Evict hidden browser WebViews under memory pressure

.github/swift-file-length-budget.tsv

@@ -2,21 +2,21 @@
 # Format: max_lines<TAB>relative path
 # Reduce counts as files shrink. CI fails if tracked files exceed this budget.
 34289	CLI/cmux.swift
-17827	Sources/AppDelegate.swift
+17830	Sources/AppDelegate.swift
 16117	Sources/ContentView.swift
 13952	Sources/TerminalController.swift
-12772	Sources/Workspace.swift
+12783	Sources/Workspace.swift
 12240	Sources/GhosttyTerminalView.swift
 12144	cmuxTests/AppDelegateShortcutRoutingTests.swift
-11924	Sources/Panels/BrowserPanel.swift
+11929	Sources/Panels/BrowserPanel.swift
 9335	cmuxTests/CLINotifyProcessIntegrationRegressionTests.swift
 8017	CLI/cmux_open.swift
 7986	Sources/Panels/BrowserPanelView.swift
 7354	cmuxTests/WorkspaceUnitTests.swift
 7218	cmuxTests/WorkspaceRemoteConnectionTests.swift
 6317	cmuxTests/SessionPersistenceTests.swift
 6217	cmuxTests/GhosttyConfigTests.swift
-6171	Sources/TabManager.swift
+6178	Sources/TabManager.swift
 6084	Sources/TextBoxInput.swift
 5915	cmuxTests/TerminalAndGhosttyTests.swift
 5573	cmuxTests/BrowserConfigTests.swift
@@ -189,6 +189,7 @@
 558	Packages/macOS/CmuxGit/Sources/CmuxGit/Parsing/GitMetadataService+Config.swift
 552	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/BrowserSection.swift
 549	Sources/Panels/BrowserAutomation.swift
+548	Sources/PaneMemoryGuardrail.swift
 541	Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/Pane/ControlCommandCoordinator+Pane.swift
 540	Packages/macOS/CmuxWorkspaces/Sources/CmuxWorkspaces/Coordinators/WorkspaceReorderCoordinator.swift
 539	CLI/CMUXCLI+Themes.swift
@@ -210,7 +211,6 @@
 519	Packages/macOS/CmuxSwiftRender/Tests/CmuxSwiftRenderTests/Corpus/stress-two-column-cockpit-sidebar.swift
 519	Sources/CmuxConfigExecutor.swift
 518	Packages/macOS/CmuxSwiftRender/Tests/CmuxSwiftRenderTests/Corpus/stress-git-review-queue-command-deck.swift
-517	Sources/PaneMemoryGuardrail.swift
 516	Sources/TerminalImageTransfer.swift
 514	Packages/macOS/CmuxSwiftRender/Sources/CmuxSwiftRender/ExpressionEvaluator.swift
 514	cmuxUITests/UpdatePillUITests.swift

Sources/AppDelegate+PaneMemoryGuardrail.swift

@@ -9,6 +9,16 @@ extension AppDelegate {
         }
     }
 
+    func discardHiddenBrowserWebViewsForSystemMemoryPressure() {
+        let now = Date()
+        let discardedCount = paneMemoryGuardrailTabManagers().reduce(0) { count, manager in
+            count + manager.discardHiddenBrowserWebViewsForSystemMemoryPressure(now: now)
+        }
+#if DEBUG
+        cmuxDebugLog("browser.memoryPressure.discardHidden count=\(discardedCount)")
+#endif
+    }
+
     private func paneMemoryGuardrailTabManagers() -> [TabManager] {
         var managers: [TabManager] = []
         var seen: Set<ObjectIdentifier> = []

Sources/AppDelegate.swift

@@ -2081,6 +2081,9 @@ final class AppDelegate: NSObject, NSApplicationDelegate, UNUserNotificationCent
         guardrail.onRequestClosePane = { [weak self] workspaceId, panelId in
             _ = self?.closePaneForMemoryGuardrail(workspaceId: workspaceId, panelId: panelId)
         }
+        guardrail.onSystemMemoryPressure = { [weak self] in
+            self?.discardHiddenBrowserWebViewsForSystemMemoryPressure()
+        }
         guardrail.start()
     }
 

Sources/PaneMemoryGuardrail.swift

@@ -33,6 +33,9 @@ final class PaneMemoryGuardrail {
     /// Fallback when a pane has no high-memory process group to signal: close it.
     @ObservationIgnored
     var onRequestClosePane: (@MainActor (_ workspaceId: UUID, _ panelId: UUID) -> Void)?
+    /// Invoked when the OS reports warning/critical system memory pressure.
+    @ObservationIgnored
+    var onSystemMemoryPressure: (@MainActor () -> Void)?
 
