Chief: release Home and stop Chief when chief.enabled is off

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/WorkspaceGroup/ControlCommandCoordinator+WorkspaceGroup.swift

@@ -229,14 +229,22 @@ extension ControlCommandCoordinator {
         guard let gid = uuid(params, "group_id") else {
             return .err(code: "invalid_params", message: "Missing or invalid group_id", data: nil)
         }
-        guard let ok = context?.controlSetWorkspaceGroupPinned(
+        let resolution = context?.controlSetWorkspaceGroupPinned(
             routing: routingSelectors(params), groupID: gid, isPinned: isPinned
-        ) else {
+        ) ?? .tabManagerUnavailable
+        switch resolution {
+        case .tabManagerUnavailable:
             return .err(code: "unavailable", message: "TabManager not available", data: nil)
+        case .notFound:
+            return .err(code: "not_found", message: "Group not found", data: .object(["group_id": .string(gid.uuidString)]))
+        case .protected(let message):
+            return .err(code: "protected", message: message, data: .object([
+                "group_id": .string(gid.uuidString),
+                "is_pinned": .bool(!isPinned),
+            ]))
+        case .applied:
+            return .ok(.object(["group_id": .string(gid.uuidString), "is_pinned": .bool(isPinned)]))
         }
-        return ok
-            ? .ok(.object(["group_id": .string(gid.uuidString), "is_pinned": .bool(isPinned)]))
-            : .err(code: "not_found", message: "Group not found", data: .object(["group_id": .string(gid.uuidString)]))
     }
 
     // MARK: - Add / Remove / Anchor

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/WorkspaceGroup/ControlWorkspaceGroupContext.swift

@@ -118,13 +118,13 @@ public protocol ControlWorkspaceGroupContext: AnyObject {
     ///   - routing: The routing selectors used for TabManager resolution.
     ///   - groupID: The group to update.
     ///   - isPinned: The new pinned state.
-    /// - Returns: `true` if the group existed and was updated, `false` if not
-    ///   found, or `nil` if no TabManager resolved.
+    /// - Returns: Whether the change applied, the group was missing, the app
+    ///   refused it, or no TabManager resolved.
     func controlSetWorkspaceGroupPinned(
         routing: ControlRoutingSelectors,
         groupID: UUID,
         isPinned: Bool
-    ) -> Bool?
+    ) -> ControlWorkspaceGroupPinResolution
 
     /// Adds a workspace to a group for `workspace.group.add`.
     ///

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/WorkspaceGroup/ControlWorkspaceGroupPinResolution.swift

@@ -0,0 +1,18 @@
+public import Foundation
+
+/// The outcome of `workspace.group.pin` / `.unpin`.
+///
+/// The legacy body reported success whenever the group existed, even when the
+/// app refused the change (a protected group such as Chief Home stays pinned),
+/// so the CLI printed `OK` for an unpin that did nothing.
+public enum ControlWorkspaceGroupPinResolution: Sendable, Equatable {
+    /// No TabManager resolved (legacy `unavailable` / "TabManager not
+    /// available").
+    case tabManagerUnavailable
+    /// The group was not found (legacy `not_found` / "Group not found").
+    case notFound
+    /// The app refused the change. Carries the app's localized reason.
+    case protected(message: String)
+    /// The group now has the requested pinned state.
+    case applied
+}

Packages/macOS/CmuxControlSocket/Tests/CmuxControlSocketTests/ControlCommandContextTestStubs.swift

@@ -260,7 +260,7 @@ extension ControlWorkspaceGroupContext {
     func controlDeleteWorkspaceGroup(routing: ControlRoutingSelectors, groupID: UUID) -> Int? { nil }
     func controlRenameWorkspaceGroup(routing: ControlRoutingSelectors, groupID: UUID, name: String) -> Bool? { nil }
     func controlSetWorkspaceGroupCollapsed(routing: ControlRoutingSelectors, groupID: UUID, isCollapsed: Bool) -> Bool? { nil }
-    func controlSetWorkspaceGroupPinned(routing: ControlRoutingSelectors, groupID: UUID, isPinned: Bool) -> Bool? { nil }
+    func controlSetWorkspaceGroupPinned(routing: ControlRoutingSelectors, groupID: UUID, isPinned: Bool) -> ControlWorkspaceGroupPinResolution { .tabManagerUnavailable }
 
     func controlAddWorkspaceToGroup(routing: ControlRoutingSelectors, groupID: UUID, workspaceID: UUID, placement: WorkspaceGroupNewPlacement?, referenceWorkspaceID: UUID?) -> ControlWorkspaceGroupAddResolution { .tabManagerUnavailable }
 

