Skip to content

Native acpmux chat pane for agent sessions (prototype) - #15521

Draft
lawrencecchen wants to merge 124 commits into
mainfrom
feat-acpmux-chat-pane
Draft

lawrencecchen wants to merge 124 commits into
mainfrom
feat-acpmux-chat-pane

Conversation

@lawrencecchen

@lawrencecchen lawrencecchen commented Sep 29, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Stacked on #15512 (bundles acpmux at Contents/Resources/bin/acpmux); merge that first.

Prototype. The agentSession panel now renders an acpmux session in a native AppKit chat pane instead of the WKWebView renderer. The pane talks JSON-RPC to the acpmux daemon over its Unix socket, starts the daemon when the socket does not answer, and streams the session into iMessage-style bubbles.

  • Packages/macOS/CmuxAcpmux: newline-framed JSON-RPC over the acpmux socket, a detached daemon launcher (posix_spawn with setsid, readiness from the daemon log, no polling), Codable wire types, a pure TranscriptReducer that folds acpmux event records into rows, and the @Observable session model (local echo, reconnect with afterSeq, history paging, queue, permissions).
  • Sources/Panels/AcpmuxChat: a virtualized NSTableView transcript with row heights cached by (row id, content version, width, group position, expansion), one diff per display frame through NSView.displayLink, bottom pinning with a "jump to latest" pill, scroll-anchored history paging, a send morph from the composer into the bubble, a typing indicator, collapsible tool activity, a permission card above the composer, queued prompts, and a session picker. Reduce Motion disables the animations.
  • Tagged DEV builds use a private daemon home under the tag's Application Support directory and never touch ~/.acpmux.
  • PanelType.agentSession and its snapshot keep their raw values; the snapshot adds the acpmux session id. cmux new-surface --type agent-session --provider claude opens the pane with that harness for new sessions.

The web renderer files stay in the target, unreferenced, for a later deletion commit.

Testing

Stacked on #15512; this branch merges its head d4bfdeb (SIGTERM shutdown, --ready-fd), and the bundled Contents/Resources/bin/acpmux comes from that head.

  • Builds: fleet tagged builds acpchat through the normal path (cmux-ci build cmux --ref <sha>). Last one: job 033e39b4, head 7ab8791.
  • Daemon launch: posix_spawn with an empty signal mask (POSIX_SPAWN_SETSIGMASK) and default dispositions (POSIX_SPAWN_SETSIGDEF), through sh -c 'set -m; "$@" &' so the shell does not set INT/QUIT to ignored. A spawned daemon shows BLOCKED 0 and ppid 1. Cause: Swift concurrency and dispatch worker threads run with most signals blocked, and the mask survives exec.
  • Live SIGTERM during a running Codex turn: the daemon (pid from its ready line) exited in 0.18 s, its node and codex children were gone, and the pane reconnected and started a new bundled daemon. An idle daemon exited in 0.11 s.
  • debug.window.record frame strips (60 fps, own window only), in artifacts/acpchat/round4/ of the worktree:
    • send morph: the flying bubble has its tail, and shape and color morph from the composer to the tailed bubble; sending bubbles are no longer dimmed, so the hand-off has no color pop;
    • send morph with a fast agent (test-only fake harness): the reply moves the slot mid-flight, and the morph now bends to the new slot instead of ending in two frames;
    • streaming growth: bubble and text grow in the same frame, with no frame that shows a line below the bubble;
    • permission card (fake harness, ask: prompt): slides in over about 4 frames above the composer.
  • Scroll: 5,000-row synthetic transcript (debug.agent_chat.action seed_rows), scripted 3 s fling from bottom to top, frame time from the view's display link at 120 Hz (nominal 8.33 ms). Seeding takes 0.9 s. First fling (cold cells): p50 8.33 ms, p95 28.7 ms, p99 33.3 ms, max 35.3 ms, 107 dropped frames. Later flings: p50 8.33, p95 8.33, p99 8.3 to 18.5 ms, max 17.5 to 22.7 ms, 3 to 14 dropped frames. Before this round a first fling had a 2.0 s stall (all rows measured at once); unmeasured rows now get a character-count estimate and are measured in a 2 ms slice per frame.
  • Test-only harness: a preflight script (outside the repo) adds a fake harness profile that runs cmux-tui/crates/acpmux/tests/fake_agent.py in the tagged daemon's config. No product code knows about it.
  • Unit tests: swift test in Packages/macOS/CmuxAcpmux at 7ab8791: 27 tests in 5 suites passed. CI's swift-package-tests is skipped on this PR (the stacked Move acpmux into the cmux-tui workspace and bundle it in cmux.app #15512 changes workflow files, so change detection treats the diff as policy-only); it runs once Move acpmux into the cmux-tui workspace and bundle it in cmux.app #15512 merges.
  • Localization: scripts/localization_catalog.py check passes.

Changelog

Changed: The agent session pane is a native chat view backed by acpmux, with streaming bubbles, tool activity, permission prompts, and a session picker.

🤖 Generated with Claude Code

lawrencecchen and others added 30 commits September 17, 2026 04:36
Adds packaging scaffolding for release:
- MIT LICENSE and .gitignore (excludes the 5GB target/ tree)
- crate metadata (repository, homepage, keywords, categories)
- python/: placeholder distribution that reserves the acpmux name on PyPI
- .github/workflows/publish-pypi.yml: Trusted Publishing via OIDC, no token
The workflow sets permissions: {} at the top level. The repository is
private, so actions/checkout got no token and failed with
'repository not found'.
npm/ mirrors python/: a placeholder that holds @acpmux/acpmux and prints
build instructions. 0.0.1 was published by hand; this is 0.0.2 so the new
pipeline has a release to cut.

publish-npm.yml authenticates with OIDC, so releases need no NPM_TOKEN and
no 2FA one-time password. npm restricts 2FA-bypass tokens for direct
publishing from January 2027, which makes token-based release a dead end.
…chestration CLI

TUI: cmux-style scrollable dialogs and resizable sidebar, Claude Code-shaped
composer with a clickable controls row, action registry with a `/` command
palette, shared text-input key handling, grey palette, Codex shimmer,
markdown rendering with syntect code blocks, OSC 8 hyperlinks, a collapsible
turn / tool-group / tool hierarchy with tinted user blocks, and right-click
context menus everywhere. Files split so none exceeds 500 lines.

Backend: effort control for Claude (--effort, apply_flag_settings), Codex
and pi with an `effort` alias mapped onto each harness's option; startup
model probe for ACP harnesses; approve-edits policy replacing Claude's own
permission modes; pinned --permission-mode; purge race fix; nested Claude
Code env scrubbed on spawn; PATH-discovered harnesses merged into config;
pi-acp support.

CLI: run, wait (exit 2 on pending permission, 3 on timeout), last,
pending, ls --status/--pending, --effort/--model on new.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`acpmux wait` with no names now targets every running or permission-waiting
session on every host, and returns as soon as one resolves; `--all` waits
for all of them. Still-running sessions are left out of the report unless
--all or a timeout.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…tory, caller env

- stateSeq per session, attach counts and an unread bit set when a turn
  ends with nobody attached; _acpmux/wait blocks server side on
  ready/permission/closed/done/running with afterSeq gating
- turn_started / turn_result markers; a restart writes turn_result
  failed outcome_unknown for a turn that never settled
- _acpmux/tag, _acpmux/set_rules (per-tool rules above the policy),
  _acpmux/history, _acpmux/schema (docs/acpmux-schema.json, embedded,
  test-checked); cursor_future on events past the log
- agents get ACPMUX_ENV/SESSION_ID/SESSION_NAME/SOCKET; ACP sessions
  replay mode, model and config options after respawn; notify_command

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…otifications

- errors.rs: one exit-code table (0/1/2/3/4/5/130) and a JSON error
  envelope on stderr under --json; resolve_id maps a missing session to 4
- orchestrate.rs: wait on the server with --until, --all, --match/--regex,
  --notify, --print; ensure; exec (ephemeral run); history; session tag,
  rules, tail --since cursors (--suppress-reads); compare -a x -a y;
  skill (bundled SKILL.md); daemon schema; @ / current session key
- send/run: queue report ("queued behind …"), --timeout with cooperative
  cancel, --on-permission wait|deny|fail, prompt_stalled detection,
  --retries on agent-internal errors that produced nothing
- client: notifications can be taken repeatedly; a closed connection fails
  requests fast instead of hanging
- claude: a result with is_error becomes a failed turn, not an empty reply
- TUI: OSC 9/99 notifications on permission requests and off-screen turn
  ends; tags shown in the sidebar subtitle

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… load, config key docs

- stall detection counts only agent activity, not acpmux's own events
- --suppress-reads is stateful across tool call ids and blanks raw
  Claude tool results too
- CLI permission stats count server-side auto answers (rules/policy)
- on load, lastSeq is recomputed from the log so a restart marker never
  reuses a sequence number after a hard kill
- claude: results with is_error become failed turns
- guide / --skill aliases for the skill command
- docs: config keys are camelCase (notifyCommand, composerMaxRows)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… limits