     @ObservationIgnored
     private var engine = PaneMemoryGuardrailEngine()
@@ -41,6 +44,8 @@ final class PaneMemoryGuardrail {
     @ObservationIgnored
     private var timer: DispatchSourceTimer?
     @ObservationIgnored
+    private var memoryPressureSource: DispatchSourceMemoryPressure?
+    @ObservationIgnored
     private var isScanning = false
     @ObservationIgnored
     private var scanApplyTask: Task<Void, Never>?
@@ -58,6 +63,7 @@ final class PaneMemoryGuardrail {
     private var pendingKillTasksByKey: [PaneMemoryPaneKey: (id: UUID, task: Task<Void, Never>)] = [:]
 
     func start() {
+        startSystemMemoryPressureSourceIfNeeded()
         guard timer == nil else { return }
         let timer = DispatchSource.makeTimerSource(queue: timerQueue)
         timer.schedule(
@@ -72,6 +78,31 @@ final class PaneMemoryGuardrail {
         timer.resume()
     }
 
+    private func startSystemMemoryPressureSourceIfNeeded() {
+        guard memoryPressureSource == nil else { return }
+        // DispatchSource memory-pressure notifications are the system signal for
+        // freeing nonessential WebKit process memory; no async-native equivalent
+        // exists.
+        let source = DispatchSource.makeMemoryPressureSource(
+            eventMask: [.warning, .critical],
+            queue: timerQueue
+        )
+        source.setEventHandler { [weak self] in
+            Task { @MainActor in
+                self?.handleSystemMemoryPressure()
+            }
+        }
+        memoryPressureSource = source
+        source.resume()
+    }
+
+    private func handleSystemMemoryPressure() {
+#if DEBUG
+        cmuxDebugLog("paneMemGuard.systemMemoryPressure")
+#endif
+        onSystemMemoryPressure?()
+    }
+
     // MARK: Settings
 
     private var isEnabled: Bool {

Sources/Panels/BrowserHiddenWebViewDiscardManager.swift

@@ -46,9 +46,15 @@ final class BrowserHiddenWebViewDiscardManager {
     private var policyObserver: NSObjectProtocol?
     private var systemSleepObservers: [NSObjectProtocol] = []
     private var systemSleepObserverCenter: NotificationCenter?
-    private var policyState = BrowserHiddenWebViewDiscardPolicy.resolved()
+    private let policyDefaults: UserDefaults
+    private var policyState: BrowserHiddenWebViewDiscardPolicy.ResolvedPolicy
     private var scheduleGeneration: UInt64 = 0
 
+    init(policyDefaults: UserDefaults = .standard) {
+        self.policyDefaults = policyDefaults
+        self.policyState = BrowserHiddenWebViewDiscardPolicy.resolved(defaults: policyDefaults)
+    }
+
     /// Sleep/wake state used to keep a hidden-webview discard from running in
     /// the fragile window right after system wake
     /// (https://github.com/manaflow-ai/cmux/issues/5261).
@@ -67,7 +73,9 @@ final class BrowserHiddenWebViewDiscardManager {
 
     func blockers(for snapshot: BlockerSnapshot) -> [String] {
         var blockers: [String] = []
-        if !BrowserHiddenWebViewDiscardPolicy.isEnabled { blockers.append("policy_disabled") }
+        if !BrowserHiddenWebViewDiscardPolicy.isEnabled(defaults: policyDefaults) {
+            blockers.append("policy_disabled")
+        }
         if isSystemSleeping { blockers.append("system_sleeping") }
         if snapshot.isClosing { blockers.append("closing") }
         if isDiscardedForMemory { blockers.append("already_discarded") }
@@ -90,7 +98,7 @@ final class BrowserHiddenWebViewDiscardManager {
         return blockers
     }
 
