iOS: multi-Mac host switcher

Packages/CmuxMobilePairedMac/Sources/CmuxMobilePairedMac/MobilePairedMacStore.swift

@@ -196,7 +196,20 @@ public actor MobilePairedMacStore: MobilePairedMacStoring {
     public func setActive(macDeviceID: String) throws {
         try ensureReady()
         try transaction {
-            try exec("UPDATE paired_macs SET is_active = 0;")
+            // Clear the active flag only within the target Mac's own Stack-user
+            // scope, mirroring the scoped clear in `upsert`. On a shared device
+            // (more than one Stack user has pairings), switching hosts for one
+            // signed-in user must not wipe another user's active Mac, or that
+            // user fails to auto-reconnect after signing back in. `IS` is
+            // SQLite's null-safe equality, so a NULL-scoped target clears only
+            // other NULL-scoped rows.
+            try exec("""
+                UPDATE paired_macs SET is_active = 0
+                WHERE stack_user_id IS (
+                    SELECT stack_user_id FROM paired_macs WHERE mac_device_id = ?
+                );
+                """,
+                binding: [.text(macDeviceID)])
             try exec("UPDATE paired_macs SET is_active = 1 WHERE mac_device_id = ?;",
                      binding: [.text(macDeviceID)])
         }

Packages/CmuxMobilePairedMac/Tests/CmuxMobilePairedMacTests/MobilePairedMacStoreTests.swift

@@ -80,6 +80,28 @@ import Testing
         #expect(active.first?.macDeviceID == "mac-c")
     }
 
+    @Test func setActiveScopesClearToTargetStackUser() async throws {
+        let (store, directory) = try makeStore()
+        defer { try? FileManager.default.removeItem(at: directory) }
+
+        let route = try CmxAttachRoute(
+            id: "tailscale",
+            kind: .tailscale,
+            endpoint: .hostPort(host: "100.64.0.3", port: 8443)
+        )
+        // user-1 has two macs, user-2 one; each starts active within its scope.
+        try await store.upsert(macDeviceID: "mac-a1", displayName: nil, routes: [route], markActive: true, stackUserID: "user-1", now: Date())
+        try await store.upsert(macDeviceID: "mac-a2", displayName: nil, routes: [route], markActive: true, stackUserID: "user-1", now: Date())
+        try await store.upsert(macDeviceID: "mac-b", displayName: nil, routes: [route], markActive: true, stackUserID: "user-2", now: Date())
+
+        // Switching user-1's active Mac must not disturb user-2's active pairing.
+        try await store.setActive(macDeviceID: "mac-a1")
+
+        let activeUser1 = try await store.loadAll(stackUserID: "user-1").filter(\.isActive)
+        #expect(activeUser1.map(\.macDeviceID) == ["mac-a1"])
+        #expect(try await store.activeMac(stackUserID: "user-2")?.macDeviceID == "mac-b")
+    }
+
     @Test func removePersistsAcrossReopen() async throws {
         let directory = FileManager.default.temporaryDirectory
             .appendingPathComponent(UUID().uuidString, isDirectory: true)

Packages/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift

@@ -246,6 +246,9 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         connectionError = nil
         activeTicket = nil
         activeRoute = nil
+        // Drop the cached paired Macs so the next signed-in user never sees the
+        // previous user's hosts in the switcher.
+        pairedMacs = []
         replaceRemoteClient(with: nil)
         cancelRemoteOperationTasks()
         rawTerminalInputBuffer.clear()
@@ -568,6 +571,108 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         return connectionState == .connected
     }
 
