[azooz2003-bit]

#24117 hid a Mac from the iPhone app's Mac filter, Workspaces and Home in two cases:

• It was offline and another Mac of the same owner with the same name was online or seen later.
• It was unseen for 30 days.

A name is not an identity: "theoretically I could have several Macs with the same name." The duplicate it was meant to fix ("Abdulaziz's MacBook Pro (2) 39C6" offline beside "… 3EB7") came from two cmux builds on one MacBook: a deleted test build (dev.cmuxterm.app.next.iostest) and the nightly (com.cmuxterm.app.nightly.cmux-next). Each build keeps its own device id in its own Application Support folder, so each registered as its own device.

Design

Each Mac now says which computer it runs on (a machine id). The phone groups one owner's Macs by machine id and never by name.

Choice: builds stay separate devices, grouped on the phone (option b), not one shared device record (option a). One shared device id is not safe:

• Signaling. The user hub keeps one socket per device id. Two running builds with one id would close each other's socket (4000 replaced) in a loop.
• Trust. A phone pins the Mac identity key per Mac device id (PROTOCOL.md "Mac identity"). Each build keeps its key in a Keychain item named by its bundle id. Sharing one device id would either break every pin when the other build answers, or require sharing one key across builds, letting a Debug build hold the key phones trust for the release build.
• Keeping each build separate keeps pairing, approvals and removal per build, exactly as today.

What the phone does with it:

• It lists one Mac per (owner, machine id): the most recently active build (online first, then last seen, then the id).
• The other builds stay in Settings → Devices, marked "Another cmux build on this Mac", where Remove deletes them.
• A Mac with no machine id (an older host) is never folded into another.
• Macs that share a name stay separate, with the existing MacNameDisambiguation tag.
• The 30-day rule is gone.

Machine id. HMAC-SHA256 under the key cmux-mobile machine-id v1 of <owner sub> NUL <host UUID> (gethostuuid, the IOPlatformUUID), first 16 bytes in lowercase hex.

• The raw hardware id never leaves the Mac and is never logged; HostUuid's Debug is redacted.
• Every build on one Mac computes the same value without sharing a file.
• Two accounts on one Mac get unrelated ids.
• A spoofed machine id can only group the spoofer's own Macs.

The user's stale record. "… 39C6" will never register again (its build is deleted), so nothing would ever give it a machine id. hostd therefore also sends siblingDeviceIds: the device-id files of other builds in ~/Library/Application Support (<bundle>/cmux-mobile-host, <bundle>/cnx-host, at most 16).

• The Worker gives the registering Mac's machine id to each sibling that is the caller's own Mac and has none yet. It never touches another owner's device, a phone, or a Mac that reported its own id.
• So when the nightly re-registers, 39C6 is listed as an older build of that Mac. No production rows are deleted by hand.
• hostd writes a machine-id marker beside its device id. A sibling folder whose marker names another machine (Migration Assistant, a restore) is skipped.

Changes

• hostd (Rust): machineId and siblingDeviceIds on POST /v1/devices. CMUX_MOBILE_MACHINE_ID (validated) and CMUX_MOBILE_APP_SUPPORT_DIR for tests.
• Worker:
  • devices.machine_id, migration 0003_device_machine_id (one nullable column).
  • Validation: 32 lowercase hex, Mac only. siblingDeviceIds only with a machineId, at most 16 UUIDs. Omitting machineId keeps the stored one.
  • The hub stores it. Every Mac list, hello and presence carries it, and omits the key for a Mac without one, so older clients see the same shapes.
• iPhone:
  • MacDevice.machineID; MacRoster groups by machine id.
  • Links and focus follow the listed Macs. Another build of a listed Mac still links while something names it (a Feed answer or notification of that build, touch), so its asks are answered on it.
  • Tags and Settings marks follow each team's list.
• Mac app: a Debug-only CMUX_NEXT_MOBILE_DEVICE_NAME (passed with open --env) so the rig can give two Macs one name. Release builds ignore it.
• PROTOCOL.md: "Machine id" under Identity, plus the new fields.
• verify/multimac: multimac_machine_id.py; rig.py takes MULTIMAC_DEVICE_NAME.

Migration ordering. The open rich-push worker branch adds 0003_push_settings. Whichever lands second renumbers to 0004 and takes a later journal when (now in the backend README). This migration's when is its real creation time.