Packages/macOS/CmuxControlSocket/Tests/CmuxControlSocketTests/ControlCommandCoordinatorWorkspaceGroupSafetyTests.swift

@@ -189,6 +189,39 @@ struct ControlCommandCoordinatorWorkspaceGroupSafetyTests {
         #expect(context.deletedGroupIDs.isEmpty)
     }
 
+    @Test func refusedUnpinReportsProtectedInsteadOfOK() {
+        let context = FakeWorkspaceGroupSafetyContext()
+        context.pinResolution = .protected(message: "stays pinned")
+        let coordinator = ControlCommandCoordinator(context: context)
+        let groupID = UUID()
+
+        guard case .err(let code, let message, _) = coordinator.handle(request(
+            "workspace.group.unpin",
+            ["group_id": .string(groupID.uuidString)]
+        )) else {
+            Issue.record("a refused unpin reported success")
+            return
+        }
+
+        #expect(code == "protected")
+        #expect(message == "stays pinned")
+    }
+
+    @Test func appliedUnpinReportsTheNewState() {
+        let context = FakeWorkspaceGroupSafetyContext()
+        let coordinator = ControlCommandCoordinator(context: context)
+
+        guard case .ok(.object(let payload)) = coordinator.handle(request(
+            "workspace.group.unpin",
+            ["group_id": .string(UUID().uuidString)]
+        )) else {
+            Issue.record("an applied unpin did not succeed")
+            return
+        }
+
+        #expect(payload["is_pinned"] == .bool(false))
+    }
+
     private func request(
         _ method: String,
         _ params: [String: JSONValue] = [:]

Packages/macOS/CmuxControlSocket/Tests/CmuxControlSocketTests/FakeWorkspaceGroupSafetyContext.swift

@@ -11,6 +11,15 @@ final class FakeWorkspaceGroupSafetyContext: ControlCommandContext {
     var removeGeneratedAnchor = false
     var deletedGroupIDs: [UUID] = []
     var deleteResult = 2
+    var pinResolution: ControlWorkspaceGroupPinResolution = .applied
+
+    func controlSetWorkspaceGroupPinned(
+        routing: ControlRoutingSelectors,
+        groupID: UUID,
+        isPinned: Bool
+    ) -> ControlWorkspaceGroupPinResolution {
+        pinResolution
+    }
 
     func controlCreateWorkspaceGroup(
         routing: ControlRoutingSelectors,

Resources/Localizable.xcstrings

@@ -671652,6 +671652,65 @@
           }
         }
       }
+    },
+    "workspaceGroup.error.chiefHomeCannotUnpin": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "The Home group stays pinned while Chief is enabled"
+          }
+        },
+        "ar": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "تبقى مجموعة Home مثبّتة ما دام Chief مفعّلًا"
+          }
+        },
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Die Gruppe „Home“ bleibt angeheftet, solange Chief aktiviert ist"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "El grupo Home permanece fijado mientras Chief esté activado"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Le groupe Home reste épinglé tant que Chief est activé"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Chief が有効な間、Home グループは固定されたままです"
+          }
+        },
+        "ko": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Chief가 활성화된 동안 Home 그룹은 고정된 상태로 유지됩니다"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Chief 启用时，Home 分组会保持固定"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Chief 啟用時，Home 群組會保持釘選"
+          }
+        }
+      }
     }
   },
   "version": "1.0"

Sources/AppDelegate.swift

@@ -4331,6 +4331,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, UNUserNotificationCent
             deferBrowserPanels: true,
             workspaceCreateIdempotencyCache: TerminalController.shared.workspaceCreateIdempotencyCache
         )
+        // A snapshot saved with Chief on carries its Home; with Chief off, drop it.
+        ChiefHomeNavigation.removeHome(in: context.tabManager)
         context.restoreWindowDockSessionSnapshot(
             snapshot,
             notificationStore: notificationStore,

