CmuxIPCService: extract AppDelegate multi-window CLI routing (MultiWindowRouter behind MultiWindowRouting)

.github/swift-file-length-budget.tsv

@@ -4,7 +4,7 @@
 33285	CLI/cmux.swift
 19990	Sources/Workspace.swift
 19225	Sources/ContentView.swift
-18118	Sources/AppDelegate.swift
+18077	Sources/AppDelegate.swift
 16075	Sources/GhosttyTerminalView.swift
 14610	Sources/TerminalController.swift
 13606	Sources/Panels/BrowserPanel.swift

Packages/CmuxIPCService/Package.swift

@@ -0,0 +1,35 @@
+// swift-tools-version: 6.0
+
+import PackageDescription
+
+let package = Package(
+    name: "CmuxIPCService",
+    platforms: [
+        .macOS(.v14),
+    ],
+    products: [
+        .library(
+            name: "CmuxIPCService",
+            targets: ["CmuxIPCService"]
+        ),
+    ],
+    targets: [
+        .target(
+            name: "CmuxIPCService",
+            swiftSettings: [
+                .swiftLanguageMode(.v6),
+                .enableUpcomingFeature("ExistentialAny"),
+                .enableUpcomingFeature("InternalImportsByDefault"),
+            ]
+        ),
+        .testTarget(
+            name: "CmuxIPCServiceTests",
+            dependencies: ["CmuxIPCService"],
+            swiftSettings: [
+                .swiftLanguageMode(.v6),
+                .enableUpcomingFeature("ExistentialAny"),
+                .enableUpcomingFeature("InternalImportsByDefault"),
+            ]
+        ),
+    ]
+)

Packages/CmuxIPCService/Sources/CmuxIPCService/MultiWindowRouteLaunchError.swift

@@ -0,0 +1,22 @@
+/// Thrown by ``MultiWindowRouting/route(arguments:)`` when the cmux CLI
+/// process could not be launched at all (the executable is missing, not
+/// executable, or `posix_spawn` failed).
+///
+/// This is the only error the route throws; once the CLI launches, every
+/// outcome (including non-zero exit) is data in ``MultiWindowRouteResult``.
+/// `description` preserves the underlying Foundation error's
+/// `String(describing:)` text verbatim, so callers that re-encode the legacy
+/// `"-1"` capture (`String(describing: error)` into the UI-test data file)
+/// produce byte-identical output to the pre-extraction code.
+public struct MultiWindowRouteLaunchError: Error, Sendable, Equatable, CustomStringConvertible {
+    /// The underlying launch error rendered with `String(describing:)`,
+    /// preserved verbatim for the legacy capture encoding.
+    public let description: String
+
+    /// Creates a launch error.
+    /// - Parameter description: The underlying error's `String(describing:)`
+    ///   text.
+    public init(description: String) {
+        self.description = description
+    }
+}

Packages/CmuxIPCService/Sources/CmuxIPCService/MultiWindowRouteResult.swift

@@ -0,0 +1,31 @@
+/// The captured outcome of one multi-window route call through the bundled
+/// cmux CLI.
+///
+/// Produced by ``MultiWindowRouting/route(arguments:)`` once the CLI process
+/// launched and exited (a process that never launched throws
+/// ``MultiWindowRouteLaunchError`` instead). The streams are UTF-8 decoded
+/// with non-decodable output collapsing to the empty string, matching the
+/// legacy AppDelegate capture exactly; consumers (the multi-window UI-test
+/// scaffolding) write `String(terminationStatus)` and the streams verbatim
+/// into the shared test-data file.
+public struct MultiWindowRouteResult: Sendable, Equatable {
+    /// The CLI process termination status.
+    public let terminationStatus: Int32
+    /// The captured standard output, UTF-8 decoded; empty when absent or not
+    /// valid UTF-8.
+    public let stdout: String
+    /// The captured standard error, UTF-8 decoded; empty when absent or not
+    /// valid UTF-8.
+    public let stderr: String
+
+    /// Creates a route result.
+    /// - Parameters:
+    ///   - terminationStatus: The CLI process termination status.
+    ///   - stdout: The captured standard output.
+    ///   - stderr: The captured standard error.
+    public init(terminationStatus: Int32, stdout: String, stderr: String) {
+        self.terminationStatus = terminationStatus
+        self.stdout = stdout
+        self.stderr = stderr
+    }
+}