- discovery adds `claude-sr` (`sr claude proxy`, Claude through the
  subrouter account pool) and sets it as the `fallback` of `claude`
- a profile's `fallback` takes over when a turn fails with a usage or
  rate-limit message: the child is replaced, the same agent session is
  resumed through the pool, the prompt runs again, `failover` is logged
- claude spawn: profile passthrough args precede Claude's flags so
  wrapper launchers work
- fake agent: fail-once, fail-after-update and limit modes; retry and
  failover covered by tests and by live runs

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
One blank row before every block including user bands, a dim bullet on
agent replies, and a dim rule between a turn's work and its final reply.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… trimmed selection

- user text plain on the band, bold dim › marker; agent • dim; reasoning
  dim italic; tool bullets green/red; markdown h1 bold underlined, h2
  bold, h3 bold italic, code and links cyan, quotes green
- markdown: one blank row between blocks, list items together, - and N.
  markers indented four columns per level, ——— for rules
- composer: blank row, › prompt, controls row; no rules; no separator
  rule before a final reply
- the sent message renders immediately; the daemon echo is matched
- selection highlights and copies only the useful text of each row

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…l reply

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…r checks

- `acpmux host setup HOST` installs the binary, config and launchd plist
  over ssh and adds the peer; `host update [--all]` pushes the current
  binary and restarts remote daemons. Build id from build.rs is shown by
  `--version`, exchanged in the initialize handshake, and reported as
  `outdated` in `host ls`; a forwarded "Method not found" names the gap.
- The daemon imports the login shell's environment when launchd starts
  it (bare PATH, no ANTHROPIC_* proxy meant "Not logged in" under the
  daemon while the same claude worked in an ssh shell). ACPMUX_LOGIN_ENV
  overrides it.
- Discovered `claude-sr` is verified with `sr claude proxy --version` at
  daemon start and dropped, with its fallback link, when the installed
  subrouter cannot run it.
- Auth errors ("not logged in", 401, invalid api key) trigger failover
  like usage limits.
- "agent process closed" quotes the agent's last stderr line.
- Purges propagate to peers and the TUI; `--json new` prints the full
  session record; `new`/`ensure` take `--host`; remote export bundles are
  fetched over scp; default session cwd is home.
- TUI clears the permission notice once nothing is pending.
- README: peer setup, login env, launcher checks. Tests for env parsing,
  launcher checks and process-death errors.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…e and its defaults

- `defaults` in config.json, keyed by family or profile: model, effort,
  policy, prefer (profiles to use for the family, in order) and env.
  Precedence at session/new: request, profile entry, family entry, daemon
  policy. A rejected default model or effort fails creation with the
  reason and the known model ids, and the session is purged.
- Families derive from the harness (claude, codex, opencode, pi, gemini)
  or an explicit `family` on the profile; `session/new` takes a family
  name as agent. SessionSummary carries `family`.
- `_acpmux/defaults` reads or changes them; `acpmux defaults [FAMILY
  key=value…] [--clear]` on the CLI; `agents` shows family and defaults.
- `new`/`ensure` pass model and effort in `_meta.acpmux` instead of two
  extra calls.
- Config save leaves discovered profiles, the automatic fallback and an
  auto-filled defaultAgent out of the file, so discovery stays live.
- README, skill, schema and tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ovider/model id

- A `defaults` key that is neither a family nor a profile is an alias.
  Its entry lands on top of the resolved profile's defaults; `models`
  holds a per-profile model id for harnesses whose ids differ.
- `prefer` skips a profile whose reported model list lacks the model it
  would get, so one alias works wherever the model is reachable. The
  `defaults` table and `session/new` share that resolver.
- CLI: `defaults NAME prefer=… models.PROFILE=id`; aliases marked `*`;
  unknown agent errors list aliases.
- README: open models through OpenCode and pi. Tests for alias overlay,
  per-profile ids, the availability filter, and alias routing.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…on, model-only inference

- The skill file is rewritten as the guide an agent reads first: how to
  pick an agent (family, alias, profile, or model), the core loop, waits,
  permissions, peers, output, exit codes and rules. Printed without the
  frontmatter; `acpmux --help` points to it.
- `-m MODEL` with no `-a` picks the harness whose reported catalog lists
  the id (Claude aliases and ids go to a Claude profile) and refuses an
  id nobody reports instead of running it on the default.
- `acpmux daemon models` lists every model id per harness.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The previous commit described both; its patch had not applied.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…n a closed pipe

main.rs had its own skill handler that bypassed the strip. SIGPIPE is
reset to default so `acpmux ls | head` does not panic.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…SON and config

"Agent" named both the program acpmux runs and the agent driving acpmux.
The program is now the harness everywhere a user or an orchestrator sees
it: CLI flag `-u`/`--harness` (`-a`/`--agent` removed), `acpmux
harnesses` (`daemon harnesses`), `_acpmux/harnesses`, `harness` in
session summaries and `_meta.acpmux`, `harnesses`/`defaultHarness` in
config.json (old keys still load through serde aliases, stored metadata
too), `/harness` in the TUI, the web dashboard, README, guide and schema.
ACP wire names (agentInfo, agent_message_chunk) are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… by policy; ${cwd} in env

- Discovery: oh-my-pi (`omp acp`) and prime-agent (`prime-agent --mode
  acp`) join the pi family.
- acpmux now advertises the ACP client file system and serves
  fs/read_text_file and fs/write_text_file: writes go through the
  permission policy and rules as `Write PATH [edit]`, reads are refused
  under deny-all or a deny rule. omp delegates its writes, so `ask` gates
  every edit there.
- Profile and family env values expand ${cwd}, ${home} and ~/, so an
  alias can set CODEX_HOME=${cwd}/.codex for oh-my-codex projects.
- README: results per harness (omp, prime-agent, oh-my-opencode,
  oh-my-codex) with the caveats found. Fake agent gained fswrite/fsread
  modes; tests for the policy gating and env expansion.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ess config

- `-m HEAD[/MODEL]` on new/run/exec/ensure/compare. HEAD is a family or
  a profile; the model keeps its own slashes. Nothing is inferred: an
  unknown head is an error, and when it is a model id the error names
  the spelling (`write codex/gpt-5.5`). `-u`/`--harness` removed.
- A family resolves through its prefer list, else its only profile,
  else the profile named like it; otherwise it is refused. Forks are
  their own families (omp, prime). Discovery prefers claude-sr for the
  claude family, with the direct login as fallback, unless the user set
  a preference.
- `-p NAME` presets: one harness plus model, effort, policy, env.
  `acpmux preset`, `_acpmux/presets`. Aliases inside defaults, the
  per-profile model map and the catalog-availability skip are gone.
- Harness profiles gain declared `models`, inline model/effort/policy,
  and `${model}` in argv or env as a spawn parameter (set_model then
  restarts the process). `daemon models --refresh` re-probes.
- Provider-prefix rule: `-m opencode/big-pickle` uses the full id when
  the catalog lists `opencode/big-pickle` and not `big-pickle`.
- README, guide, schema, tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… reconnects

- Context menus: right press opens and arms the menu, the drag moves the
  highlight, the release runs the item under the pointer; a release over
  no item leaves the menu open for a click. Left press inside the menu
  arms it the same way.
- "daemon connection closed" now says what was in flight and why the
  socket closed (daemon still running and dropped us, exited without
  cleanup, or shut down), the build mismatch when there is one, and the
  log path. Exit detail `daemon_closed`, retryable.
- The client puts a `_acpmux/disconnected` notification on its stream
  when the socket closes; streams and follows end with that error instead
  of hanging, and the TUI reconnects (starting a daemon if needed),
  re-watches, reloads sessions and re-attaches the selected one.
- Bare harness "Internal error" replies quote the last useful stderr
  line, as process deaths already did.
- Example strings in the TUI and CLI use -m.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Screenshots of the Codex desktop app were the reference.

