Keep socket discovery and remote forwarding on this user's socket

[austinywang]

Stacked on #15142. It's based on local-socket-peer-checks, so review and merge that first. This PR closes two socket paths #15142 left open.

Summary

Socket discovery. To find the app, the CLI probes candidate control sockets, and some of them sit at fixed names in the shared /tmp directory. Before this change the probe checked who owned the socket file, then accepted any listener that took the connection. It now also reads the listener's user with #15142's UnixSocketPeerCheck after the connect finishes. A socket another user is listening on fails the probe, so discovery moves on to the next candidate. The probe moved out of CLISocketPathResolver into CmuxFoundation as UnixSocketConnectProbe so it can be tested. The existing lstat owner check on the socket file stays where it was. All CLISocketPathResolver discovery goes through this one probe.

Remote forwarding target. workspace.remote.configure takes a local_socket_path parameter. The app stored whatever the client sent, and a remote workspace's CLI relay and cloud CLI bridge then forwarded remote commands to that path. The app now stores its own control socket path (currentSocketPathForRemoteRestore()) and ignores the value the client sends. A non-blank local_socket_path still turns forwarding on, and a missing or blank one leaves it off. The CLI already sends the socket it connected through, which is this app's socket, so normal cmux ssh and cloud flows behave the same. One small side effect: a blank value used to be stored as an empty string, which the fork-conversation menu treated as a reachable socket. It's now stored as nil.

Relay policy. No change. workspace.remote.configure isn't in RemoteRelayRoutingSchema, so RemoteRelayCommandPolicy already refuses it when it comes through the remote relay. Only local socket clients can call it, and they now can't choose where forwarded commands go.

Testing

Regression tests were committed first, in beb4c14, and failed there. The fix is 6ce2e23.

Command	beb4c14 (tests only)	6ce2e23 (fix)
swift test --disable-index-store --package-path Packages/macOS/CmuxFoundation --filter UnixSocketConnectProbeTests	3 tests, 1 failed: refusesAListenerRunningAsAnotherUser	3 tests passed
swift test --disable-index-store --package-path Packages/macOS/CmuxControlSocket --filter ControlWorkspaceRemoteLocalSocketPathTests	3 tests (9 cases) failed, 8 issues	3 tests (9 cases) passed

The probe test simulates another user by expecting a user ID other than the current one; there was no second local account to run a real listener. python3 scripts/verify-local.py --affected origin/main --swift-changed origin/main passed Swift syntax, package groups and feature flags.

Not verified: the cmux-cli and app targets and cmuxTests weren't compiled or run locally. That covers the one-line CLISocketPathResolver change and the TerminalController+ControlWorkspaceContext call site. There was no dogfood in a tagged build, so cmux ssh and cloud CLI forwarding weren't checked live.

Follow-up not included. Moving tagged and debug sockets from /tmp into a per-user directory. That touches socket path resolution in the app, CLI, scripts, docs and tests, which makes it too big to add here safely. With #15142 and this PR, the app and CLI refuse a socket another user holds at one of those names, so what's left is that user blocking the name, not intercepting commands.

Changelog

Fixed: The CLI skips control sockets another user is listening on, and remote workspaces always forward commands to the app's own socket

Checklist

• Behavior changes have added or updated tests, or Testing says why not
• No UI, settings, menu, schema, help-text or user-facing docs change
• No v2 socket method allowlisted for cmux ssh
• Reviewed with a subagent before merge (cmux-review), and all bot and human review comments resolved

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Closes two socket paths left open: the CLI now checks the listener's user when probing candidate control sockets, and remote workspaces forward commands to the app's own socket instead of the path the client sends.

Socket discovery

• The probe moved from CLISocketPathResolver into UnixSocketConnectProbe in CmuxFoundation and now checks the listener's user with UnixSocketPeerCheck after connecting.
• A socket another user is listening on fails the probe, so discovery moves to the next candidate; the existing lstat file-owner check stays.

Remote forwarding target

• workspace.remote.configure stores currentSocketPathForRemoteRestore() and ignores the client's local_socket_path value, which only turns forwarding on or off.
• A blank value now stores nil instead of an empty string, so the fork-conversation menu no longer treats it as a reachable socket.

Regression tests were committed first and failed there; the fix commits followed. The remaining commits are merges from main and don't change these two behaviors.

^{Written for commit 7792b9a. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3fa2a1c8-9e84-412b-bc43-d23dd41ad881

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI failure attribution

CI failed on 6ce2e232a6 (run 36377920548 attempt 1): 1 unknown.

Job	Verdict	Why
guards / workflow-guard-tests / release-ios	unknown	no known signature; failed step: Validate iOS package conventions for this change

Not re-run automatically: guards / workflow-guard-tests / release-ios is not a machine failure.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

Dogfood tours of cae5f924

sidebar-and-chrome-tour at cae5f924: not run

skipped: CI built this head on a runner pool whose products the UI test Macs cannot load, and media never compiles one; gh workflow run pr-media.yml -f pr=<n> -f allow_compile=true does

agent-activity-reorder at cae5f924: not run

skipped: CI built this head on a runner pool whose products the UI test Macs cannot load, and media never compiles one; gh workflow run pr-media.yml -f pr=<n> -f allow_compile=true does

_{Tours are picked by the paths globs in dogfood/scenarios/*.json; a Dogfood-tours: a, b line in the description picks them instead (none turns this off). Look at every frame before merging: a green tour only means no step failed.}

[austinywang]

Closing as superseded by merged PR #15116, which consolidated this SSH/security/local-state hardening into main.