Packages/CmuxIPCService/Sources/CmuxIPCService/MultiWindowRouter.swift

@@ -0,0 +1,146 @@
+public import Foundation
+import Darwin
+import os
+
+/// Diagnostics for partial pipe reads; mirrors the app-side ProcessPipeReader
+/// warning the lifted code emitted (file-scoped `os.Logger` per house style).
+nonisolated private let logger = Logger(subsystem: "com.cmuxterm.app", category: "MultiWindowRouter")
+
+/// Runs the bundled cmux CLI against the app's control socket to route a
+/// request to a specific window, capturing its output.
+///
+/// This is the production ``MultiWindowRouting``, extracted from AppDelegate's
+/// `runMultiWindowRouteCLI`: it spawns the CLI with an implicit
+/// `--socket <path>` argument pair and an explicit child environment (the
+/// child inherits nothing beyond what is injected), then captures termination
+/// status and both streams. A launch failure throws
+/// ``MultiWindowRouteLaunchError``; a launched CLI always returns a result.
+///
+/// Isolation design: the router holds only immutable `Sendable` configuration
+/// (CLI URL, socket path, environment), so there is no state to protect and an
+/// actor would serialize unrelated route calls for no benefit (the same ruling
+/// that made `CmuxProcess.CommandRunner` a stateless struct). The legacy
+/// synchronous `waitUntilExit` is replaced by a `terminationHandler`
+/// continuation, so `route` never blocks its calling thread; the two stream
+/// readers run on detached tasks (the `CommandRunner` pattern) so a stream
+/// larger than the pipe buffer cannot deadlock the child against an unread
+/// pipe.
+public struct MultiWindowRouter: MultiWindowRouting, Sendable {
+    private let cliURL: URL
+    private let socketPath: String
+    // Environment is value-like once copied; stored immutable so the struct
+    // stays Sendable.
+    private let environment: [String: String]
+
+    /// Creates a router for one CLI binary, socket, and child environment.
+    /// - Parameters:
+    ///   - cliURL: The bundled cmux CLI executable.
+    ///   - socketPath: The control socket path passed to every call as
+    ///     `--socket <path>`.
+    ///   - environment: The complete child process environment (replaces, not
+    ///     merges with, the app's environment).
+    public init(cliURL: URL, socketPath: String, environment: [String: String]) {
+        self.cliURL = cliURL
+        self.socketPath = socketPath
+        self.environment = environment
+    }
+
+    /// Runs the CLI with `arguments` and captures its outcome.
+    ///
+    /// Implements ``MultiWindowRouting/route(arguments:)``; see the protocol
+    /// for the full contract and the type docs for the isolation rationale.
+    public func route(arguments: [String]) async throws -> MultiWindowRouteResult {
+        let process = Process()
+        process.executableURL = cliURL
+        process.arguments = ["--socket", socketPath] + arguments
+        process.environment = environment
+
+        let stdoutPipe = Pipe()
+        let stderrPipe = Pipe()
+        process.standardOutput = stdoutPipe
+        process.standardError = stderrPipe
+
+        // Drain both streams on detached tasks, keyed by raw fd so no
+        // non-Sendable FileHandle crosses the task boundary. Started before the
+        // spawn so a child that fills a pipe buffer can never deadlock against
+        // an unread pipe; the reads block until data or EOF arrives.
+        let stdoutDescriptor = stdoutPipe.fileHandleForReading.fileDescriptor
+        let stderrDescriptor = stderrPipe.fileHandleForReading.fileDescriptor
+        let stdoutReader = Task.detached {
+            self.readDataToEndOfFileOrEmpty(fromFileDescriptor: stdoutDescriptor)
+        }
+        let stderrReader = Task.detached {
+            self.readDataToEndOfFileOrEmpty(fromFileDescriptor: stderrDescriptor)
+        }
+
+        let terminationStatus: Int32
+        do {
+            terminationStatus = try await withCheckedThrowingContinuation { continuation in
+                process.terminationHandler = { finished in
+                    continuation.resume(returning: finished.terminationStatus)
+                }
+                do {
+                    try process.run()
+                    // Close the parent's write ends so the readers see EOF once
+                    // the child closes its copies.
+                    try? stdoutPipe.fileHandleForWriting.close()
+                    try? stderrPipe.fileHandleForWriting.close()
+                } catch {
+                    process.terminationHandler = nil
+                    try? stdoutPipe.fileHandleForWriting.close()
+                    try? stderrPipe.fileHandleForWriting.close()
+                    continuation.resume(
+                        throwing: MultiWindowRouteLaunchError(description: String(describing: error))
+                    )
+                }
+            }
+        } catch {
+            // The write ends are closed, so the readers finish on EOF; await
+            // them before rethrowing so no detached work outlives the call.
+            _ = await stdoutReader.value
+            _ = await stderrReader.value
+            throw error
+        }
+
+        let stdoutData = await stdoutReader.value
+        let stderrData = await stderrReader.value
+        return MultiWindowRouteResult(
+            terminationStatus: terminationStatus,
+            stdout: String(data: stdoutData, encoding: .utf8) ?? "",
+            stderr: String(data: stderrData, encoding: .utf8) ?? ""
+        )
+    }
+
+    /// Reads `fileDescriptor` to end-of-file, retrying `EINTR`, returning
+    /// partial data (with a logged warning) on a read error. Carried over from
+    /// the app-side `ProcessPipeReader.readDataToEndOfFileOrEmpty`, which stays
+    /// app-target for its other callers. Operates on the raw descriptor so the
+    /// detached reader tasks capture only `Sendable` values (`self` is a
+    /// Sendable value type).
+    private func readDataToEndOfFileOrEmpty(fromFileDescriptor fileDescriptor: Int32) -> Data {
+        let chunkSize = 64 * 1024
+        var data = Data()
+        var buffer = [UInt8](repeating: 0, count: chunkSize)
+        while true {
+            let bytesRead = buffer.withUnsafeMutableBytes { pointer -> Int in
+                guard let baseAddress = pointer.baseAddress else { return 0 }
+                return Darwin.read(fileDescriptor, baseAddress, chunkSize)
+            }
+            if bytesRead > 0 {
+                data.append(contentsOf: buffer[0..<bytesRead])
+                continue
+            }
+            if bytesRead == 0 {
+                return data
+            }
+            let code = errno
+            if code == EINTR {
+                continue
+            }
+            logger.warning(
+                "multiWindowRouter.readFailed errno=\(Int(code), privacy: .public) fd=\(fileDescriptor, privacy: .public) partialBytes=\(data.count, privacy: .public)"
+            )
+            return data
+        }
+    }
+}

