Stop WindowAccessor storing a deallocating window

[teamleaderleo]

App-host shards on main abort with:

objc[97896]: Cannot form weak reference to instance (0x...) of class NSKVONotifying__TtCC9cmuxTests24WindowDragHandleHitTests...RecordingTitlebarActionWindow. It is possible that this object was over-released, or is in the process of deallocation.
*** Program crashed: Aborted

Symbolicated against the run's own product (run 36295033926, shard 5), the abort comes from a SwiftUI update:

NSViewRepresentable.updateNSView → WindowAccessor.updateNSView → the installWindowHandler closure → WindowAccessor.Coordinator.shouldInvoke → weak store → abort

updateNSView reads nsView.window. NSView.window does not retain, so during a SwiftUI update it can return a window that is already deallocating. The coordinator then stores it in weak var lastWindow, and the objc runtime aborts. The window here is a test window that a different test dropped, which is why the crash shows up in unrelated tests. An app window whose last owner lets go during an update hits the same path.

WindowObservingView now keeps the window it gets in viewDidMoveToWindow, where AppKit hands over a live one, in its own weak property, and updateNSView reads that. While the view is attached it is the same window as before. A deallocating window reads nil, so nothing is stored and no handler runs.

This is the pattern #14925 used for the titlebar accessory (TitlebarControlsAccessoryViewController.updateObservedWindowIfNeeded), which caused shard 4 of the same run. It is already on main.

Verification

• Stack symbolicated with atos against cmux DEV.debug.dylib from that run's app-host-layer-app-cli artifact; the dylib UUID matches the crash.
• No local build on this Mac. This PR's CI app-host shards exercise WindowAccessor through every window SwiftUI hosts.
• There's no focused regression test: the abort needs AppKit to deallocate a window in the middle of a SwiftUI update, which can't be triggered on demand.

Other weak var ...: NSWindow? sites are safe as long as they take the window from viewDidMoveToWindow. If the abort shows up again after this merges, symbolicating that stack will show which site it came from.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Stops WindowAccessor from aborting when SwiftUI updates the view while its window is deallocating, which was crashing app-host shards with "Cannot form weak reference".

WindowAccessor now reads the window from a new weak property on WindowObservingView, set in viewDidMoveToWindow, instead of nsView.window during updateNSView. A deallocating window reads nil, so the coordinator never stores it and the handler doesn't run.

^{Written for commit 3be1bbc. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ce5e9877-bed3-4873-93f2-1ee5a3bf6475

📥 Commits

Reviewing files that changed from the base of the PR and between 75caaa5 and 3be1bbc.

📒 Files selected for processing (1)

• Sources/WindowAccessor.swift

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Merge receipt for 3be1bbcc68: every check was green at merge (16 verified; 14 skipped by policy). Full suite runs on main after merge.