Repository navigation

Consolidate SSH security, shim hardening, and restored terminal replay fixes - #15116

Merged

austinywang merged 164 commits into

mainfrom

ssh-private-control-path

Sep 29, 2026

Commits on Sep 25, 2026
Commits on Sep 26, 2026
- Merge remote-tracking branch 'origin/main' into issue-7028-per-pane-path-shim
  austinywang
  committed
  e2dbbd0
Commits on Sep 28, 2026
- cmux ssh: test that the shared control socket stays out of /tmp
  
  austinywang
  and
  claude
  committed
  1590a46
- cmux ssh: keep the shared control socket in a private directory
  
  austinywang
  and
  claude
  committed
  08567b6
- Test that the VM daemon forward listens on a private Unix socket
  
  austinywang
  and
  claude
  committed
  5e9b83b
- cmux ssh: test that the browser proxy requires its credential
  
  austinywang
  and
  claude
  committed
  409a6bc
- Test that terminal clipboard reads ask and take plain text only
  
  austinywang
  and
  claude
  committed
  41978d7
- Forward the VM daemon to a private per-user Unix socket
  
  austinywang
  and
  claude
  committed
  a6bb4b8
- cmux ssh: require a per-tunnel credential on the browser proxy
  
  austinywang
  and
  claude
  committed
  645d033
- Ask before a terminal reads the clipboard and share plain text only
  
  austinywang
  and
  claude
  committed
  aef9ab3
- cmux ssh: test that the relay withholds resume bindings, reply fields and remote status details
  
  austinywang
  and
  claude
  committed
  cee4bef
- ssh: test that background ssh argv ends option parsing and drops forwarding
  
  austinywang
  and
  claude
  committed
  97e1a9a
- local sockets: test that clients refuse peers and files owned by another user
  
  austinywang
  and
  claude
  committed
  8eda61a
- Test remote link and notification guards before the fix
  
  austinywang
  and
  claude
  committed
  99a24db
- ssh: pass destinations as operands and drop forwarding on background runs
  
  austinywang
  and
  claude
  committed
  0e87e0b
- Check the local socket's owner before sending commands or credentials
  
  austinywang
  and
  claude
  committed
  91866a1
- cmux ssh: keep resume bindings, reply fields and local status off the relay
  
  austinywang
  and
  claude
  committed
  459905c
- Keep remote-initiated opens off this Mac's loopback and local network
  
  austinywang
  and
  claude
  committed
  70da666
- Test that socket discovery and remote forwarding stay on this user's socket
  
  austinywang
  and
  claude
  committed
  beb4c14
- Keep socket discovery and remote forwarding on this user's socket
  
  austinywang
  and
  claude
  committed
  6ce2e23
- Add failing tests for PR watcher state and auth debug log in /tmp
  
  austinywang
  and
  claude
  committed
  9384bde
- Keep PR watcher state and debug logs out of shared /tmp names
  
  austinywang
  and
  claude
  committed
  20e8a9c
- cmux ssh: share the foreground-auth readiness script lines
  
  austinywang
  and
  claude
  committed
  0de539c
- cmux ssh: test that the foreground-auth token stays out of argv
  
  austinywang
  and
  claude
  committed
  c038a46
- cmux-tui: test that background ssh runs end options before the destination
  
  austinywang
  and
  claude
  committed
  7a166ce
- cmux ssh: test that a refused browser proxy never asks for a password
  
  austinywang
  and
  claude
  committed
  0fd0b21
- cmux ssh: never ask for a password when the browser proxy refuses
  
  austinywang
  and
  claude
  committed
  f39305d
- cmuxd-remote: test that the CLI bridge fallback ignores other users' sockets
  
  austinywang
  and
  claude
  committed
  52dff71
- cmuxd-remote: use the CLI bridge fallback socket only when this user owns it
  
  austinywang
  and
  claude
  committed
  0fb7bfa
- cmuxd-remote: test that the Claude settings cache refuses a symlinked directory
  
  austinywang
  and
  claude
  committed
  17dc052
- cmux ssh: keep the foreground-auth token out of process arguments
  
  austinywang
  and
  claude
  committed
  2ba26df
- cmux-tui: end background ssh options before the destination
  
  austinywang
  and
  claude
  committed
  bc6fe30
- cmuxd-remote: keep Claude settings in a directory this user owns
  
  austinywang
  and
  claude
  committed
  219392a
- shell integration: test that shims and bash state stay in private directories
  