Sources/Chief/ChiefService+Control.swift

@@ -118,11 +118,18 @@ extension ChiefService {
     /// - Throws: ``ChiefControlFailure/unavailable(_:)`` when the Chief home could not be opened.
     func controlOwner() async throws -> ChiefConversationOwner {
         let load = controlOwnerLoad()
+        let generation = startGeneration
+        let owner: ChiefConversationOwner
         do {
-            return try await load.task.value
+            owner = try await load.task.value
         } catch {
             throw ChiefControlFailure.unavailable(startFailure ?? load.failure)
         }
+        // Chief was turned off while the load ran: that owner is shutting down.
+        guard startGeneration == generation, ChiefSettings.isEnabled else {
+            throw ChiefControlFailure.unavailable(ChiefStrings.unavailable)
+        }
+        return owner
     }
 
     /// Starts the Chief and returns its owner's load, for a caller off the
@@ -131,7 +138,7 @@ extension ChiefService {
         start()
         let failure = startFailure ?? ChiefStrings.unavailable
         if let ownerLoad { return (ownerLoad, failure) }
-        // Not reached: start() always sets the load.
+        // start() sets the load unless `chief.enabled` is off.
         return (Task<ChiefConversationOwner, any Error> { throw ChiefControlFailure.unavailable(failure) }, failure)
     }
 

Sources/Chief/ChiefService.swift

@@ -49,6 +49,9 @@ final class ChiefService {
     /// changes only with ``workingConversations``, so Observation tracks that.
     @ObservationIgnored private(set) var turnStarts: [ConversationID: ContinuousClock.Instant] = [:]
     @ObservationIgnored private var started = false
+    /// Bumped by each ``start()`` and ``stopBecauseDisabled()``; an owner load
+    /// that finishes after a stop sees a newer value and shuts itself down.
+    @ObservationIgnored private(set) var startGeneration = 0
     /// The list's preview lines by conversation (ChiefService+Previews.swift), with the row state
     /// each was read at.
     @ObservationIgnored var previewLines: [ConversationID: ChiefPreviewEntry] = [:]
@@ -125,10 +128,12 @@ final class ChiefService {
 
     /// Opens the Chief home and starts the store. Idempotent, and cheap on
     /// the main thread: the owner loads on a background task and the store
-    /// connects when it is ready.
+    /// connects when it is ready. Does nothing while `chief.enabled` is off.
     func start() {
-        guard !started else { return }
+        guard !started, ChiefSettings.isEnabled else { return }
         started = true
+        startGeneration &+= 1
+        let generation = startGeneration
         let (home, temporary) = Self.resolveHome()
         let settings = ChiefSettingsAccess().current
         engine = settings
@@ -156,13 +161,50 @@ final class ChiefService {
         Task { @MainActor [weak self] in
             do {
                 let owner = try await loading.value
-                self?.ownerLoaded(owner)
+                guard let self, self.startGeneration == generation else {
+                    await owner.shutdown()
+                    return
+                }
+                self.ownerLoaded(owner)
             } catch {
+                guard self?.startGeneration == generation else { return }
                 self?.ownerFailed(error)
             }
         }
     }
 
+    /// `chief.enabled` turned off: ends every turn and the brain's processes
+    /// and drops the store, so nothing reaches a harness until Chief is
+    /// enabled and started again. Open Chief views keep the stopped store and
+    /// can no longer send.
+    func stopBecauseDisabled() {
+        guard started else { return }
+        started = false
+        startGeneration &+= 1
+        let owner = self.owner
+        storeIfStarted?.stop()
+        storeIfStarted = nil
+        startFailure = nil
+        self.owner = nil
+        ownerLoad = nil
+        home = nil
+        allowRules = nil
+        brainSwitch = nil
+        workingWatch?.cancel()
+        workingWatch = nil
+        workingConversations = []
+        turnStarts = [:]
+        previewLines = [:]
+        previewReads = []
+        if let settingsObserver { NotificationCenter.default.removeObserver(settingsObserver) }
+        settingsObserver = nil
+        if let quitObserver { NotificationCenter.default.removeObserver(quitObserver) }
+        quitObserver = nil
+        guard let owner else { return }
+        // task-owner: one shutdown of the stopped owner; ends when its turns and processes end
+        Task.detached { await owner.shutdown() }
+    }
+
     private func ownerLoaded(_ owner: ChiefConversationOwner) {
         self.owner = owner
         for problem in owner.loadProblems { chiefServiceLog.error("load problem: \(problem, privacy: .private)") }
@@ -262,6 +304,10 @@ final class ChiefService {
     }
 
     private func applySettingsIfChanged() {
+        guard ChiefSettings.isEnabled else {
+            stopBecauseDisabled()
+            return
+        }
         let settings = ChiefSettingsAccess().current
         guard settings != engine, let brainSwitch else { return }
         engine = settings