- Transcript: tool calls are one muted line with a kind glyph and a
  short title (paths cut to the file name); thoughts collapse to
  "Thought  <summary> ›"; each turn's work sits under "Worked for 19s ›"
  from the daemon's turn markers; a centered "Today 2:15 AM" precedes
  each user message; no bullet before agent text; code headers span
  the block.
- Composer: a rounded box. Inside, along the bottom: the permission chip
  ("Full access" in a warm accent, "Ask before acting", …), the harness
  mode when it is not the default, and at the right the model, the
  effort, and a send glyph. The directory moved to the header.
- Header: "▢ project  ›  session", status only when it needs attention,
  token use at the right edge.
- Sidebar: a shaded column without a rule, "New session" on top,
  sessions grouped under their project (host · project for peers), one
  line each with a status mark at the right edge, "Add host" pinned to
  the bottom, hover and selection as full-row shades.
- Theme tokens: sidebar_bg, accent_warm_fg, composer border, muted text.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…and draft states

- A pending permission is a card above the composer ("Needs permission ·
  Write perm.txt", the options as chips, y/n hint) instead of a modal
  over the conversation. Digits, y and n still answer it.
- Every dialog and menu has rounded corners.
- Draft and empty states: a centered "What should we build in
  <project>?" headline with the settings as one muted line.
- Transcript permission rows read "? Needs permission", "✓ Allowed",
  "✗ Rejected"; an open turn's handle says "Working for 12s".
- Sidebar draft rows are labelled "Draft" until typed into.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…olls, live handle while a turn runs

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…; keys hint and quieter status bar

The hub records the first prompt as the session title. The sidebar and
header show it for generated names (codex, codex-3) and keep names the
user chose.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…and empty sessions

- ACP diff content blocks become +/- lines with two lines of context; the
  tool row shows "Edited calc.py  +2 -1" in the diff colors and expands
  to the colored diff.
- Sessions with no messages show the "What should we build in …?"
  headline; peer sessions drop the host prefix in the sidebar and the
  header reads "host · project  ›  name".
- Collapsible rows light up under the pointer; the composer names the
  harness when the model is its default.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
lawrencecchen and others added 3 commits September 29, 2026 21:08
A launcher can start the daemon with SIGTERM (and SIGCHLD) blocked in
its signal mask. exec keeps the mask and every runtime thread inherits
it, so SIGTERM stayed pending forever and the daemon needed kill -9.
main now clears the mask before the runtime starts its threads.

Shutdown is bounded on its own as well: each agent's process group gets
SIGTERM, then SIGKILL after 2 s; lock waits have deadlines; the exit
watcher's lock no longer delays the kill. The new daemon_lifecycle case
(blocked and ignored SIGTERM, one agent mid-turn, one that ignores
SIGTERM, an attached client and a watcher) exits in under 5 s.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e streaming growth, scroll measurement

- The daemon spawn clears the signal mask and resets catchable signals to
  their defaults (POSIX_SPAWN_SETSIGMASK | SETSIGDEF), and the launching
  shell runs with job control so it does not start acpmux with SIGINT and
  SIGQUIT ignored. Swift concurrency and dispatch worker threads run with
  most signals blocked, and the mask survives exec.
- The send morph animates one bubble outline from the composer's rounded
  rectangle to the final tailed bubble (same path builder, same grouped
  corner), so the tail is attached in flight and the hand-off matches.
- Streaming growth sets the bubble outline and the new text in the same
  frame; only the growth out of the typing bubble tweens.
- DEBUG debug.agent_chat.action gains select_session, seed_rows (synthetic
  transcript) and fling/fling_stats (display-link frame timing).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
github-actions Bot added a commit that referenced this pull request Sep 30, 2026
github-actions Bot added a commit that referenced this pull request Sep 30, 2026
github-actions Bot added a commit that referenced this pull request Sep 30, 2026
github-actions Bot added a commit that referenced this pull request Sep 30, 2026
github-actions Bot added a commit that referenced this pull request Sep 30, 2026
github-actions Bot added a commit that referenced this pull request Sep 30, 2026
lawrencecchen and others added 5 commits September 29, 2026 21:54
…n; keep sending bubbles at full color

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e viewport first

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…session starts pinned

A fast agent's reply arrived mid-flight and ended the morph in two frames. The
flight now bends from its on-screen state to the moved slot.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…om the text's glyphs

Row text is laid out by a small worker pool with TextKit 1 groups that the main thread
then only adopts: rows about two screens ahead of the scroll first, the rest in the
background after a load. The send morph now starts from the composer text's glyph
bounds, travels a slight curve, and the placeholder fades in after the flight leaves.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s; apply finished heights without main-thread layout

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@teamleaderleo

Copy link
Copy Markdown
Collaborator

This remains a draft stacked on #15512; leaving it open until the acpmux bundle lands.

@teamleaderleo teamleaderleo added the area: agents Agent integrations (Claude Code, Codex, ACP), agent chat, hooks, status label Sep 30, 2026
teamleaderleo and others added 4 commits September 30, 2026 14:40
* Add shared terminal sizing contract and Swift engine

One policy reducer decides the PTY grid for local and Cloud terminals.
The conformance corpus is replayed by the Swift engine and, next, the
cmux-tui Rust twin.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Document Mac and iPhone sizing payloads

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add shared participant color and cmux-tui sizing wire params

TerminalSizingParticipantColor hashes user_id (else participant id) with
FNV-1a 64 into a fixed 10-color palette so Mac and iOS agree.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add CmuxTerminalSharing store, local host and Cloud relay model

TerminalSharingStore is the one Mac-side owner of per-terminal size state
and actions. LocalTerminalSizingHost runs the shared engine for local
terminals with the Mac pane and each phone as participants.
CloudTerminalSizingRelay tracks the Mac and its phones as cmux-tui
participants. Wires CmuxTerminalSizing and CmuxTerminalSharing into the
app and test targets.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Bump bonsplit for the shared-terminal presence accessory

Points at manaflow-ai/bonsplit#259 (feat/terminal-size-presence). Land
that PR before merging so the pinned SHA is on bonsplit main.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Host local terminals and relay Cloud terminals through the sizing engine

Local terminals: TerminalController runs LocalTerminalSizingHost per
surface (the Mac pane as mac:<surface>, each phone as mobile:<client_id>)
instead of the smallest-viewport rule, and applies the decided grid
through the existing viewport governor. Mobile RPC gains size_state in
replay, mobile.terminal.size_state and mobile.terminal.detached pushes,
mobile.terminal.reattach, size_policy.set and participant.disconnect. A
disconnected phone's viewport, input and replay are refused until it
reattaches.

Cloud terminals: with shared-sizing-v1 the mirror sends its identity,
forwards each phone as a relay sub-view, relays size-state and routes
detached events. A disconnected-by detach of the Mac stops automatic
reconnection. Daemons without the capability keep the legacy claim path.

Socket: terminal.size_state, size_policy.set, size_to_me,
size_counts.set, participant.disconnect, participants.disconnect_others
route through TerminalSharingStore. Not allowlisted for the remote relay.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Show shared terminal size in tabs, panes and a size panel

Tab presence accessory and size context menu (bonsplit), pane bounds
overlay with owner border, hatch, chip, crop pill, HUD and a detached
card, and the SwiftUI size panel. Adds the Size Terminal to My Window
shortcut (ctrl+opt+cmd+=) and command palette actions, all routed
through TerminalSharingStore.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: decode shared terminal sizing state and model per-surface attachment

Adds the phone side of docs/shared-terminal-sizing.md: decoders for the
mobile.terminal.size_state and mobile.terminal.detached pushes and the
size_state/self_participant_id replay fields, a per-surface sizing reducer
(generation ordering, network vs disconnected-by detach, reattach), the
presentation facts for the bounds UI, the viewport payload builder with
device_kind/device_name/counts_override, a stand-in owner color matching
the shared FNV-1a rule, and the pure bounds geometry for the letterbox.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: keep shared sizing state and honor detach in the shell

Subscribes to the size_state and detached pushes, records size_state from
replay answers, and gates viewport reports, input, paste, mouse, scroll and
replay while another participant has detached this phone from a terminal.
A network detach recovers through the existing replay path. Adds
reattach, size policy, participant disconnect and counts override actions.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: show shared terminal bounds, size sheet and detached card

Draws the owner-color border, hatch and cut-edge fade inside the surface's
letterbox, adds the corner chip, +N cols pill, reconnecting capsule, the
size sheet (mode, participants, counts, disconnect) and the detached card
with Reattach and Reattach as viewer. Strings are localized in the app
catalog for all nine locales.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Localize shared terminal sizing strings

All nine app locales. Mac, iPhone and iPad are recorded as brand
literals and the person-device separator as a format literal.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add surface sizing CLI verbs and Cloud relay session tests

cmux surface size, size-policy, size-to-me, size-counts, participants,
disconnect-participant and disconnect-others call the terminal.* socket
methods. Session tests cover disconnected-by (no auto-reconnect), network
detach (reconnects) and a phone detach that keeps the mirror attached.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add the Rust shared terminal sizing engine

Port TerminalSizingEngine to cmux-tui-core/src/sizing_policy.rs with the
same JSON wire shape and replay schemas/terminal-sizing/fixtures.json in
its tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Wire shared terminal sizing into the cmux-tui mux and protocol

Every client view and relay sub-view of a terminal is a participant of
the runtime's sizing engine. Attach, claims and send/send-key input are
activity; an owner that leaves hands the grid to the next owner instead
of freezing it. set-client-sizing maps onto counts overrides.