-    func scheduleIfNeeded(reason: String) {
+    func scheduleIfNeeded(reason: String, now: Date = Date()) {
         scheduleGeneration &+= 1
         discardTimer?.cancel()
         discardTimer = nil
@@ -100,14 +108,15 @@ final class BrowserHiddenWebViewDiscardManager {
 
         let observedWebViewInstanceID = delegate.hiddenWebViewDiscardWebViewInstanceID
         let generation = scheduleGeneration
-        let hiddenAt = delegate.hiddenWebViewDiscardHiddenAt ?? Date()
+        let hiddenAt = delegate.hiddenWebViewDiscardHiddenAt ?? now
         // Restart the countdown from the latest wake: WebKit pages reconnect and
         // re-navigate right after wake, and replacing/releasing a WKWebView in
         // that window crashed in WebPageProxy::updateActivityState
         // (https://github.com/manaflow-ai/cmux/issues/5261).
         let effectiveHiddenAt = lastSystemWakeAt.map { max(hiddenAt, $0) } ?? hiddenAt
-        let elapsed = Date().timeIntervalSince(effectiveHiddenAt)
-        let remaining = max(0, BrowserHiddenWebViewDiscardPolicy.hiddenDelay - elapsed)
+        let elapsed = now.timeIntervalSince(effectiveHiddenAt)
+        let hiddenDelay = BrowserHiddenWebViewDiscardPolicy.hiddenDelay(defaults: policyDefaults)
+        let remaining = max(0, hiddenDelay - elapsed)
         if remaining <= 0 {
             delegate.hiddenWebViewDiscardManagerDidRequestDiscard(self, reason: reason)
             return
@@ -131,6 +140,27 @@ final class BrowserHiddenWebViewDiscardManager {
         timer.resume()
     }
 
+    @discardableResult
+    func requestImmediateDiscardIfSafe(reason: String, now: Date = Date()) -> Bool {
+        guard let delegate else { return false }
+        guard blockers(for: delegate.hiddenWebViewDiscardSnapshot).isEmpty else { return false }
+        guard delegate.hiddenWebViewDiscardHiddenAt != nil else {
+            scheduleIfNeeded(reason: reason, now: now)
+            return false
+        }
+        // Memory pressure bypasses the hidden-duration delay, not the WebKit post-wake crash guard.
+        guard !isInPostWakeDiscardDelay(now: now) else {
+            scheduleIfNeeded(reason: reason, now: now)
+            return false
+        }
+
+        scheduleGeneration &+= 1
+        discardTimer?.cancel()
+        discardTimer = nil
+        delegate.hiddenWebViewDiscardManagerDidRequestDiscard(self, reason: reason)
+        return true
+    }
+
     func cancel() {
         scheduleGeneration &+= 1
         discardTimer?.cancel()
@@ -181,14 +211,14 @@ final class BrowserHiddenWebViewDiscardManager {
     func noteSystemDidWake(now: Date = Date()) {
         isSystemSleeping = false
         lastSystemWakeAt = now
-        scheduleIfNeeded(reason: "system_did_wake")
+        scheduleIfNeeded(reason: "system_did_wake", now: now)
 #if DEBUG
         cmuxDebugLog("browser.discard.wake rearmed=\(hasScheduledDiscard ? 1 : 0)")
 #endif
     }
 
     func installPolicyObserver() {
-        policyState = BrowserHiddenWebViewDiscardPolicy.resolved()
+        policyState = BrowserHiddenWebViewDiscardPolicy.resolved(defaults: policyDefaults)
         guard policyObserver == nil else { return }
         policyObserver = NotificationCenter.default.addObserver(
             forName: UserDefaults.didChangeNotification,
@@ -257,12 +287,17 @@ final class BrowserHiddenWebViewDiscardManager {
     }
 
     private func handlePolicyDefaultsChanged() {
-        let nextPolicyState = BrowserHiddenWebViewDiscardPolicy.resolved()
+        let nextPolicyState = BrowserHiddenWebViewDiscardPolicy.resolved(defaults: policyDefaults)
         guard policyState != nextPolicyState else { return }
         policyState = nextPolicyState
         delegate?.hiddenWebViewDiscardManagerPolicyDidChange(self, reason: "policy_changed")
     }
 