+    // MARK: - Paired Mac switching
+
+    /// Every Mac paired with this device, for the host switcher. Refreshed via
+    /// ``loadPairedMacs()`` and after switch/forget. Cleared on sign-out so a
+    /// shared device never shows the previous user's Macs. The active row is
+    /// marked by each ``MobilePairedMac/isActive`` flag (the live connection's
+    /// attach ticket carries a transient manual id, so it is not a reliable
+    /// active marker on its own).
+    public private(set) var pairedMacs: [MobilePairedMac] = []
+
+    /// Reload ``pairedMacs`` from the store, scoped to the signed-in Stack user.
+    ///
+    /// A missing current Stack user id yields no pairings rather than falling
+    /// back to the unscoped all-users query, so a shared device never exposes
+    /// another user's Macs in the switcher.
+    public func loadPairedMacs() async {
+        guard let pairedMacStore, isSignedIn,
+              let stackUserID = identityProvider?.currentUserID else {
+            pairedMacs = []
+            return
+        }
+        let loaded: [MobilePairedMac]
+        do {
+            loaded = try await pairedMacStore.loadAll(stackUserID: stackUserID)
+        } catch {
+            mobileShellLog.error("paired mac store loadAll failed: \(String(describing: error), privacy: .public)")
+            return
+        }
+        // The await above suspended the main actor; a sign-out or user switch may
+        // have run meanwhile. Discard the result unless we are still the same
+        // signed-in user, so a slow load can never repopulate another user's hosts.
+        guard isSignedIn, identityProvider?.currentUserID == stackUserID else {
+            pairedMacs = []
+            return
+        }
+        pairedMacs = loaded
+    }
+
+    /// Switch the live connection to `macDeviceID`, persisting it as the active
+    /// pairing only on a successful connect.
+    ///
+    /// The underlying connect path is destructive (it replaces the live client),
+    /// so a failed switch to an offline/stale Mac would drop the working session.
+    /// To avoid stranding the user, the store's active row is only updated on a
+    /// successful connect, and on failure the previously-active Mac (still the
+    /// active row) is reconnected. A no-op when already connected to that Mac.
+    /// - Parameter macDeviceID: The stored Mac to switch to.
+    public func switchToMac(macDeviceID: String) async {
+        guard let pairedMacStore,
+              let target = pairedMacs.first(where: { $0.macDeviceID == macDeviceID }) else { return }
+        if target.isActive, connectionState == .connected { return }
+        // The currently-active Mac to fall back to if the switch fails.
+        let previousActive = pairedMacs.first { $0.isActive && $0.macDeviceID != macDeviceID }
+        let supportedKinds = runtime?.supportedRouteKinds ?? []
+        guard let (host, port) = Self.firstReconnectHostPortRoute(
+            target.routes,
+            supportedKinds: supportedKinds
+        ), let normalizedHost = MobileShellRouteAuthPolicy.normalizedManualHost(host) else {
+            mobileShellLog.error("switchToMac: no reconnectable route mac=\(macDeviceID, privacy: .public)")
+            return
+        }
+        await connectManualHost(name: target.displayName ?? host, host: host, port: port)
+        // Persist the active row only if the live connection is to THIS Mac's
+        // route. A different switch tapped while this connect was in flight
+        // supersedes it via `beginPairingAttempt`, leaving `connectionState`
+        // `.connected` for the other Mac; matching the live route prevents this
+        // superseded task from persisting a stale active target.
+        if connectionState == .connected,
+           case let .hostPort(liveHost, livePort)? = activeRoute?.endpoint,
+           liveHost == normalizedHost, livePort == port {
+            do {
+                try await pairedMacStore.setActive(macDeviceID: macDeviceID)
+            } catch {
+                mobileShellLog.error("paired mac store setActive failed mac=\(macDeviceID, privacy: .public) error=\(String(describing: error), privacy: .public)")
+            }
+        } else if previousActive != nil, connectionState != .connected {
+            // The switch did not connect and the destructive connect path dropped
+            // the previous session; reconnect to the still-active previous Mac so
+            // the user is not left stranded on a failed switch.
+            _ = await reconnectActiveMacIfAvailable(stackUserID: identityProvider?.currentUserID)
+        }
+        await loadPairedMacs()
+    }
+
+    /// Forget `macDeviceID`. Always removes the selected stored row by its real
+    /// id, and additionally tears down the live connection when that row is the
+    /// active one (the live attach ticket can carry a transient manual id, so we
+    /// must not rely on it to identify the row being forgotten).
+    /// - Parameter macDeviceID: The stored Mac to forget.
+    public func forgetMac(macDeviceID: String) async {
+        let isActiveMac = pairedMacs.first(where: { $0.macDeviceID == macDeviceID })?.isActive ?? false
+        if isActiveMac, connectionState == .connected {
+            disconnectLiveConnection()
+        }
+        do {
+            try await pairedMacStore?.remove(macDeviceID: macDeviceID)
+        } catch {
+            mobileShellLog.error("paired mac store remove failed mac=\(macDeviceID, privacy: .public) error=\(String(describing: error), privacy: .public)")
+        }
+        await loadPairedMacs()
+    }
+
     static func firstReconnectHostPortRoute(
         _ routes: [CmxAttachRoute],
         supportedKinds: [CmxAttachTransportKind]
@@ -672,14 +777,23 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
     /// session starts from a fresh QR scan. Clears in-memory state and the
     /// persisted active flag (other macs in SQLite stay, but none are marked
     /// active so reconnect-on-launch is a no-op until the user pairs again).
-    public func disconnectAndForgetActiveMac() {
-        let staleMacID = activeTicket?.macDeviceID
+    /// Tear down the live connection and reset connection UI state, without
+    /// touching the paired-Mac store.
+    private func disconnectLiveConnection() {
         pairingAttemptID = UUID()
         connectionError = nil
         connectionRequiresReauth = false
         connectionState = .disconnected
         macConnectionStatus = .unavailable
         clearRemoteConnectionContext()
+    }
+
+    /// Disconnect the live connection and forget the currently-active paired Mac
+    /// (drops it from the store), returning the UI to the pairing flow. Backs the
+    /// "Rescan QR" action.
+    public func disconnectAndForgetActiveMac() {
+        let staleMacID = activeTicket?.macDeviceID
+        disconnectLiveConnection()
         if let pairedMacStore, let macID = staleMacID {
             // Fire-and-forget: forgetting the persisted mac is cleanup that must
             // not block the synchronous disconnect UI state update above.