Add set-size-policy (terminal override or workspace default),
set-size-counts, get-size-state, relay sub-views on resize-attached-view
(view + identity), identity fields on set-client-info, participant ids
and by on detach-client, and reason/by/view on detached. size-state
events and the new attach response fields go only to clients that send
shared-sizing-v1, which identify now advertises. Update the spec,
inventory, SDK schema and generated bindings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Send note-size-activity for Mac and phone input on Cloud terminals

The cmux-tui host now takes explicit activity through note-size-activity
(with view for a phone behind this Mac). set-client-sizing is no longer
used as activity because enabled:false means counts false. Activity is
sent only when it would move ownership.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Document note-size-activity and the shared-sizing opt-in

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Credit relay-forwarded input to the relay sub-view

Add note-size-activity {surface, view?}, gated on shared-sizing-v1.
Without view it marks the caller's own view; with view it marks that
relay sub-view, so a Mac mirror forwarding phone input makes the phone
the latest active participant instead of the Mac.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Skip the size HUD when this Mac resizes a grid it owns

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Use the shared participant color on iOS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that bounds show when this Mac does not match the grid alone

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Show terminal bounds whenever this Mac does not match the grid

A single Mac with a fixed or smaller grid had no border, hatch or chip,
because sizing chrome appeared only when another viewer was attached.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* List shared sizing verbs in cmux surface help

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: make shared terminal sizing UI minimal

The terminal shows a 1 pt owner-color border at 70% opacity, a faint hatch,
a short cut-edge fade and one caption2 chip at the grid's bottom-trailing
corner ("118×38 · Maya's Mac Studio · 12 cols hidden"), only while this
phone's grid differs. The "+N cols" pill and the top-leading chip are gone.
The chip is a UIKit button owned by the surface so it follows the letterbox
rect; its tap opens the size sheet.

The size sheet is a grouped list: a "118 × 38" header with the owner under
it, one Size menu (Fixed adds a columns × rows field row), participant rows
with an avatar, "Name · Device" and "Sets size" on owners, swipe and context
menu Disconnect, a counts toggle in this phone's context menu, EditButton
reorder in Priority mode, and one confirmed "Disconnect Others" button.

The detached card is "Detached", one line, Reattach and Reattach as viewer.

Model: showsChip now follows viewportDiffers only; adds isOwner(_:) and
ownerLabel, which drops the person name when the device name already
contains it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Make the Mac terminal size UI minimal and hang the panel from the tab

The size panel is now 280pt, opaque and padded (16/12pt): the grid and
its owner on one line, a Size mode menu (with a cols × rows pair in
Fixed), participant rows with a hover menu (Counts toward size,
Disconnect) and drag handles only in Priority, and Disconnect Others with
an inline confirm. The size map, help text, scope select, switches,
eject icons and Size to My Window button are gone from the panel.

TerminalSizePanelPresenter owns the one popover and anchors it to the
tab accessory, else the tab item, for every entrypoint. The accessory
click toggles it; the mouse-down that closes a transient popover is
recorded so its mouse-up does not reopen it.

The pane overlay keeps a 1pt owner-color border that animates to a new
grid, a fainter hatch, a 16pt fade on a cut edge, and one AXButton chip
(118×38 · Maya's Mac [· 12 cols hidden]) that opens the panel. The HUD,
flash and +N cols pill are removed. The detached card is shorter.

Label rules move to TerminalSharingPresentation in CmuxTerminalSharing
with injected strings and tests. Unused strings are removed; new ones
carry all nine macOS locales. Bonsplit moves to the fork branch head
with the avatar-only accessory and popoverAnchorView(for:).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that fit-everyone modes count the same user's phone

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Count every attached device in fit-everyone and largest modes

The same-user phone deferral made Fit everyone ignore the iPhone, so the
grid stayed Mac-sized with no visible reason.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Count every attached device in cmux-tui fit-everyone and largest modes

Mirror the Swift engine: without a counts override, smallest and largest
modes count every participant with a viewport; the same-user handheld
deferral applies only in latest, priority, and fixed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Draw shared-terminal sizing UI in neutral greys and mark uncounted devices

Remove per-participant accent colors on Mac and iOS: grey avatars with
secondary initials, a thin labelColor ring on the owner, and a neutral
border, hatch and cut-edge fade. TerminalSizingParticipantColor is deleted
with its tests and doc paragraph.

The tab accessory shows only other participants: one item per other person
(by user id) and one device glyph per kind for the viewer's own other
devices, owner first. Mac panel and iOS sheet rows say "not counted" for
participants the grid ignores. Bumps bonsplit to the neutral accessory.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that shared terminals default to fit everyone

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Default shared terminals to fit everyone

Follow latest let the Mac grid outgrow an attached iPhone, which then
showed a cut-off terminal. Fit everyone keeps every device's view whole.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Draw the Mac sizing UI in the split divider grey

The grid border, hatch, cut-edge fade, pane chip, tab accessory and panel
row avatars now use the workspace's split divider / tab-bar separator color
(Bonsplit Appearance.separatorColor, which honors pane-border-color and
Ghostty split-divider-color) instead of label-color greys. Borders and rings
draw in it as is; fills derive from it with opacity. Bumps bonsplit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: show a shared grid larger than the phone whole, scaled to fit

When the host publishes a grid larger than the phone (Follow latest,
Largest, Priority, Fixed), the surface left libghostty at its natural
grid. A 175x78 stream then parsed into 54x44: lines wrapped and cursor
moves garbled, and every render-grid replay failed the local grid fence
and reopened recovery.

The surface now always renders the exact shared grid. When it is wider
or taller than the phone, the renderer layer keeps its exact drawable
bounds under a scale transform, displayed at the viewport width and
bottom-pinned. Pinch magnifies around the fingers up to 1:1 and moving
the fingers pans; neither changes the PTY grid or font. Cut-edge fades
follow the displayed rect, and the chip says "scaled" instead of
"N cols hidden" (all catalog locales).

The mode decision and the scaled layout are pure and tested:
TerminalGridFit and TerminalScaledGridLayout.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: draw shared-sizing greys in the app's separator color

The grid border, chip stroke and owner ring use UIColor.separator, the
color of the workspace list dividers and the plain letterbox border.
The hatch, cut-edge fade, chip fill and avatar fill use it at half its
own opacity. The border was secondary label at 50%, and the avatar used
tertiary system fill.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS: draw sizing chrome only for a settled mismatch; send identity with replays

The bounds border, hatch, fades and chip drew whenever the grid and the
phone's viewport differed, including transient mismatches: the first
size state after connect still lists the phone's old viewport, and a
keyboard, rotation or zoom report is briefly in flight. In dark mode the
border was secondary label at 50%, so it flashed near-white.

TerminalSizingChromeGate now draws the chrome only when the host's
newest size state lists this phone's acknowledged viewport and no
viewport report is queued or awaiting its echo. The surface
re-evaluates on each size state and each report start or settle, with
no timer. The plain letterbox border for older hosts also waits for the
report. Nothing draws before the first size state.

mobile.terminal.replay now carries device_kind and device_name next to
client_id, viewport_columns, viewport_rows and viewport_generation, so
the host can register this phone and apply the shared size before it
captures the first frame.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin latest sizing in cmux-tui tests about latest semantics

Fit everyone (smallest) is now the default policy, so nine mux, server and
sizing_policy tests that describe latest-activity ownership pin the latest
policy explicitly through a test-only Mux helper.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Report a detached Mac view in terminal.size_state and cmux surface size

After a kick the socket payload kept the pre-kick state with no sign of the
detach. The payload is now built in TerminalSizingWireCoder and carries
detachment {reason, by, at} (null while attached); the CLI summary prints a
detached line. The summary's missing-mode fallback is smallest, the default.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Capture a phone's first Cloud replay at the host's fitted grid

The local replay already registers the phone's viewport (client_id,
viewport_columns/rows/generation, device_kind, device_name) and applies the
fitted grid before capture; a test now pins that one connect is one grid
change. On the Cloud relay path the sub-view report went to the daemon but the
replay captured at once, at the pre-join grid. The relay now tracks each sent
report; the replay answers viewport_transition until the host's state shows
the phone's viewport (bounded by 3 s so a lost answer cannot block). Docs
cover the replay viewport fields and the iOS scaled grid, separator grey and
chrome gating.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Join shared terminal sizing from the cmux-tui frontend

The TUI now opts into shared-sizing-v1 with device_kind tui and its
hostname, stores size-state events per terminal, and draws the Mac chip text
on the pane border (118x38 · Lawrence's Mac, plus cols hidden when narrower)
only while someone else is attached or its viewport differs from the grid.
The pane and border menus offer the five modes (Fit everyone first) and a
submenu per participant with Counts toward size and Disconnect, sending
set-size-policy, set-size-counts and detach-client; daemons without the
capability keep the legacy per-client menu. Core exposes the size-state
accessors and a participant detach for the in-process session.