Tests

The failing tests were committed first (7cb0532) and run on that commit:

• Swift: cmux_mobile_kit-test-ios.sh CmuxMobileModelTests/MacRosterTests CmuxMobileModelTests/SettingsRowsTests CmuxMobileLiveTests/MacMachineIDLinkTests, iOS simulator on mini-cmux11s. The base fails to compile: no machineID, no SettingsDeviceRows.otherBuilds.
• Rust: rbx -- cargo test --locked -p cmux-mobile-host --test machine_id. The base fails to compile: no machine_id, sibling_device_ids or DeviceRegistration.machine_id.
• Worker: vitest run test/machine-id.test.ts on a mini. 7 of 7 fail on the base: the machine id is not stored, listed or validated, and siblings are not claimed.

On the head (ca5861b4e295 and later):

• Swift (iOS 26.5 simulator, mini-cmux8s; mini-cmux11s was out of disk), all pass: CmuxMobileModelTests 173, CmuxMobileLiveTests 246, CmuxMobileChiefTests 67, CmuxMobileWorkspacesTests 101, CmuxMobileShellTests 3. New ones:
  • MacRosterTests: two builds on one Mac listed once; same-named Macs on two computers both listed; a Mac without a machine id never hidden; no 30-day rule; owner scoping; stable choice; per-team.
  • SettingsRowsTests: other builds marked, per team.
  • MacMachineIDLinkTests: one link for two builds; two links for two same-named computers; the other build links when touched; decoding.
• Rust (rbx): machine_id 7, cmux-mobile-link --lib 75, cmux-mobile-host --lib 82, all pass. clippy -D warnings on both crates is clean.
• Worker: tsc clean, vitest run 75 of 75 pass, including the hub catch-up after a missed claim.
• prepush-gate.py: no new violations.

Observed / Not run

• Observed: everything above, plus the dev deploy and smoke and the live check (comments below).
• Not run:
  • The user's own phone (no TapKit).
  • The macOS CmuxNext packages' tests. The only Mac app change is the Debug-only name override in IPhoneHostService+Wiring.swift; the fleet build compiles it.

No capture: this changes the iOS app's Mac lists, not Mac UI. The live-check stills are listed in the comment below.

Changelog

• Fixed: The iPhone app lists each Mac once even when several cmux builds run on it, and never hides a Mac because another has the same name.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

The iPhone app now identifies a Mac by its machine id rather than its name, so several cmux builds on one computer appear as one Mac, and same-named Macs on different computers stay separate. The previous behavior — hiding an offline Mac when another Mac had the same name and owner, and hiding any Mac unseen for 30 days — is gone.

• Every build on a Mac registers a machine id (HMAC-SHA256 of the owner sub and the host UUID, never the raw hardware id) and names the other builds it finds on the same machine.
• The worker stores the id (migration 0003_device_machine_id), validates it, carries it in every Mac list and presence frame, and gives a registering Mac's id to its siblings, so a deleted build's record is listed as this Mac's.
• The phone groups one owner's Macs by machine id and lists the most recently active build; other builds stay in Settings → Devices, marked "Another cmux build on this Mac", and a Mac without a machine id is never folded in.
• Builds stay separate devices: one shared device id would let two running builds close each other's signaling socket and would let a debug build hold the identity key phones pin for the release build.
• Links, pickers, and online counts follow the listed Macs.
• The Mac app adds a Debug-only name override for the multimac rig, which now checks that the phone lists one Mac per computer.

Migration

• Deploy backend migration 0003_device_machine_id (one nullable column).
• If the open push-settings migration lands first, renumber this one to 0004 and take a later journal when.

^{Written for commit 2aac5fa. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 2aac5fa: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr24167 -f ref=feat-cmux-next-ios-mac-machine-id -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: Checks job structure (+1 more) is not red on the base 75673f9; do not merge until green; see lane-rules

Tour of 2aac5fa819 (run): no media. The tour job failed before the tour ran (build or setup); the run log has the output.

[blacksmith-sh]

Found 9 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp831q6pvb/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpscxc1xus/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_base_passes (main.NoticesPairTests.test_base_passes)/ test_base_passes (main.NoticesPairTests.test_base_passes)	View Logs
test_targets_outside_the_app_go_to_the_mac_canary (main.SwiftCanaryFleetCoverage.te st_targets_outside_the_app_go_to_the_mac_canary)/ test_targets_outside_the_app_go_to_the_mac_canary (main.SwiftCanaryFleetCoverage.te st_targets_outside_the_app_go_to_the_mac_canary)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[azooz2003-bit]

Review 1 (fresh correctness and security subagent) on 314e4c7: FIX, with every finding fixed in ca5861b

The reviewer read the diff only; it did not build or run tests.