Packages/CmuxIPCService/Sources/CmuxIPCService/MultiWindowRouting.swift

@@ -0,0 +1,52 @@
+/// Routes a cmux CLI request to a specific window over the app's control
+/// socket and returns the captured outcome.
+///
+/// This is the seam for the multi-window CLI-over-socket capability extracted
+/// from AppDelegate: production code uses ``MultiWindowRouter``, and tests
+/// inject a fake conforming type so they never spawn the real CLI. The window
+/// targeting itself is expressed in `arguments` (for example
+/// `["list-workspaces", "--window", id]`); the conforming type supplies the
+/// CLI binary, socket path, and child environment.
+public protocol MultiWindowRouting: Sendable {
+    /// Runs the bundled cmux CLI against the configured socket with `arguments`
+    /// and captures its termination status and output.
+    ///
+    /// - Parameter arguments: The CLI arguments after the implicit
+    ///   `--socket <path>` pair (subcommand, window targeting flags, output
+    ///   format flags).
+    /// - Returns: The ``MultiWindowRouteResult`` describing how the launched
+    ///   CLI call finished.
+    /// - Throws: ``MultiWindowRouteLaunchError`` when the CLI process could
+    ///   not be launched; a launched CLI never throws, its outcome (including
+    ///   non-zero exit) is the returned result.
+    func route(arguments: [String]) async throws -> MultiWindowRouteResult
+}
+
+extension MultiWindowRouting {
+    /// Routes one CLI call, encoding a launch failure into the result instead
+    /// of throwing.
+    ///
+    /// This is the legacy capture encoding the pre-extraction AppDelegate
+    /// helper produced and the multi-window UI-test data file still expects:
+    /// a CLI that never launched yields termination status `-1` with the
+    /// launch error's description in `stderr` (byte-identical to the old
+    /// `String(describing:)` text via ``MultiWindowRouteLaunchError``'s
+    /// `CustomStringConvertible`). Use it when every call in a batch must run
+    /// regardless of earlier launch failures.
+    ///
+    /// - Parameter arguments: The CLI arguments after the implicit
+    ///   `--socket <path>` pair.
+    /// - Returns: The route result, with launch failure folded in as
+    ///   termination status `-1`.
+    public func routeCapturingLaunchFailure(arguments: [String]) async -> MultiWindowRouteResult {
+        do {
+            return try await route(arguments: arguments)
+        } catch {
+            return MultiWindowRouteResult(
+                terminationStatus: -1,
+                stdout: "",
+                stderr: String(describing: error)
+            )
+        }
+    }
+}