The pty geometry integration test pins the latest policy, since fit
everyone is the default.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that cmux-tui focus keeps a shared-sizing counts choice

Against a shared-sizing-v1 daemon, focusing a terminal sends the legacy
set-client-sizing, which clears a "not counted" choice made on the Mac.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Treat cmux-tui focus as shared-sizing activity only

Against a daemon advertising shared-sizing-v1, focusing a terminal sends
note-size-activity instead of the legacy exclusive set-client-sizing, which
cleared a counts choice made on the Mac. Daemons without the capability keep
the legacy claim.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that a cmux-tui client has size state and a device name at attach

The remote client ignores the size_state in the attach-surface answer and
waits for the first change event; the in-process frontend joins with no
device name.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Give cmux-tui clients size state and a device name at attach

The remote client adopts the size_state and participant from the
attach-surface answer instead of waiting for the first size-state event.
Remote and in-process TUI participants carry device_name, the host name or
cmux-tui.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that a Mac mirror's disconnect detaches the phones behind it

When the Cloud host detaches this Mac with disconnected-by, the relay keeps
its phones' sub-views and tells them nothing, though they lost their path to
the terminal.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Detach the phones behind a Mac mirror when the host detaches the Mac

A non-network detach of the Mac's own Cloud attachment now forwards the same
reason, actor and time to every phone viewing the terminal through this Mac
as mobile.terminal.detached, gates their input until they reattach, and drops
their relay sub-views. After the Mac reattaches, phones reattach normally.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Satisfy rustfmt and clippy for the shared-sizing focus and attach fixes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that an explicit phone leave restores the Mac size immediately

The governor must apply an explicit leave (surface closed, back navigation,
viewport clear, disconnect) at once; only an implicit TTL expiry may wait
out the stability window. Adds a CmuxMobileHost package test target.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Restore the Mac size at once when a phone explicitly leaves

A viewport clear, a disconnect or a host-side disconnect of a phone went
through the governor's 3 s uncap window, so the Mac pane stayed at the
phone's grid for about 3 s after the phone left (log: mobile.viewport.govern
stage reschedule=1 reason=mobile.terminal.viewport.clear, flush 3.06 s later).

The governor gains an immediate request: it applies the target now and
cancels any staged change, so a pending flush is inert. clearMobileViewportReport,
the path every explicit leave takes, resolves sizing with immediate: true.
Only the TTL expiry of an input-carried report still waits for the window.
No timer or sleep is added.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Apply a host-side phone disconnect without the stability window

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that a Mac matching the grid draws no bounds or chip

Someone else attached shows the tab accessory, but the border, hatch and
"105×45 · This Mac" chip describe a mismatch and must not draw when this
Mac's viewport equals the grid.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Draw the Mac bounds and chip only when this view differs from the grid

The pane overlay used showsSizingChrome, which is also true whenever a
phone is attached, so a Mac showing the grid exactly drew the chip
"105×45 · This Mac". The overlay now uses showsBoundsChrome (attached and
this viewport differs from the grid) for the border, hatch, fades and chip,
and stays visible for the detached card. The tab accessory keeps
showsSizingChrome.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Give the Mac detached card's Reattach as Viewer a standard secondary button

The link style drew accent text on the grey card with low contrast. A
bordered push button draws the label color on the control fill, which
meets WCAG AA on the card in light and dark mode.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that the iPhone size chip never covers the last grid row

The chip sat inside the grid's bottom-trailing corner, over the last row.
It must go in the letterbox outside the grid (below, beside or above), and
only as a compact pill at the viewport's top-trailing corner when the grid
fills the viewport.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Place the iPhone size chip outside the grid, never over the last row

The chip was laid out inside the grid's bottom-trailing corner, over the
last row where the prompt and cursor live. TerminalSizingChipPlacement is a
pure placement: in the letterbox below the grid, then beside its last rows,
then above it (a bottom-pinned grid leaves its slack above); when the grid
fills the viewport, a compact "118×38" pill at the viewport's top-trailing
corner. The surface measures the full and compact titles and applies the
placement. The contract doc says a matching viewer draws no bounds and where
the chip goes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Declare the viewport reassert marker outside the DEBUG-only block

updateUIViewController reads it in every configuration, so a Release iOS
build did not compile.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that an oversize shared grid fits the phone surface exactly

The phone derived its cell size as surface width over natural columns,
which counts padding and the leftover fraction. Multiplied by a grid
wider than the phone (120x40 fixed on a 66-column iPhone), the request
laid out 121 columns, the render-grid apply fence rejected every replay
and the scaled view froze on stale content. Moves the request math into
TerminalGridFit unchanged and adds the failing test against libghostty's
padding-then-whole-cells layout.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fit an oversize shared grid to the exact column count

The request now uses libghostty's integer cell size plus the natural
surface's padding remainder, which lays out exactly N cells for any N,
and the refinement loop removes an overshoot as well as a shortfall.
Before, a 120x40 grid on a 66-column iPhone laid out 121 columns, every
render-grid replay failed the apply fence (retry_exhausted, fail_open)
and the scaled view stayed frozen on the old 66x45 content.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that a scaled shared grid shows no scrollback above it

With a shared grid larger than the phone (Fixed 120x40 on a 66x41
iPhone), the grid is scaled to fit and bottom-pinned, leaving slack above
it. The renderer drawable's top scroll-edge band, which libghostty fills
with the scrollback rows above the viewport, then displays inside that
slack, where the sizing chrome hatches unused space and places the size
chip. The chip looked drawn over terminal rows. The border and chip rect
match the displayed grid; the band must be hidden while the grid's top is
inside the viewport.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Hide the scrollback band above a scaled shared grid

The renderer drawable extends above the grid by the top scroll-edge band,
which libghostty fills with the scrollback rows above the viewport. The
band belongs under the navigation bar. With a shared grid scaled to fit
(or letterboxed), the grid is bottom-pinned with slack above it, so the
scaled band rendered scrollback inside that slack: the area the sizing
chrome hatches as unused and where the size chip sits. The chip, border
and hatch already used the displayed grid rect (lastRenderRect); the
renderer layer showed more than that rect.

TerminalScrollEdgeBandClip decides, from the displayed grid rect and the
viewport, whether the band may show: only while the grid's top reaches
the viewport's top. Otherwise syncRendererLayerFrame masks the renderer
layer to its grid rows (layer-local, so the scale transform and pixel
scroll are unaffected). Every placement path (geometry result, viewport
relayout, keyboard top-align) goes through that one function.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add a shared-grid mode to the DEBUG terminal layout preview

CMUX_UITEST_TERMINAL_SHARED_GRID=<cols>x<rows> hosts that grid with the
sizing chrome and draws scrollback plus a labeled box, with no paired Mac.
CMUX_UITEST_TERMINAL_TOP_INSET and CMUX_UITEST_TERMINAL_TOP_INSET_LATER
set the scroll-edge band. Used to verify the scaled grid on a simulator.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that sizing borders skip edges flush with the viewport

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Draw sizing borders only on sides facing unused space

The grid border stroked a full rectangle. On the Mac the grid pins
top-left under the tab bar, so its top line sat against the tab bar's
separator in the same grey: two parallel lines. On iOS a grid flush
with the viewport top (or filling the viewport) doubled the navigation
bar edge the same way. Each platform now computes the border's edge set
in its pure geometry (TerminalSizeBoundsEdges / TerminalSizingBorderEdges)
and strokes open polylines for only the sides facing hatched space.
The plain iOS letterbox border uses the same rule.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test top-pinned short grids and keyboard-safe sizing chrome

A shared grid shorter than the phone pins to the top with the slack
below it (letterbox and scaled modes). With the keyboard open the grid
stays put while the cursor row fits above the dock and otherwise slides
only enough to keep that row visible; the sizing chrome never draws
under the dock. In a shared-sizing session an alternate-screen keyboard
toggle does not change the reported viewport.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin short shared grids to the top and keep sizing chrome above the keyboard

A shared grid at least one row shorter than the phone now pins to the
top (letterbox and scaled modes), with the slack below it; the natural
grid's sub-row remainder stays bottom-pinned. The keyboard absorption
counts that slack as blank space below the content, so the grid stays
put while its content fits above the dock and otherwise slides only
enough to keep the cursor row visible. The sizing chrome lays out in
the part of the viewport the dock leaves visible (TerminalKeyboardViewport),
so no border, hatch or chip draws under the keyboard. The bottom
scroll-edge band is hidden under a top-pinned grid, like the top band
above a lower grid. In a shared-sizing session an alternate-screen
keyboard toggle no longer resizes the reported viewport, so it cannot
shrink and regrow every device's grid under Fit everyone.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Map border points through a closure on the main actor

Passing the MainActor-isolated layerPoint method to map drops its actor
isolation, which Swift 6 rejects.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test main's displaced-owner scenarios under shared sizing

Main's displaced-owner tests asserted the removed exclusive-owner model. The
same user outcome (the laptop regains the grid when the phone stops sizing;
a departed view never returns) is now asserted through the sizing reducer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test shared sizing colors against a theme matrix

Adds TerminalSizingPalette with the current separator-grey behavior and a
theme matrix (light, dark, Solarized, Dracula, low-contrast, pure white and
black, mid grey) requiring 4.5:1 chip text, 3:1 borders and visible fills.
It fails today.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Derive shared sizing colors from the surface with contrast floors

The sizing chrome drew in one separator grey with alpha fills and system
secondary-label text, which vanished on light tab bars (light glyph on a
light tab under dark macOS) and was faint on custom dark themes.