#	Severity	Finding	Resolution
1	major	When two builds on one Mac are both online, MacRoster lists one (by id) and hides the other's workspaces.	Kept by design, with a fix for the ask path. The user's report wanted that Mac listed once. Settings → Devices lists the other build and marks it, and Remove still works. Order is stable: online first, then last seen, then id. Item 2 makes the hidden build reachable whenever something names it.
2	major	touch and applyLinks linked only the listed Macs: a Feed answer or notification of the hidden build never opened its link, and an open session on a build that became hidden lost it.	Fixed. dialableMacs now includes the other build while lastShown names it (set by touch, a Feed answer, a notification or an open session, and kept until idle). Focus and lists still use the listed Macs. Test theOtherBuildLinksWhenSomethingNamesIt.
3	major	Journal when 1792800000000 was ahead of the clock, so a later drizzle-kit generate could be skipped. Also, rich-push's 0003_push_settings collides on idx 3.	Fixed. when is the real creation time (1792641637765), and the dev record was corrected to match. The backend README now says: run migrations as cmux-mobile-api, and the second of two same-index branches renumbers and takes a later when.
4	minor	If the hub call fails after the database claim, later registrations return claimed: [] and the hub never learns the machine id.	Fixed. claimSiblings returns every sibling that has this machine id, claimed now or earlier, and the hub fills any row that differs. Worker test a hub that missed a claim catches up at the next registration.
5	minor	Sibling device-id files carried over by Migration Assistant would claim another Mac's record.	Fixed. hostd writes a machine-id marker beside its device id, and a sibling folder whose marker names another machine is skipped. A folder with no marker (a build from before machine ids, like 39C6) still counts. Rust test a_folder_from_another_machine_is_not_a_sibling.
6	minor	Settings marks and the same-name tag scope grouped across teams, while each team lists its own.	Fixed. MacRoster.accountMacs(teams) and SettingsDeviceRows.otherBuilds group per team (Settings rows carry teamID). Tests eachTeamListsItsOwnBuild and buildsInTwoTeamsAreNotMarked.
7	nit	CMUX_MOBILE_MACHINE_ID was not validated.	Fixed. It is normalized to 32 lowercase hex; otherwise hostd warns and uses its own id.
8	nit	HostConfig: Debug held the raw host UUID.	Fixed. HostUuid has a redacted Debug. Test the_host_uuid_never_prints.
9	nit	No log when gethostuuid gives nothing (for example in a sandbox).	Fixed. An info line says this build is listed as its own Mac.

Security, checked with no problem found:

• Claims cover only the caller's own Macs with no machine id.
• A phone, or siblings without a machine id, gets a 400. Siblings are deduplicated and capped at 16.
• SQL is parameterized.
• The raw hardware id is never sent or logged.
• The id is per owner, so it gives no cross-account linkage, and a spoofed id groups only the spoofer's own Macs.
• A Debug build gets no auth or pin advantage.

[teamleaderleo]

Bead cx-qxlew created for this PR by the cmux coordinator.

[azooz2003-bit]

Review 2 (fresh correctness and security subagent) on ca5861b: FIX, fixed in 67cb742

The reviewer confirmed that the fixes for findings 2 through 9 of review 1 are in the code. It read the code only; it ran nothing.