  austinywang
  and
  claude
  committed
  5495274
- shell integration: keep claude shims and bash state in private directories
  
  austinywang
  and
  claude
  committed
  51add4c
- cmux wait-for: test that signal files stay in a private directory
  
  austinywang
  and
  claude
  committed
  ac1c600
- cmux wait-for: keep signal files in a private per-user directory
  
  austinywang
  and
  claude
  committed
  9e5b2c5
- debug logs: test that /tmp log files stay private to this user
  
  austinywang
  and
  claude
  committed
  7556730
- debug logs: open /tmp log files without following links
  
  austinywang
  and
  claude
  committed
  af07660
- cmux wait-for: normalize the project entries for the signal owner
  
  austinywang
  and
  claude
  committed
  d780d95
- Keep remote terminal file links off this Mac's filesystem (#15162)
  
  austinywang
  and
  claude
  authored
  dae8774
- test: reproduce Codex composer replay row loss
  austinywang
  committed
  a19ad6c
- fix: keep Cloud VT replay rows anchored
  austinywang
  committed
  7d4b9db
- test: cover Codex replay cells and redraw
  austinywang
  committed
  830eae1
- fix: update Ghostty replay formatter
  austinywang
  committed
  802da7f
- docs: describe Cloud replay cell preservation
  austinywang
  committed
  bff5b33
- build: pin GhosttyKit replay fix
  austinywang
  committed
  8c3b4e7
- test: assert complete replay frame shapes
  austinywang
  committed
  227b261
- Merge main (ce5cb45d55d9) into remote-relay-narrowing
  austinywang
  committed
  f206129
- Merge main (ce5cb45d55d9) into remote-url-open-guard
  austinywang
  committed
  462a522
- Merge main (ce5cb45d55d9) into remote-cli-bridge-owner-check
  austinywang
  committed
  b76b32b
- Merge main (ce5cb45d55d9) into ssh-private-control-path
  austinywang
  committed
  f765de7
- Merge main (ce5cb45d55d9) into ssh-browser-proxy-auth
  austinywang
  committed
  47aae20
- Merge main (ce5cb45d55d9) into ssh-argument-hardening
  austinywang
  committed
  6c45821
- Merge main (ce5cb45d55d9) into ssh-auth-token-off-argv
  austinywang
  committed
  4823e3d
- Merge main (ce5cb45d55d9) into socket-discovery-owner-checks
  austinywang
  committed
  3ccc32b
- Merge main ce5cb45d55d into terminal-clipboard-read-guard
  
  austinywang
  and
  claude
  committed
  2a2e771
- Merge main (ce5cb45d55d9) into private-shell-state-dirs
  
  austinywang
  and
  claude
  committed
  9e9e32a
- cmux ssh: bind the credentialed proxy configurations with let
  
  austinywang
  and
  claude
  committed
  89cef27
- cmux ssh: import Foundation where the spawn policy protocol names UUID
  
  austinywang
  and
  claude
  committed
  ce8dd17
- cmux ssh: resolve the reauth test's socket inside the private directory
  
  austinywang
  and
  claude
  committed
  ed1a24d
- Merge main (ce5cb45d55d9) into local-socket-peer-checks
  austinywang
  committed
  3785cdf
- ssh: replace the static shell-word helpers with String and value types
  
  austinywang
  and
  claude
  committed
  dd5e734
- Expect a projected tmux pane's path to stay off this Mac
  
  austinywang
  and
  claude
  committed
  2fda0cb
- socket: make the remote local-socket resolver an instantiated value
  
  austinywang
  and
  claude
  committed
  cae5f92
- Merge branch 'main' of https://github.com/manaflow-ai/cmux into 15109-cloud-codex-restore-regression
  austinywang
  committed
  53cdbbe
- debug logs: make OwnedLogFile a value with its path and owner
  
  austinywang
  and
  claude
  committed
  9e39482
- cmux wait-for: wait on the watcher being armed instead of sleeping
  
  austinywang
  and
  claude
  committed
  9d58d1d
- Keep the foreign-socket tests from dying on SIGPIPE
  
  austinywang
  and
  claude
  committed
  8f0724d
- ssh: expect -- before the destination in ControlMaster cleanup tests
  
  austinywang
  and
  claude
  committed
  60c7335
- cmux ssh: test that a replay parsed at a hidden grid is refetched
  