Sources/ChiefHomeNavigation.swift

@@ -98,6 +98,48 @@ struct ChiefHomeNavigation {
         return home
     }
 
+    /// With `chief.enabled` off, removes Chief Home and unpins its group, so
+    /// a disabled Chief leaves nothing pinned in the sidebar. A Home workspace
+    /// holding only Chief panes and an empty Dock closes (a window whose only
+    /// workspace it is gets a fresh workspace first); one the user added other
+    /// panes or Dock panels to keeps them and loses only its Home pane. The
+    /// group is unpinned only alongside a removal, so a later pin by the user
+    /// stays. Automatic removal never hides conversations from the Home list.
+    static func removeHome(in manager: TabManager) {
+        guard !ChiefSettings.isEnabled, !manager.isFinalizedForWindowClose else { return }
+        guard manager.tabs.contains(where: \.holdsChiefHomePane) else { return }
+        let hiddenBefore = UserDefaults.standard.object(forKey: hiddenConversationsKey)
+        defer { UserDefaults.standard.set(hiddenBefore, forKey: hiddenConversationsKey) }
+        var removedGroupIDs: Set<UUID> = []
+        for home in manager.tabs where home.holdsChiefHomePane {
+            let groupID = home.groupId
+            let holdsOnlyChief = home.panels.values.allSatisfy { $0 is ChiefPanel }
+                && home._dockSplit?.panels.isEmpty != false
+            if holdsOnlyChief {
+                if manager.tabs.count == 1 {
+                    guard manager.addWorkspaceIfActive(select: true) != nil else { continue }
+                }
+                manager.closeWorkspace(home, recordHistory: false)
+            } else {
+                let homePanes = home.panels.values.compactMap { $0 as? ChiefPanel }.filter(\.isHome)
+                // Only the Dock holds user work: keep the main area non-empty so
+                // removing Home closes neither the workspace nor its Dock.
+                if home.panels.values.allSatisfy({ $0 is ChiefPanel }),
+                   let pane = home.bonsplitController.focusedPaneId {
+                    _ = home.newTerminalSurface(inPane: pane, focus: false)
+                }
+                home.withClosedPanelHistorySuppressed {
+                    for pane in homePanes { _ = home.closePanel(pane.id, force: true) }
+                }
+            }
+            if let groupID { removedGroupIDs.insert(groupID) }
+        }
+        for group in manager.workspaceGroups
+        where removedGroupIDs.contains(group.id) && group.externalID == homeGroupExternalID && group.isPinned {
+            manager.setWorkspaceGroupPinned(groupId: group.id, isPinned: false)
+        }
+    }
+
     /// Opens a conversation as an ordinary workspace under Home; existing views are reused.
     @discardableResult
     static func openConversation(_ id: ConversationID, in manager: TabManager, select: Bool = true) -> Workspace? {

Sources/ContentView.swift

@@ -2653,6 +2653,8 @@ struct ContentView: View {
 
         view = AnyView(view.onAppear {
             ChiefHomeNavigation.restoreConversations(in: tabManager)
+            // A session saved with Chief on restores its Home; with Chief off, drop it.
+            ChiefHomeNavigation.removeHome(in: tabManager)
             sidebarState.installVisibilityWillChangeHandler(ownerId: windowId) { isVisible in
                 if !isVisible {
                     restoreMainPanelFocusAfterAppKitSidebarHiddenIfNeeded()
@@ -2804,6 +2806,7 @@ struct ContentView: View {
                 _ = ChiefHomeNavigation.ensureHome(in: tabManager)
             } else {
                 ChiefHomeNavigation(sidebarSelectionState: sidebarSelectionState, tabManager: tabManager).leave()
+                ChiefHomeNavigation.removeHome(in: tabManager)
             }
         })
 

Sources/Panels/ChiefPanel.swift

@@ -16,6 +16,9 @@ final class ChiefPanel: Panel {
     /// Home is protected in the split tree; dragged copies are ordinary Chief panes.
     let isHome: Bool
 
+    /// Whether the split tree refuses to close this pane: canonical Home while `chief.enabled` is on.
+    var isProtectedHome: Bool { isHome && ChiefSettings.isEnabled }
+
     /// The conversation this pane shows; nil means Chief's default conversation.
     @Published var conversationID: ConversationID?