[teamleaderleo]

Summary

If something deletes the control socket file while cmux NEXT is running, the app now binds a new socket at the same path. Until now, no client could connect again until a relaunch.

The readiness soak (hq#1870) hit this two nights running. On the soak host, a process outside the app removed /tmp/cmux-debug-<tag>.sock at about 11:00Z. The app kept listening on the unlinked inode, so every later connect got ENOENT. Agent turns kept completing because they go through acpmux, but the CLI and automation lost the app for the rest of the session.

How it works:

• ControlSocketPathWatch watches the socket's directory with kqueue, with no timer. On each directory change it runs one lstat on the server's accept queue. It asks the server for a new listener only when nothing is at the path. Because the restore runs on the accept queue, it never races an accept that is pausing on descriptor exhaustion.
• The new socket is bound the same way as the first one: in a private staging directory, with its mode set, then renamex_np(..., RENAME_EXCL). A path that another server or a file took in the meantime is never replaced.
• The new listener is resumed before it is published. If a stop lands mid-restore, the new listener is resumed, cancelled, and its file removed.
• A restore that keeps failing would trigger itself again, because its bind stages a directory beside the path. After 3 failures in a row, the watch ignores events and retries on a DemandTimer with Backoff from 1 s to 60 s until a restore works.
• stop still unlinks only this server's own inode, and connections that were open across the delete keep working.
• The socket-file helpers move unchanged into ControlSocketServer+File.swift, which keeps the server file under its 400-line budget. The stale-socket probe now sets SO_NOSIGPIPE, so the crash-safety check passes for that file.
• plans/cmux-next/idle-wakeups.md gets a row for the new wake source.

Testing

New suite ControlSocketPathRestoreTests, driven through the real Unix socket on the fleet (run-swift-testing-suites.sh Packages/macOS/CmuxNext, Xcode 26.6):

• aDeletedSocketFileComesBackWithItsMode: deletes the file under a running server and expects:

  • a new connect gets PONG within 5 s;
  • the file is back as a socket with the access mode's permissions;
  • an open connection keeps working.

  It then deletes the file again, and finally checks that stop removes it.

  • Red at b1e08b9: 6 issues.
  • Green.

• aPathAnotherServerTookIsLeftAlone: a plain listener's socket is renamed over the path. The test expects the path to keep that inode, including after the first server stops.

• aStopDuringARestoreClosesTheNewSocket: the restore's bind calls stop().

  • Red at fd614cb: the test process crashed in libdispatch (a never-resumed source was cancelled and released).
  • Green.

• restoresThatKeepFailingBackOffAndStillComeBack: binds fail after the delete. The test expects at most 12 attempts in 2 s, then a PONG once binds work again.

  • Red at 1e04356: the watch had stopped for good, so there was no PONG within 10 s.
  • Green at 8dd3953: 3.3 s, and every suite passed.

Local checks: check-concurrency.sh, check-crash-safety.sh, crash_ratchet.py and check-no-godfiles.sh show nothing new.

Changelog

Fixed: cmux NEXT's control socket comes back on its own when something deletes the socket file, so the CLI reconnects without relaunching the app

Proof

No UI. The socket-level tests above are the proof.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

If the control socket file is deleted while cmux NEXT is running, the app now rebinds a socket at the same path instead of keeping the listener on the unlinked inode, where no client could connect until a relaunch. The readiness soak (hq#1870) hit this when an external /tmp sweep removed /tmp/cmux-debug-<tag>.sock.

• ControlSocketPathWatch watches the socket's directory with kqueue (no timer) and runs its check inline on the accept queue, so a restore never races an accept pausing on descriptor exhaustion.
• It asks the server for a new listener only when nothing is at the path; the socket is bound like the first (staging dir, mode, renamex_np(..., RENAME_EXCL)), so a path another server or a file took is never replaced.
• The new listener is resumed before it is published; a stop landing mid-restore cancels it and removes its file. After three failed restores in a row the watch ignores events and retries with a backoff capped at 60 s until one works. stop still unlinks only this server's own inode, and connections open across the delete keep working.
• Socket-file helpers moved to ControlSocketServer+File.swift; the stale-socket probe sets SO_NOSIGPIPE as the crash-safety check requires.
• New ControlSocketPathRestoreTests drive the real Unix socket: restoring the file with its mode, leaving a path another server took alone, closing a new socket when a stop lands mid-restore, and backing off when restores keep failing. The test client stores its descriptor only after a connect succeeds, so a failed connect's deinit never closes a descriptor another suite's listener holds.

^{Written for commit 2358d24. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4abc392d-f1c8-4ca9-be2f-75e27644bb89

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

Bead cx-s5fig created for this PR by the cmux coordinator.

[github-actions]

Not verified: macOS jobs did not run: compile and app tests were skipped on 2358d24ed6; ci-status is green without them.

CI passes on 2358d24ed6 (run 38562971242 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

cmux-next tour of 2358d24ed6731a8b10d6c3409858a066c79883ba (run)

The tour job failed before the tour ran (build or setup); the run log has the output.

The tour produced no media.

_{Tours are data in scripts/cmux-next/media/tours: add a step or a tour file to show your feature.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review notes (non-blocking), carried into the follow-up socket-move PR #20508:

1. ControlSocketPathWatch.start() does nothing when open(parent, O_EVTONLY) fails. cmux-next: keep the control socket in ~/.local/state/cmux, with a /tmp link #20508 will log that once so a dead watch is visible.
2. On /tmp every directory write by any process costs one lstat on the accept queue. Dispatch coalesces these, and the idle-wakeups row already records the cost. cmux-next: keep the control socket in ~/.local/state/cmux, with a /tmp link #20508 moves the socket to a per-user state folder, which keeps that directory quiet.

🤖 Generated with Claude Code