Packages/CmuxMobileShellUI/Package.swift

@@ -18,6 +18,7 @@ let package = Package(
         .package(path: "../CmuxAuthRuntime"),
         .package(path: "../CmuxMobileCamera"),
         .package(path: "../CmuxMobileDiagnostics"),
+        .package(path: "../CmuxMobilePairedMac"),
         .package(path: "../CmuxMobileShell"),
         .package(path: "../CmuxMobileShellModel"),
         .package(path: "../CmuxMobileSupport"),
@@ -33,6 +34,7 @@ let package = Package(
                 "CmuxAuthRuntime",
                 "CmuxMobileCamera",
                 "CmuxMobileDiagnostics",
+                "CmuxMobilePairedMac",
                 "CmuxMobileShell",
                 "CmuxMobileShellModel",
                 "CmuxMobileSupport",

Packages/CmuxMobileShellUI/Sources/CmuxMobileShellUI/MobileHostPickerView.swift

@@ -0,0 +1,111 @@
+#if os(iOS)
+import CmuxMobilePairedMac
+import CmuxMobileShell
+import CmuxMobileSupport
+import SwiftUI
+
+/// Lets the user switch which paired Mac this device controls, and pair another.
+///
+/// Lists every Mac paired with this device (from the on-device store), marks the
+/// one the live connection targets, switches on tap, forgets on swipe, and pairs
+/// a new Mac by scanning its QR code without dropping the others.
+struct MobileHostPickerView: View {
+    @Bindable var store: CMUXMobileShellStore
+    @Environment(\.dismiss) private var dismiss
+    @State private var showingScanner = false
+
+    var body: some View {
+        NavigationStack {
+            List {
+                Section {
+                    if store.pairedMacs.isEmpty {
+                        Text(L10n.string("mobile.hostPicker.empty", defaultValue: "No paired Macs yet."))
+                            .foregroundStyle(.secondary)
+                    }
+                    ForEach(store.pairedMacs) { mac in
+                        macRow(mac)
+                    }
+                } header: {
+                    Text(L10n.string("mobile.hostPicker.header", defaultValue: "Paired Macs"))
+                } footer: {
+                    Text(L10n.string(
+                        "mobile.hostPicker.footer",
+                        defaultValue: "Switch which Mac this device controls. Pairing another Mac keeps the others, so you can hop between them."
+                    ))
+                }
+
+                Section {
+                    Button {
+                        showingScanner = true
+                    } label: {
+                        Label(
+                            L10n.string("mobile.hostPicker.addMac", defaultValue: "Pair Another Mac"),
+                            systemImage: "plus"
+                        )
+                    }
+                    .accessibilityIdentifier("MobileHostPickerAddMac")
+                }
+            }
+            .navigationTitle(L10n.string("mobile.hostPicker.title", defaultValue: "Switch Mac"))
+            .navigationBarTitleDisplayMode(.inline)
+            .toolbar {
+                ToolbarItem(placement: .confirmationAction) {
+                    Button(L10n.string("mobile.common.done", defaultValue: "Done")) {
+                        dismiss()
+                    }
+                    .accessibilityIdentifier("MobileHostPickerDone")
+                }
+            }
+            .task { await store.loadPairedMacs() }
+            .sheet(isPresented: $showingScanner) {
+                MobilePairingScannerSheet { code in
+                    showingScanner = false
+                    Task {
+                        _ = await store.connectPairingURL(code)
+                        await store.loadPairedMacs()
+                        dismiss()
+                    }
+                }
+            }
+        }
+        .accessibilityIdentifier("MobileHostPicker")
+    }
+
+    @ViewBuilder
+    private func macRow(_ mac: MobilePairedMac) -> some View {
+        let isActive = mac.isActive
+        Button {
+            Task { await store.switchToMac(macDeviceID: mac.macDeviceID) }
+        } label: {
+            HStack(spacing: 12) {
+                Image(systemName: "desktopcomputer")
+                    .foregroundStyle(.secondary)
+                VStack(alignment: .leading, spacing: 2) {
+                    Text(mac.displayName ?? mac.macDeviceID)
+                        .foregroundStyle(.primary)
+                    Text(mac.lastSeenAt, format: .relative(presentation: .named))
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                Spacer(minLength: 8)
+                if isActive {
+                    Image(systemName: "checkmark")
+                        .foregroundStyle(Color.accentColor)
+                        .accessibilityLabel(L10n.string("mobile.hostPicker.active", defaultValue: "Active"))
+                }
+            }
+            .contentShape(Rectangle())
+        }
+        .buttonStyle(.plain)
+        .accessibilityIdentifier("MobileHostPickerRow-\(mac.macDeviceID)")
+        .swipeActions(edge: .trailing) {
+            Button(role: .destructive) {
+                Task { await store.forgetMac(macDeviceID: mac.macDeviceID) }
+            } label: {
+                Label(L10n.string("mobile.hostPicker.forget", defaultValue: "Forget"), systemImage: "trash")
+            }
+            .accessibilityIdentifier("MobileHostPickerForget-\(mac.macDeviceID)")
+        }
+    }
+}
+#endif