  austinywang
  and
  claude
  committed
  870b249
- cmux ssh: load a copied test CLI's frameworks from its source app
  
  austinywang
  and
  claude
  committed
  b9fcbb2
- Merge main (f7ee3bc64db5) into remote-relay-narrowing
  
  austinywang
  and
  claude
  committed
  7f7004b
- cmux ssh: refetch a replay the hidden pane parsed at the wrong grid
  
  austinywang
  and
  claude
  committed
  7749205
- Merge main (69c05744af41) into cmux-ssh-replay-garble
  austinywang
  committed
  8cbd478
- remote tests: set SO_NOSIGPIPE on the fake socket listeners
  
  austinywang
  and
  claude
  committed
  7792b9a
- Merge main (69c05744af4) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  8548794
- Merge local-socket-peer-checks (#15142) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  f0c8b66
- Merge socket-discovery-owner-checks (#15151) into ssh-private-control-path
  austinywang
  committed
  c307a9a
- Merge remote-cli-bridge-owner-check (#15168) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  b70288f
- Merge private-shell-state-dirs (#15179) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  70e8169
- Merge tmp-debug-file-hardening (#15158) into ssh-private-control-path
  austinywang
  committed
  4ff609a
- Merge cloud-daemon-private-forward (#15128) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  98e0cda
- Merge ssh-browser-proxy-auth (#15132) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  44ab7fd
- Merge terminal-clipboard-read-guard (#15136) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  521a9ad
- Merge remote-relay-narrowing (#15145) into ssh-private-control-path
  austinywang
  committed
  bb85cac
- Merge ssh-argument-hardening (#15147) into ssh-private-control-path
  austinywang
  committed
  0620dec
- Merge remote-url-open-guard (#15148) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  56e5b9c
- Merge ssh-auth-token-off-argv (#15169) into ssh-private-control-path
  austinywang
  committed
  ab4b8e3
- Merge cmux-tui-ssh-argument-hardening (#15172) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  4610fb6
- Merge cmux-ssh-replay-garble (#15454) into ssh-private-control-path
  
  austinywang
  and
  claude
  committed
  c05fbf2
- cmuxd-remote: test that the CLI client refuses a socket another user serves
  
  austinywang
  and
  claude
  committed
  a4a5ae7
- cmuxd-remote: check the bridge socket's owner before sending CLI requests
  
  austinywang
  and
  claude
  committed
  6fb972e
- cmux ssh: expect one shared control path for workspaces on the same host
  
  austinywang
  and
  claude
  committed
  fc3364c
- CmuxFoundation: test that the append opener narrows an existing log to 0600
  
  austinywang
  and
  claude
  committed
  84bb953
- CmuxFoundation: narrow an existing log to the opener's creation mode
  
  austinywang
  and
  claude
  committed
  06d362a
- Keep debug-log replacements private before writing their contents
  austinywang
  committed
  4e0aca6
- Merge main (3da1b53bf558) into ssh-security-all
  austinywang
  committed
  4e0ccc9
- Merge bridge peer-credential review fix into consolidated SSH hardening
  austinywang
  committed
  85619f1
- Test SSH forwarding flags and caller-supplied option separators
  austinywang
  committed
  77ee6b2
- Keep background SSH forwarding disabled and preserve one option separator
  austinywang
  committed
  80387b3
- Update combined SSH forwarding tests for private Unix sockets
  austinywang
  committed
  656d7b1
- Test remote initiated URL opens fail closed
  austinywang
  committed
  2cf9e8f
- Fail closed on remote initiated URL opens
  austinywang
  committed
  44cf8b4
- Test remote initiated links stop before routing
  austinywang
  committed
  5dbdd0a
- Reject remote initiated links before local routing
  austinywang
  committed
  802a26a
- Test replay fidelity across resize before parse completion
  
  austinywang
  and
  claude
  committed
  39a4a1b
- Use the linted SSH argument-value guard
  austinywang
  committed
  7c6ece0
- Preserve replay fidelity across asynchronous runtime changes
  
  austinywang
  and
  claude
  committed
  8b4802e
- test: cover writable shim ancestry and roots
  austinywang
  committed
  fdc88d3
- Close replay checks around parser and image paste
  
  austinywang
  and
  claude
  committed
  26c7362
- Report discarded buffered replays
  