+    private func isInPostWakeDiscardDelay(now: Date) -> Bool {
+        guard let lastSystemWakeAt else { return false }
+        return now.timeIntervalSince(lastSystemWakeAt) < BrowserHiddenWebViewDiscardPolicy.hiddenDelay(defaults: policyDefaults)
+    }
+
     private func stopOnMainActor() {
         cancel()
         if let policyObserver {

Sources/Panels/BrowserPanel.swift

@@ -3228,7 +3228,7 @@ final class BrowserPanel: Panel, ObservableObject {
             restoreDiscardedWebViewIfNeeded(reason: "visible.\(reason)")
             drainPendingInteractiveBrowserPromptsIfPossible(reason: "visible.\(reason)")
         } else if changed || isFirstVisibilityRecord || !hiddenWebViewDiscardManager.hasScheduledDiscard {
-            scheduleHiddenWebViewDiscardIfNeeded(reason: reason)
+            scheduleHiddenWebViewDiscardIfNeeded(reason: reason, now: now)
         }
     }
 
@@ -3310,8 +3310,8 @@ final class BrowserPanel: Panel, ObservableObject {
         hiddenWebViewDiscardManager.blockers(for: hiddenWebViewDiscardSnapshot)
     }
 
-    private func scheduleHiddenWebViewDiscardIfNeeded(reason: String) {
-        hiddenWebViewDiscardManager.scheduleIfNeeded(reason: reason)
+    private func scheduleHiddenWebViewDiscardIfNeeded(reason: String, now: Date = Date()) {
+        hiddenWebViewDiscardManager.scheduleIfNeeded(reason: reason, now: now)
     }
 
     private func cancelHiddenWebViewDiscard() {
@@ -3397,6 +3397,11 @@ final class BrowserPanel: Panel, ObservableObject {
         return true
     }
 
+    @discardableResult
+    func discardHiddenWebViewForSystemMemoryPressure(now: Date = Date()) -> Bool {
+        hiddenWebViewDiscardManager.requestImmediateDiscardIfSafe(reason: "system_memory_pressure", now: now)
+    }
+
     @discardableResult
     func restoreDiscardedWebViewIfNeeded(
         reason: String,

Sources/TabManager.swift

@@ -2895,6 +2895,13 @@ class TabManager: ObservableObject {
         return tab.panels[panelId] as? BrowserPanel
     }
 
+    @discardableResult
+    func discardHiddenBrowserWebViewsForSystemMemoryPressure(now: Date = Date()) -> Int {
+        tabs.reduce(0) { count, workspace in
+            count + workspace.discardHiddenBrowserWebViewsForSystemMemoryPressure(now: now)
+        }
+    }
+
     /// Returns the focused panel if it's a MarkdownPanel showing the rendered
     /// preview, nil otherwise. Zoom applies to the preview WKWebView, so the raw
     /// text-edit mode is deliberately excluded.

Sources/Workspace.swift

@@ -4963,6 +4963,17 @@ final class Workspace: Identifiable, ObservableObject {
         }
     }
 
+    @discardableResult
+    func discardHiddenBrowserWebViewsForSystemMemoryPressure(now: Date = Date()) -> Int {
+        var discardedCount = 0
+        for browserPanel in panels.values.compactMap({ $0 as? BrowserPanel }) {
+            if browserPanel.discardHiddenWebViewForSystemMemoryPressure(now: now) {
+                discardedCount += 1
+            }
+        }
+        return discardedCount
+    }
+
     @discardableResult
     func updatePanelTitle(panelId: UUID, title: String) -> Bool {
         let trimmed = title.trimmingCharacters(in: .whitespacesAndNewlines)