#	Severity	Finding	Resolution
1	major	A hidden build named once (touch) stayed linked for good while Workspaces or the Feed was open. showing(nil) counted every dialable Mac as shown and kept refreshing lastShown.	Fixed. showing(nil) now covers the listed Macs only, so the other build keeps its link only for the idle window after something names it. Test theOtherBuildIdlesOutWhileWorkspacesShows touches m2 under showing(nil), waits out idleAfter, and expects m2 closed and m1 still connected.
2	minor	A presence frame for a Mac new to the list had ownerUserID: nil, so it was not grouped until the next full list.	Fixed. The caller's hub carries only the caller's own Macs (0.10.0), so a new Mac gets the caller's id as owner unless it is a teammate's.
3	minor	Race: the hub could replace a sibling's own machine id with the claimer's.	Fixed. The hub never replaces a machine id it already has, matching the database. The catch-up test still covers a null row.
4	minor	A folder with no marker is still trusted. A Migration Assistant copy of a build from before machine ids could claim the old Mac's record.	Accepted. That record is what the cleanup has to claim (39C6 has no marker). The case is rare: it needs a pre-machine-id build migrated onto this Mac while the old Mac stays in use and never updates. The effect is limited to how the owner's own list groups. Settings still lists the record and marks it.
5	nit	The override id was written as the folder's marker.	Fixed. No marker is written for CMUX_MOBILE_MACHINE_ID.
6	nit	The sibling scan runs on every registration.	Not changed. It reads at most a few files per Application Support entry, only when hostd registers (start and reconnect).
7	nit	Settings ranks builds on the service list's presence.	Not changed. Settings applies the live presence the phone has to those rows first (SettingsDeviceRows.macs), so it ranks on the same data as Workspaces.

Tests on 67cb742:

• Swift (mini-cmux8s): Model 173, Live 247, Chief 67, Workspaces 101, Shell 3; all pass.
• Rust (rbx): machine_id 7, link 75, host 82; all pass. clippy -D warnings is clean.
• Worker: 75 of 75 pass; tsc is clean.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[azooz2003-bit]

Live check: one Mac per computer, whatever the name

Setup:

• Phone: one headless iOS 26.5 simulator on the laptop, running the Demo build of 1ec207f. Booted with simctl; Simulator.app never opened. No TapKit, no real phone.
• Macs: three hidden rig apps from two fleet builds of 67cb742 (the Mac side is unchanged after it). They are isolated, with settings passed only through open --env, and signed in to the dev account. All three register the same name, "0 mid check", through the Debug CMUX_NEXT_MOBILE_DEVICE_NAME; the computer names were not changed.
  • mini-cmux8s, rig A: com.cmuxterm.app.debug.cmux.mobile.e2e.mida, device a35c517d.
  • mini-cmux8s, rig B: com.cmuxterm.app.debug.cmux.mobile.e2e.midb, device 1ee9037f. This is a second build on the same Mac, with a different bundle id.
  • mini-cmux15, rig C: …e2e.mida, device 60f11ab0. A different Mac.
• Worker: cmux-mobile-api-dev at this branch, with migration 0003 applied to the dev database.
• Path: phone → WireGuard (TURN) → each Mac's cmux-mobile-host.
• Driver: cmux-next-ios/verify/multimac/multimac_machine_id.py.

Check	Result
Workspaces → Filter, rows with my rigs' device ids	2 rows: "0 mid check 9746" (mini-cmux8s, rig B) and "0 mid check F7FC" (mini-cmux15). Rig A is not listed. Both online.
Two different minis with the same name	Both listed, told apart by the tag.
Settings → Devices	All 3 builds listed. "0 mid check 5622" (rig A) reads "Online · Not connected · Another cmux build on this Mac · Added Oct 21".

PASS: filter True, settings True. Evidence on the laptop at ~/cmux-mobile-builds/machine-id/evidence-live/: results.json, run.log, shots/01-filter-one-row-per-computer.png, shots/02-settings-devices-every-build.png.

Deploy so far

• Dev database: 0003 applied (as the cmux-mobile-api role).
• cmux-mobile-api-dev deployed (version 953920fb). scripts/smoke.ts: 33 of 33 PASS.

Non-green checks on 1ec207f

Check	Classification
CmuxMobileKit tests (macOS swift test)	Mine, fixed in 01d60db. The new MacMachineIDLinkTests needed #if os(iOS).
cmux-next fast tier	Base. CmuxNext tests do not build: CmuxNextAppTests/HomeChiefLinkInkTests.swift:23: ambiguous use of 'display'. That file is not in this PR.
cmux-next checks	Base. The failing checks are "No fleet host names in gallery fixtures", "Checks job structure" and "Tier routing". The same job is red on the feat-cmux-next tip (run 39725144936).
link	Infrastructure. HTTP 403 patching the review comment.
nightly-guards / release-notary	Base. These are workflow guard tests; this PR changes no workflows.
risk evidence	Expected for risk:high. It clears with the review receipt.