  austinywang
  and
  claude
  committed
  d2981f0
- Test replay remains faithful across unchanged grid reports
  austinywang
  committed
  b5d370d
- Preserve replay fidelity across pixel-only layout reports
  austinywang
  committed
  5ea4fb8
- Test startup shim ancestry and Claude-disabled agent routing
  austinywang
  committed
  6eb6c42
- Validate shim ancestry before login-shell and Nushell PATH routing
  austinywang
  committed
  952c593
Commits on Sep 29, 2026
- Reject writable shim ancestors and insecure inherited roots
  austinywang
  committed
  a2952fc
- Merge durable per-pane shim paths into consolidated SSH hardening
  austinywang
  committed
  bb09804
- Merge Codex replay formatter correction into consolidated restore fixes
  austinywang
  committed
  b16bc28
- Adapt shim tests to durable per-user roots
  austinywang
  committed
  bf2a5f5
- Keep Zsh PR watcher state off unsafe temp ancestors
  austinywang
  committed
  9e6f962
- Merge main (926e2f59a63d) into ssh-security-all
  austinywang
  committed
  21f2316
- Format hardened SSH argument parsing
  austinywang
  committed
  5132eb6
- Merge main (d938f969d244) into ssh-security-all
  austinywang
  committed
  2d6a06a
- Merge main (3a52f0459c58) into ssh-security-all
  austinywang
  committed
  67b0300
- Update shell shim regressions for durable per-user roots
  austinywang
  committed
  0ea0857
- Merge latest main and resolve generated project conflicts
  austinywang
  committed
  ae0ab1d
- Precreate durable shim state in shell regression fixtures
  austinywang
  committed
  b22d156
- Allow remote daemon timeout-isolation events to arrive under CI load
  austinywang
  committed
  89dd6d1
- Merge latest main and resolve localization conflict
  austinywang
  committed
  393b97e
- Make remote mirror observability fixtures admit their split space
  austinywang
  committed
  5e525bd
- Merge latest main and resolve localization catalog conflict
  austinywang
  committed
  64981c4
- Redact peer UID from daemon socket errors
  austinywang
  committed
  13d3e5d
- Avoid sharing SSH masters across route-specific configurations
  austinywang
  committed
  8c02d1b
- Close SSH route collision and remote clipboard gaps
  austinywang
  committed
  636dfee
- test: cover log and terminal-link security boundaries
  austinywang
  committed
  ee455ad
- fix: close local log and terminal-link trust gaps
  austinywang
  committed
  2d1f66c
- Merge remote-tracking branch 'origin/main' into ssh-security-all
  austinywang
  committed
  7d57e0f
- test: use the pinned Ghostty URL kinds
  austinywang
  committed
  11019a4
- Merge remote-tracking branch 'origin/main' into ssh-security-all
  austinywang
  committed
  5f8deff
- Harden remote clipboard trust and stabilize CI tests
  austinywang
  committed
  1e5e648
- Merge remote-tracking branch 'origin/ssh-private-control-path' into ssh-security-all
  austinywang
  committed
  28245a9
- Mark remote split terminals as untrusted
  austinywang
  committed
  228b2a5
- Separate SSH masters by host-key policy
  austinywang
  committed
  98da94b
- Preserve SSH route isolation and remote terminal trust
  austinywang
  committed
  3f99998
- Preserve remote trust on dock session restore
  austinywang
  committed
  44c1028
- Merge remote-tracking branch 'origin/main' into ssh-security-all
  austinywang
  committed
  a25a21f
- Mark cloud VM attach terminals as remote
  austinywang
  committed
  3fcb2b8
- Fix initial remote terminal argument order
  austinywang
  committed
  7acffe3
- fix: resolve remaining review blockers
  austinywang
  committed
  27a0ca9
- fix: pass remote terminal state through surface wiring
  austinywang
  committed
  ce9a66f
- Thread remote trust through app surface wiring
  austinywang
  committed
  215a756
- Merge remote-tracking branch 'origin/ssh-private-control-path' into ssh-security-all
  austinywang
  committed
  faa42e1
- fix: remove duplicate remote terminal parameter
  austinywang
  committed
  75f343d
- Merge remote-tracking branch 'origin/main' into ssh-security-all
  austinywang
  committed
  18f7451
- Merge remote-tracking branch 'origin/ssh-private-control-path' into ssh-security-all
  austinywang
  committed
  b9e418a

Commits

Commits on Sep 25, 2026

Commits on Sep 26, 2026

Commits on Sep 28, 2026

Commits on Sep 29, 2026