Every color now derives from the surface it sits on through one pure
function per platform: the surface's text color mixed into its background
in sRGB, then moved toward black or white until glyphs and chip text reach
4.5:1, rings and borders 3:1, and fills stay visible.

- Mac tab accessory: tab fill / tab bar and its text color (bonsplit
  BonsplitContrastPalette, bumped to 3793c0a).
- Mac pane border, hatch, cut fade and chip: terminal theme background and
  foreground; chip fill is opaque.
- Mac size panel avatars: popover window background and label color.
- iPhone border, hatch, cut fade and chip: the surface's terminal theme,
  refreshed on theme change (TerminalSizingPalette).
- iPhone size sheet avatars: inset-grouped row background and label.

Adds an opt-in PNG proof (CMUX_THEME_PROOF_DIR) and documents the rule.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* List shared sizing actions in the dock tab switch

Main's dock tab context handler predates the sizing actions, so the merge
left its switch non-exhaustive and raised a new Swift warning.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Link CmuxTerminalSizing in the Cloud command fixture

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Count the shared sizing commands and event in SDK coverage tests

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Replace namespace-only iOS sizing helpers with values

TerminalGridFit.mode becomes TerminalGridFitMode.init, requestedPixelSize
moves onto TerminalNaturalGridMeasurement, and the chrome gate, band clip
and viewport parameters hold their stable inputs as instances.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Bump bonsplit: side-by-side presence avatars

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pass the cell height in the keyboard pin tests

renderRect now takes the cell height to decide top or bottom pinning.
These tests render a full-height natural grid, which stays bottom-pinned.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test sizing host lifetime, fixed-size limit and phone reconnect ordering

Red: a closed terminal keeps its local sizing host, the socket accepts a
70000-column fixed grid, and the phone drops a new host's generation 1.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Bound sizing host lifetime, fixed sizes and phone state ordering

- cleanupSurfaceState removes a closed terminal's local sizing host,
  controller and store snapshot; a moved surface keeps its host.
- Socket and phone policy entrypoints reject a fixed grid above the
  size panel's 500 x 200 (TerminalSizingPolicy.maximumFixedSize).
- The phone forgets published size states when its Mac connection
  ends, so a relaunched host's generation 1 is accepted.
- A font-size change re-reports the Mac pane's natural grid, not only
  a pixel-size change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add a sizing fixture for a zero viewport on attach

Rust clamps an attached viewport to 2 x 1; the Swift twin kept 0 x 0 for
a decoded participant.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Clamp an attached viewport in the Swift sizing reducer

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Settle viewport reports by ID in iOS geometry tests

The spacing harness confirmed echoes with the no-argument call, which
never ends the report handshake, so the sizing chrome gate kept the
letterbox border hidden. Production settles by report ID first; the
harness now does the same. A grid larger than the phone now renders
exactly and scaled to fit, so the verified replay test expects the
exact grid before the viewport grows.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Register a main window context in the sizing host tests

Socket targets resolve a surface through the main window contexts, so
the tests could not create a host without one.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test that the SwiftPM scratch key covers the vendored bonsplit commit

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Key the owned SwiftPM scratch on the vendored bonsplit commit

swift-package-tests linked CmuxPanes test objects compiled against main's
bonsplit into a branch whose bonsplit changed Tab.init, and failed on an
undefined symbol. SwiftPM's mtime check cannot see a submodule that moved to
sources older than the kept build, so the scratch directory is now per
bonsplit commit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* iOS onboarding: align the final primary action (#15791)

* test: cover final onboarding button alignment

* fix: align final onboarding primary action

* docs: document onboarding button alignment rule

* test: isolate onboarding alignment fixture

* test: account for hidden onboarding slot

* test: remove brittle hidden-slot assertion

* test: record every onboarding alignment frame

* Update the watch target runtime test for #15311 (unblocks the merge queue) (#15814)

* Wait for the background focus, not the scan signal, in the watch target runtime test

The scan callback fires before the activity is processed, and a scan can
defer the activity while the launched target's process metadata is not
ready. The test then asserted two terminal focuses one scan too early and
failed on loaded CI Macs. Wait for the second focus event instead; the
test's one-minute time limit still bounds a real failure.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Expect no terminal focus from background activity in the watch target test

#15311 stopped Computer Use activity from focusing the calling terminal,
but this test still expected a second focus after the background scan.
PR CI runs only changed suites, so the stale expectation first failed in
the merge queue's full run. The previous commit's wait never completed
for the same reason; replace it with the new expected count.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: pin pane-flash routing defaults in direct-interaction tests (#15810)

testTerminalMouseDown/KeyDownDismissesUnreadWhenSurfaceIsAlreadyFirstResponder
failed on main run 36661608916 with flashCount 0 while the unread was
dismissed. That run executed on cmux13s-Mac-mini, whose persisted
com.cmuxterm.app.debug domain holds tmuxOverlayExperimentEnabled = 1 and
tmuxOverlayExperimentTarget = bonsplitPane. The app host reads that domain,
so TerminalPanel.triggerFlash took the bonsplitPane branch and flashed the
workspace pane overlay instead of GhosttySurfaceScrollView, which is the
only place flashCount records. The same tests pass on the same commits on
cmux7/9/10/12 and austin-mini-1, whose domains lack those keys.

The product path is unchanged: the direct-interaction dismissal still
requests the dismiss flash. Pin the tmux overlay experiment off and the
pane flash on for each test in the class and restore the prior values in
tearDown, so the tests stop depending on runner state.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(input): consume keys while terminal runtime is unavailable (#15738)

* test: cover unavailable terminal escape fallback

* fix: consume input while terminal runtime is unavailable

* Fix the cross-surface ordered-input test hang (#15811)

* test: check ordered-input buckets before waiting on a second surface

orderedInputOnAnotherSurfaceIsNotBlocked holds input-1 and waits for
input-2 to start. If both requests share one ordering bucket, input-2
queues behind input-1 and the wait never ends, so CI reports only a
300 s time limit. Require distinct ordering keys first so the test fails
at once with the real reason. With the non-UUID surface ids the test
still sends, this commit fails: both keys are empty.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: name real terminals in the cross-surface ordered-input test

#15432 keys the ordered-input bucket on the canonical terminal UUID
(phoneNamedTerminalID), so the test's "surface-1"/"surface-2" ids no
longer parse and both requests share the empty bucket. input-2 then
waits behind the held input-1 and the test hangs to its 300 s limit.
Use UUID surface ids, which is what a phone sends. The product change is
intended and already covered by
testOrderedInputKeyIsTheSameForEverySpellingOfOneTerminal.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep zsh prompts intact when a terminal resizes after a partial line (#15809)

* Keep zsh prompts intact when a terminal resizes after a partial line

Bump Ghostty to 5e5f8e12e (manaflow-ai/ghostty#245). zsh PROMPT_SP pads a
partial output line past the right edge, which soft-wraps into the prompt
row. Reflow joined the two rows on every resize, so zsh redrew its prompt
at the wrong cells and left fragments such as "lalalawlawrence in ~ λ".
An OSC 133;A prompt at column 0 of a wrapped row now starts its own line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Rebase the Ghostty prompt fix onto the fixed styled blank row test

Ghostty e1b8bf5f4 carries 9d8d40319, which corrects the styled blank row
test that failed at 9961d09be and stopped build-ghosttykit.yml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin the GhosttyKit archive for Ghostty e1b8bf5f4

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add a Themes settings page listing every terminal theme; TextBox leaves beta (#15112)

* test: Themes settings page lists every terminal theme

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add a Themes settings page with every terminal theme; drop TextBox beta label

Themes collects app appearance, accent color, browser theme, adaptive
default theme and the terminal theme gallery. The gallery now lists every
theme Ghostty ships, grouped by the edited slot's appearance, and search
has no result cap. TextBox loses its beta label, warning note and docs
callout.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: sidebar matches the terminal background by default

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Match the terminal background in the sidebar by default

A light terminal theme under a dark app appearance left the sidebar and
titlebar dark beside a white terminal. sidebarAppearance.matchTerminalBackground
now defaults to true. Every reader takes the catalog default; the AppKit
resolver, which cannot import CmuxSettings, mirrors it. An explicit false
in Settings or cmux.json still opts out.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: secondary chrome color holds a contrast floor

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Hold sidebar secondary text at 3.5:1 over terminal-matched backdrops

A sweep of all 463 built-in themes with the sidebar matching the terminal
found secondary text (workspace path, metadata, footer help icon, Upgrade
badge) as low as 2.6:1 on saturated mid-tone themes such as Hot Dog Stand
and Grass. The macOS secondary label keeps a fixed opacity tuned for
neutral backgrounds.