[azooz2003-bit]

Reviews 3 to 5 (fresh correctness and security subagents)

Review 3 on 67cb742: FIX. One major finding: the /v1/me/macs poll rebuilt each Mac without its machine id and owner, so two builds on one Mac split into two again within 30 s. Fixed in 1ec207f:

• DiscoveredMac now carries both fields, keeps the team list's values when a reply leaves them out, and has a test (discoveryKeepsTheMachineID).
• Minors fixed in the same commit: the Settings fallback rows carry their team, presence uses the caller as owner, and the PROTOCOL.md wording is corrected.

Review 4 on 1ec207f: SHIP. Its minors and nits:

• Fixed in 01d60db: Team.listedMacs is now used for team online counts and dots, the sidebar and setup rows, and the new-workspace picker. The Demo driver keeps the machine id.
• Not changed:
  • Old orphan records with no machine id now show again, by design. A name is never an identity. Remove them in Settings → Devices; a still-installed build's sibling scan also claims them.
  • Sibling-scan caching: no change.

Fixed with the review 4 changes: the #if os(iOS) guard on MacMachineIDLinkTests, after the macOS swift test leg failed to compile it. The CmuxMobileKit CI job now passes.

Review 5, on the delta 1ec207f..01d60db: SHIP. Follow-ups, not blocking:

1. A remembered new-workspace Mac that is now a hidden build falls back to the first listed Mac. It should map to its computer's listed build.
2. While a hidden build holds the link, its computer may briefly have no creatable Mac in the picker.

Tests on 01d60db, iOS simulator on mini-cmux8s: Model 174, Live 247, Chief 67, Workspaces 101, Shell 3, Onboarding 3, all pass. Rust and the Worker are unchanged since their last green runs (7, 75 and 82 tests plus clippy; 75 of 75 Worker tests plus tsc).

Review (fresh subagent): SHIP at 01d60db

[azooz2003-bit]

Review (fresh subagent, correctness and security first): SHIP at 01d60db

Five independent review subagents over the PR; every finding and its resolution is in the comments above. Review 5 covered the final delta 1ec207f..01d60db after review 4 returned SHIP on 1ec207f.

[azooz2003-bit]

Review (fresh subagent, correctness first): SHIP at 75bc7bc

This reviews the merge of feat-cmux-next into the branch (75bc7bc). The PR's own diff is line-for-line identical before and after the merge. No raw team.macs use was reintroduced, no machineID field was dropped, and the migrations folder still holds only 0000 to 0003. Swift suites at this head (iOS simulator, mini-cmux8s), all passing: Model 182, Live 252, Chief 74, Workspaces 101, Shell 3.

[azooz2003-bit]

Review (fresh subagent, correctness first): SHIP at ea61581

This covers the second merge of feat-cmux-next (ea61581). The PR's own diff is line-identical: 39 files, +1466/-161. The 447 merged base commits touch nothing under cmux-next-ios/backend and add no raw team.macs use. The app compile on this head passes.

Non-green checks on this head, all base:

• cmux-next swift test: NativeTooltipGuardTests flags CmuxNextImportCards/ImportSuggestionRowView.swift (from cmux NEXT Home: the import suggestion is one glass row on the Chief's front page, never over the chat #23940). Open fixes: cmux NEXT Home: no "Bring your stuff to cmux" import row on the Chief front page #24349, cmux NEXT: no import suggestion on the New Tab or the Chief front page #24247.
• crash-class rules: check-objc-selectors flags CmuxNextDesign/HoverCards/HoverCard{IconSlot,Row}.swift (from 1231b9d).
• cmux-next checks, fast tier and nightly-guards: red on the feat-cmux-next tip too.

None of these files is in this PR.

[azooz2003-bit]

Review (fresh subagent, correctness first): SHIP at 2aac5fa

This head is another base merge by the lander (parents ea61581 and the base tip 75673f9). The PR's own added and removed lines are identical to the reviewed diff (the same check the review of ea61581 ran), and the merged base commits change nothing under cmux-next-ios/backend. The non-green checks are the base reds listed in the previous comment.

[azooz2003-bit]

Merging with a merge commit. Every non-green check on 2aac5fa is also red on the feat-cmux-next tip (run 39898799506: "No new SwiftUI", "Crash safety", "Checks job structure", "Check the app FFI pin"; the PR shows a subset of these). The swift test and crash-class reds are in ImportSuggestionRowView and HoverCard files outside this PR. The app compile and risk evidence are green, and the SHIP receipt names this exact head. next-autoland counted the base red as "its own" because it probed only one check.