Packages/CmuxMobileShellUI/Sources/CmuxMobileShellUI/MobileSettingsView.swift

@@ -1,5 +1,6 @@
 #if os(iOS)
 import CmuxAuthRuntime
+import CmuxMobileShell
 import CmuxMobileSupport
 import SwiftUI
 
@@ -13,9 +14,13 @@ struct MobileSettingsView: View {
     let connectedHostName: String
     let rescanQR: (() -> Void)?
     let signOut: (() -> Void)?
+    /// The shell store, used to drive the multi-Mac switcher. `nil` in previews,
+    /// where the "Switch Mac" entry is hidden.
+    var store: CMUXMobileShellStore?
 
     @Environment(\.dismiss) private var dismiss
     @State private var showingShortcuts = false
+    @State private var showingHostPicker = false
 
     var body: some View {
         NavigationStack {
@@ -58,6 +63,17 @@ struct MobileSettingsView: View {
                             value: connectedHostName
                         )
                     }
+                    if store != nil {
+                        Button {
+                            showingHostPicker = true
+                        } label: {
+                            Label(
+                                L10n.string("mobile.settings.switchMac", defaultValue: "Switch Mac"),
+                                systemImage: "macbook.and.iphone"
+                            )
+                        }
+                        .accessibilityIdentifier("MobileSettingsSwitchMac")
+                    }
                     if let rescanQR {
                         Button {
                             rescanQR()
@@ -117,6 +133,11 @@ struct MobileSettingsView: View {
             .sheet(isPresented: $showingShortcuts) {
                 TerminalShortcutsSettingsView()
             }
+            .sheet(isPresented: $showingHostPicker) {
+                if let store {
+                    MobileHostPickerView(store: store)
+                }
+            }
         }
         .accessibilityIdentifier("MobileSettingsView")
     }

Packages/CmuxMobileShellUI/Sources/CmuxMobileShellUI/WorkspaceListView.swift

@@ -1,3 +1,4 @@
+import CmuxMobileShell
 import CmuxMobileShellModel
 import CmuxMobileSupport
 import SwiftUI
@@ -20,6 +21,9 @@ struct WorkspaceListView: View {
     /// previews), the menu is hidden.
     var rescanQR: (() -> Void)?
     var signOut: (() -> Void)?
+    /// The shell store, forwarded to Settings to drive the multi-Mac switcher.
+    /// `nil` in previews.
+    var store: CMUXMobileShellStore?
     /// Optional: rename a workspace on the Mac. When present, each row offers a
     /// Rename context-menu action.
     var renameWorkspace: ((MobileWorkspacePreview.ID, String) -> Void)?
@@ -107,7 +111,8 @@ struct WorkspaceListView: View {
             MobileSettingsView(
                 connectedHostName: host,
                 rescanQR: rescanQR,
-                signOut: signOut
+                signOut: signOut,
+                store: store
             )
         }
         #endif