WindowChromeColorResolver.contrastFloored raises only the opacity until a
color reaches a minimum WCAG ratio over a known opaque backdrop. The window
appearance snapshot exposes that backdrop when the sidebar shares the
terminal background, the sidebar passes it through the environment, and the
row palette, footer icons and plain Pro badge use the floored color. The
floor is 3.5:1: the system secondary label on white is 3.9:1, so only six
saturated themes change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pick titlebar and tab bar text by WCAG contrast

The workspace titlebar and the Bonsplit tab bar used a 0.5 gamma-space
brightness cutoff while the sidebar used WCAG contrast. On saturated
mid-tones such as Hot Dog Stand (#E44330) the sidebar drew black text and
the titlebar and tabs white text at 3.2:1. Both now use the WCAG choice.
Bumps vendor/bonsplit to manaflow-ai/bonsplit#260.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep titlebar symbols at full color when the window is inactive

Hosted SF Symbols drew their pre-tinted bitmap through NSImageView, which
dims its image to about 45% in a titlebar whenever the window is not key.
The drawn sidebar-toggle glyph beside them did not dim, so the bell, new
workspace and history buttons changed color on focus loss (median 13:1 to
3.2:1 across 463 themes) and disabled arrows dropped to 1.1:1.

The bitmap already carries every intended opacity (tint, hover, disabled),
so CmuxResolvedIconImageView now draws it with a plain view that keeps
NSImageView's scale-down, centered layout. Reproduced and verified with a
standalone titlebar-accessory probe: NSImageView 116, drawn glyph 224,
custom-drawn bitmap 225 (8-bit white channel, inactive dark window).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: a theme pick applies to the appearance in use

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Theme gallery: one theme by default, cheaper cards, App Icon under Themes

A pick on the Light tab while the app was dark saved a theme the terminal
never showed, so a click looked like it did nothing. The gallery now owns
one mode: by default a pick sets both appearances and always applies.
Separate Light and Dark Themes (on when the config already holds two
themes) shows the tabs and says when the edited side is not in use;
turning it off keeps the theme the terminal shows now.

Scrolling realized about 25 views per card, including 16 swatch shapes and
an AppKit tooltip. The background and swatches are now one Canvas, colors
are resolved once at load, and cards are Equatable. Hosting 200 cards drops
from about 255 ms to 78 ms.

App Icon also appears under Themes, bound to the same key as the App row.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: the gallery highlights and writes one theme

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Theme gallery owns one theme: drop the light/dark checkbox and tabs

With separate light and dark themes, the gallery could highlight one side
while the terminal showed the other (Light: Front End Delight, Dark:
Iceberg Light, macOS dark), so picks looked desynced. The gallery now
holds exactly one theme: every pick writes it to both appearances, and the
highlighted card is the theme the terminal shows. Pairs remain available
through cmux themes set --light/--dark; picking in the gallery replaces
one. Removes the checkbox, slot tabs, not-in-use caption and badges.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix the light-theme sidebar top wash and unify Cmd-hold hint colors

The sidebar list's top fade mask reached 20 pt below the first row's
resting position, so the first row was partly transparent at rest; over a
light terminal-matched backdrop that washed the selected row's top. The
fade now ends where the first row rests, so rows fade only while scrolled
under the titlebar.

Cmd-hold hint pills drew translucent material with system label colors:
the material resolved against the window while the chrome picked its
scheme from the terminal, so a light theme in a dark window gave dark text
on a dark pill. ShortcutHintPalette is an opaque palette (10.4:1 dark,
15.1:1 light) chosen by the chrome's scheme: the sidebar row scheme for
AppKit pills, the titlebar icon scheme for titlebar hints, and the view's
scheme elsewhere. Bumps vendor/bonsplit (manaflow-ai/bonsplit#260) for the
same palette on pane tab hints.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix titlebarControlAppearance: explicit return, single @MainActor

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: Cmd-hold hints fade in unless Reduce Motion

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fade Cmd-hold hints in as well as out

Hints appeared in one frame and only faded out. The whole hint layer shows
at once across the window, so popping every pill in the same frame read as
a flash. SwiftUI hints now use an opacity transition with the 0.12 s
ease-out in both directions (none under Reduce Motion), and the AppKit
sidebar pill runs a matching opacity fade-in. Pane tab hints in Bonsplit
already animated both ways with the same curve.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Stop the Themes page shifting sideways as it opens

The gallery loaded after the page appeared, the page grew past the window,
and with legacy scrollers a vertical scroller appeared and narrowed every
card mid-view. The Settings detail scroll view now always reserves the
scroller gutter, which also removes the same shift between short and long
pages, and loaded themes are cached for the app's lifetime so reopening
Themes renders the full gallery without a background load.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: gallery follows appearance changes and picks up added themes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Address review: live appearance, refreshed theme cache, card tooltip

- The gallery follows app appearance changes while Settings is open, so
  the highlighted card and group order track the theme on screen when the
  config holds a light/dark pair.
- The theme cache shows the last parse at once, then re-reads the
  directories so added theme files appear; an empty parse is not cached.
- BitmapView invalidates its intrinsic size when the image size changes.
- Theme cards show the full name as a tooltip again (names truncate).
- TextBox search aliases drop the beta word in every language.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep TextBox docs descriptions within the 110-160 SEO bounds

Removing the beta word shortened the French and Khmer meta descriptions
below 110, so the audited selector fell back to a 109-character intro.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* ci: rerun checks with the no-full-ci label

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: expect pane exit to hide the drop preview at once

PR #15550 made leaving a pane hide its drag preview immediately and covers
that in PaneDropTargetIdentityTests. The older #15171 assertion still
expected a fade-out, so this test failed on main.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test(hermes): let the hang guard outlast the installer budget

The default installer timeout equaled the 5 s hang guard, so on a busy
runner a slow installer and the guard expired together and the wrapper
was killed before it launched Hermes. Give the installer its own 10 s
budget and the guard 15 s more.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(ci): keep media artifact commits out of PR timelines (#15826)

* Label SSH and Cloud workspaces by host in window titles and Task Manager (#15270)

* Label SSH and Cloud workspaces by host in window titles and Task Manager

Add WorkspaceHostLabel (CmuxFoundation), which derives a workspace's host
from its SSH destination or Cloud machine instead of the typed title. The
window title bar and NSWindow.title now read "title · host" for remote
workspaces, system.top workspace nodes carry a host object, and Task
Manager workspace rows show the host.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Address review: IPv6-only brackets, Port= option, title refresh order

Bracket only IPv6 hosts in detail and grouping keys, read a port set
through --ssh-option Port=, keep {activeWorkspace} host-free, refresh the
title after a Cloud binding change clears directories, return the trimmed
title when it already names the host, and document {defaultTitle}.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep host label code in existing files to avoid project churn

Move Workspace.hostLabel next to cloudVMID and the window-title tests into TabManagerTitleUpdateTests, so the PR no longer edits project.pbxproj.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(ci): update the production drift issue in place (#15838)

* test(ci): reproduce repeated drift comment noise

* fix(ci): update the production drift issue in place

* Resume Cloud terminal replays inside escape sequences (#15533)

* test: byte mirrors must match the terminal when joining or resizing mid-sequence

Add failing tests for the Cloud rendering races where a byte viewer attaches,
or the geometry owner resizes, while the daemon parser is inside an escape
sequence or UTF-8 code point. Today the attach replay drops the partial
sequence (its tail then prints as text) and a mid-sequence resize disconnects
every viewer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: replay the parser's incomplete sequence so byte mirrors resume mid-stream

A byte-mode replay reproduced the screen but not an escape sequence or UTF-8
code point the parser was inside. A viewer that attached during streaming
output printed the rest of the sequence as text, and a resize at such a byte
disconnected every viewer.

The VT boundary tracker now keeps the bytes fed since the last safe point
(up to 1 MiB) and every replay ends with them, so a fresh parser enters the
same incomplete state and the live stream completes it. Attach, resize, and
terminal-host snapshots now resync only inside a control string past that
budget; oversized direct Kitty uploads keep using their own tracker.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: send the incomplete sequence as a separate replay field

A replay that ended inside a sequence broke every consumer that writes its
own bytes after the replay: the macOS pane, the daemon's hosted mirror, the
remote cmux-tui client, and iOS all append color-override OSCs there, which
would land inside the incomplete sequence.

