload's optional `c=<category>;p=<0|1>` meta.
+public enum AgentNotifyCategory: String, Sendable {
+    case turnComplete = "turn-complete"
+    case needsPermission = "needs-permission"
+    case idleReminder = "idle-reminder"
+    case other
+
+    public var soundAlertType: NotificationSoundAlertType? {
+        switch self {
+        case .turnComplete: return .turnDone
+        case .needsPermission, .idleReminder: return .needsInput
+        case .other: return nil
+        }
+    }
+}
+

Sources/AgentNotificationGate.swift

@@ -1,24 +1,6 @@
 import CmuxSettings
 import Foundation
 
-/// Category an agent hook attaches to a notification so the app can gate
-/// delivery by user config. Mirrors the CLI's `ClaudeNotifyCategory`; serialized
-/// into the `notify_target_async` payload's optional `c=<category>;p=<0|1>` meta.
-enum AgentNotifyCategory: String {
-    case turnComplete = "turn-complete"
-    case needsPermission = "needs-permission"
-    case idleReminder = "idle-reminder"
-    case other
-
-    var soundAlertType: NotificationSoundAlertType? {
-        switch self {
-        case .turnComplete: return .turnDone
-        case .needsPermission, .idleReminder: return .needsInput
-        case .other: return nil
-        }
-    }
-}
-
 /// User policy for the "Claude finished a turn" notification.
 enum AgentTurnCompleteMode: String {
     case whenIdle