cmux.xcodeproj/project.pbxproj

@@ -109,6 +109,7 @@
 		A5008373 /* BrowserFindWebViewEvaluator.swift in Sources */ = {isa = PBXBuildFile; fileRef = A5008372 /* BrowserFindWebViewEvaluator.swift */; };
 		7B5F1A2E9C0D4B6A8E217302 /* BrowserFixtureInteractionUITests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7B5F1A2E9C0D4B6A8E217301 /* BrowserFixtureInteractionUITests.swift */; };
 		B42450030000000000000001 /* BrowserHiddenWebViewDiscardManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = B42450040000000000000001 /* BrowserHiddenWebViewDiscardManager.swift */; };
+		B6585001B6585001B6585001 /* BrowserHiddenWebViewDiscardMemoryPressureTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = B6585002B6585002B6585002 /* BrowserHiddenWebViewDiscardMemoryPressureTests.swift */; };
 		B42450010000000000000001 /* BrowserHiddenWebViewDiscardPolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = B42450020000000000000001 /* BrowserHiddenWebViewDiscardPolicy.swift */; };
 		4E1F28554F1B908F18559390 /* BrowserHistorySuggestionCacheTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 19D536229C6194FD62B44503 /* BrowserHistorySuggestionCacheTests.swift */; };
 		FA100000A1B2C3D4E5F60718 /* BrowserImportMappingTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = FA100001A1B2C3D4E5F60718 /* BrowserImportMappingTests.swift */; };
@@ -1232,6 +1233,7 @@
 		A5008372 /* BrowserFindWebViewEvaluator.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Find/BrowserFindWebViewEvaluator.swift; sourceTree = "<group>"; };
 		7B5F1A2E9C0D4B6A8E217301 /* BrowserFixtureInteractionUITests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BrowserFixtureInteractionUITests.swift; sourceTree = "<group>"; };
 		B42450040000000000000001 /* BrowserHiddenWebViewDiscardManager.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Panels/BrowserHiddenWebViewDiscardManager.swift; sourceTree = "<group>"; };
+		B6585002B6585002B6585002 /* BrowserHiddenWebViewDiscardMemoryPressureTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BrowserHiddenWebViewDiscardMemoryPressureTests.swift; sourceTree = "<group>"; };
 		B42450020000000000000001 /* BrowserHiddenWebViewDiscardPolicy.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Panels/BrowserHiddenWebViewDiscardPolicy.swift; sourceTree = "<group>"; };
 		19D536229C6194FD62B44503 /* BrowserHistorySuggestionCacheTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BrowserHistorySuggestionCacheTests.swift; sourceTree = "<group>"; };
 		FA100001A1B2C3D4E5F60718 /* BrowserImportMappingTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BrowserImportMappingTests.swift; sourceTree = "<group>"; };
@@ -3113,6 +3115,7 @@
 				D3622001A1B2C3D4E5F60718 /* BrowserArrowKeyForwardingTests.swift */,
 				D3622101A1B2C3D4E5F60718 /* EditableTextViewArrowKeyForwardingTests.swift */,
 				B65060010000000000000001 /* BrowserPanelSessionRestoreTests.swift */,
+				B6585002B6585002B6585002 /* BrowserHiddenWebViewDiscardMemoryPressureTests.swift */,
 				58C7B1B978620BE162CC057E /* BrowserPanelTests.swift */,
 				C0DE62600000000000000002 /* BrowserWindowPortalRegistryNotificationTests.swift */,
 				19D536229C6194FD62B44503 /* BrowserHistorySuggestionCacheTests.swift */,
@@ -4468,6 +4471,7 @@
 				E12E88F82733EC42F32C36A3 /* BrowserConfigTests.swift in Sources */,
 				C59240010000000000000003 /* BrowserDownloadFilenameResolverTests.swift in Sources */,
 				A5008381 /* BrowserFindJavaScriptTests.swift in Sources */,
+				B6585001B6585001B6585001 /* BrowserHiddenWebViewDiscardMemoryPressureTests.swift in Sources */,
 				4E1F28554F1B908F18559390 /* BrowserHistorySuggestionCacheTests.swift in Sources */,
 				FA100000A1B2C3D4E5F60718 /* BrowserImportMappingTests.swift in Sources */,
 				BCBC0A0E0000000000000E11 /* BrowserMediaActivityAggregationTests.swift in Sources */,