VtReplay.bytes now always ends at a parser boundary, and the incomplete
sequence (including a partial Kitty command) travels as pending_sequence.
Consumers write it last, after their colors and immediately before the live
stream. The attach events vt-state and resized carry it as an optional
base64 `pending` field, sent only when non-empty, so older clients see no
change. The terminal-host protocol is unchanged: hosts still snapshot and
resize only at a boundary, and single-field wires (host frames, the vt-state
command, journal checkpoints, resource reads) use the self-contained bytes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: the Cloud pane must write a replay's pending sequence after its colors

End-to-end through CloudTuiManualMirrorSession and a real manual-I/O Ghostty
surface: a vt-state or resized event whose daemon parser was inside an SGR
carries the incomplete bytes as `pending`; the live output that completes
it must render styled text, not print the sequence tail.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* feat: gate the separate pending field on terminal-pending-sequence-v1

Additive attach-event fields reach only clients that advertise them, because
the SDK decoders are strict. Attachments that advertise
terminal-pending-sequence-v1 receive the replay's incomplete sequence as
`pending`; others get it appended to the replay, which is what a raw
consumer such as chatmux-relay needs, so its special case is reverted. The
cmux-tui remote client advertises the capability and gains a test for its
replay, colors, pending ordering. Documented in the events, commands and
transports specs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: write a Cloud replay's pending sequence after the pane's colors

The macOS pane and the iOS cmux-tui client now advertise
terminal-pending-sequence-v1. The macOS frame decoder carries `pending` on
snapshot and resized frames, and CloudTuiManualMirrorSession appends it after
the replay's color OSCs, so the next output completes the sequence the
daemon's parser was inside. iOS emits it as output after the replay and its
colors.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: pending sequences must not replay bytes the parser already acted on

A string terminator's ESC dispatches the string, a new introducer abandons
the sequence before it, C0 controls inside a sequence execute at once, and
strictly invalid UTF-8 prints U+FFFD at once; replaying any of those bytes
acts on them twice. A resize inside a sequence must also keep disconnecting
viewers that did not advertise terminal-pending-sequence-v1.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: never replay bytes the parser already acted on

Review findings on the pending sequence:
- ESC, or a C1 introducer outside a UTF-8 code point, ends the sequence in
  progress (Ghostty dispatches OSC/DCS/APC strings there), so pending
  restarts at it; replaying the whole string ran it twice (OSC 52, OSC 9,
  Kitty transmits, DECRQSS).
- C0 controls inside an escape, CSI or control string execute or are
  ignored on arrival, so they are not recorded except in DCS passthrough.
- The tracker uses Ghostty's strict UTF-8 DFA ranges, so a code point
  Ghostty already replaced with U+FFFD is not pending.
- Byte viewers that did not advertise terminal-pending-sequence-v1 are
  disconnected by a resize replay with pending bytes, as before this
  change, instead of writing their color sequences into the open sequence.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add Cloud to the menu bar extra and a main-menu Cloud menu (#15822)

* Add Cloud to the menu bar: status item section and top-level Cloud menu

One shared entry tree (CloudMenuContent) renders in the status item
(AppKit) and a new main-menu Cloud menu (SwiftUI). Machine verbs come
from CloudMachineMenuVerbs, which the Cloud sidebar context menu now
uses too. CloudMenuModel reads the fleet when a menu opens, reuses a
read younger than 20s, and drops it on team switch or sign-out.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cloud menu: discard open() result, drop macro attribute on static

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cloud menu: import CmuxFoundation for the menu font

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Status item: close the Cloud section with its own separator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cloud menu: resolve the shared model inside the main actor

Default arguments evaluate in a nonisolated context, so `.shared` there
warned under Swift 6 checking and exceeded the CI warning budget.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cloud menu tests: bound the readiness wait by a deadline, not an iteration count

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cloud menu: regression test for a read that lands after a scope change

Adds an injectable scope seam (defaults to the pin store's scope) and a
test that confirms the team while the first read is in flight. Today the
result is dropped without clearing the in-flight task, so the menu stays
at Loading and never reads again.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cloud menu: never strand a read after a scope change; keep open submenus

A read whose team scope changed in flight was dropped without clearing
the in-flight task, so the menu stayed at Loading and every later open
returned early. Clear the task first, then read again for the current
scope. The status item now rebuilds its Cloud rows only when something
visible changed, so a landing read no longer collapses an open machine
submenu.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Size the stale-selection split test's window before splitting

createMainWindow copies a 320-point window left by earlier app-host
tests, so split admission (#15392) refuses the second side-by-side
split and the test fails on main for every PR that runs this suite
(seen on #15469, #15475, #15107). Same fix #15434 applied to two other
split tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Wait for the scheduled focus in the background Computer Use runtime test

The scan reports the background session before the presentation
controller's scheduled focus effect runs, so asserting two focused
terminals right after the scan signal fails whenever the test task
resumes first. It fails in main's CI and in every merge-queue run.
Poll for the focus with a deadline instead.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Expect one focus in the background Computer Use runtime test

#15311 stopped Computer Use activity from re-focusing the calling
terminal and updated ComputerUseUXTests, but this test still expected
the old second focus after a scan. It has failed in main's CI and in
every merge-queue run since. The only focus is now the one Continue in
Background makes. Replaces the previous commit's wait, which was wrong.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: fix the replay row scroll and stale hook fence tests breaking the full gate (#15240)

* Stop Cloud VT replays one row early so they do not scroll the mirror

Ghostty's formatter preserved trailing blank rows for VT replays with one
row break too many: the break ending the final row. Every replay that
ended on the last screen row scrolled its target by one row, pushing the
top row into scrollback. Bump ghostty to the fix.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: check hook projector output in hook fence tests; rustfmt the title suffix

#13299 moved list_agents onto the journal-folded agent roster. Seven hook
fence tests drive apply_agent_hook_record directly with hand-picked
sequences, which never reaches the roster fold, so list_agents came back
empty and they failed. Assert on the projector's own live record instead.

Also apply rustfmt to the OSC title suffix from #15163.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: update two core tests that main's journal changes left stale

#13299 narrowed the forced resource patch failure trigger to journal rows
that carry a resource revision, so a failed topology close now commits its
failure outcome instead of going indeterminate. Expect operation.failed on
the first attempt and the same error on replay.

The raw socket and hook report race test assumed the socket report always
commits first. When the hook wins, the hook-owned record retains the later
socket report without a new revision. Check one batch per committed
revision with the hook's commit last.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: expect the generic plugin validation field in the sidebar CLI test

#13299 generalized the plugin manager and reports validation errors on the
plugin field for every plugin kind.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin ghostty to main's replay row fix plus the hex escape commits

manaflow-ai/ghostty#241 landed on ghostty main as 3429f20. Pin a commit
that adds the two hex escape commits from manaflow-ai/ghostty#239 on top,
so startup input keeps its UTF-8 bytes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin the GhosttyKit checksum for fd8e62daa

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: receipted input to an exited keep-on-exit terminal is a no-op

Receipted API input (95a184a) rejected writes to an exited hosted
terminal, while keep-on-exit terminals document typing on the final
screen as a harmless no-op and the unreceipted path already drops those
bytes. terminal.input.write on a kept terminal failed with
terminal_input_delivery_failed. Treat it as a successful no-op on both
paths.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: run the plugin projection repair test against a live surface

startup_repairs_a_plugin_projection_lost_after_journal_commit restarted
the daemon and expected its local PTY terminal back. Startup adopts only
host-owned terminals and detaches the rest, so the terminal had no
surface after restart and the repair had nothing to project onto. Run
the startup reconciliation on the live surface, check a repeat is a
no-op, and check the restart restores the roster entry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cmux-tui: run the live OSC 7 cwd tests on a real PTY

Mux::new_for_test builds PTY-free surfaces that never spawn the command,
so the shell never printed its OSC 7 report and both tests timed out since
they were added in #12978.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* ci: isolate wrapper deadline regressions

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin Cloud panes to the daemon's terminal grid (#15792)

* test: byte mirrors must match the terminal when joining or resizing mid-sequence

Add failing tests for the Cloud rendering races where a byte viewer attaches,
or the geometry owner resizes, while the daemon parser is inside an escape
sequence or UTF-8 code point. Today the attach replay drops the partial
sequence (its tail then prints as text) and a mid-sequence resize disconnects
every viewer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: replay the parser's …
… shows model values

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… renderer switch

PR #16042 merged code that uses bonsplit APIs added after the branch's pin
b32f48b (TabContextAction.sizeMode*, BonsplitContrastPalette, TabPresence,
BonsplitController.popoverAnchorView), so the app failed with "type
'TabContextAction' has no member 'sizeToMyWindow'" and related errors. Pin
vendor/bonsplit to 351bfa7, the commit cmux main pins (on bonsplit main;
b32f48b is its ancestor). AgentSessionPanelView applied .id and .frame to an
if/else, which failed with "instance member 'id' cannot be used on type
'View'"; the renderer switch is now inside a Group. Native stays the default.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: agents Agent integrations (Claude Code, Codex, ACP), agent chat, hooks, status

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants