Remove Stack auth from mobile attach hot path

.github/swift-file-length-budget.tsv

@@ -12,9 +12,9 @@
 9497	cmuxTests/CLINotifyProcessIntegrationRegressionTests.swift
 8016	CLI/cmux_open.swift
 7952	Sources/Panels/BrowserPanelView.swift
-7366	cmuxTests/WorkspaceUnitTests.swift
+7368	cmuxTests/WorkspaceUnitTests.swift
 7218	cmuxTests/WorkspaceRemoteConnectionTests.swift
-6895	Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift
+6968	Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift
 6317	cmuxTests/SessionPersistenceTests.swift
 6217	cmuxTests/GhosttyConfigTests.swift
 6183	Sources/TabManager.swift
@@ -39,7 +39,7 @@
 2565	Sources/Panels/CmuxWebView.swift
 2546	cmuxTests/WorkspaceManualUnreadTests.swift
 2524	cmuxTests/CommandPaletteSearchEngineTests.swift
-2395	Sources/Mobile/MobileHostService.swift
+2424	Sources/Mobile/MobileHostService.swift
 2328	cmuxTests/CJKIMEInputTests.swift
 2242	Sources/TerminalNotificationStore.swift
 2233	Sources/TerminalWindowPortal.swift
@@ -69,8 +69,8 @@
 1373	cmuxTests/AppDelegateIssue2907RoutingTests.swift
 1363	Sources/CMUXInstalledExtensionSidebarHostView.swift
 1360	Sources/Feed/FeedButtonStyleDebugWindowController.swift
+1328	cmuxTests/MobileHostAuthorizationTests.swift
 1295	Packages/macOS/CmuxTerminalCore/Sources/CmuxTerminalCore/Config/GhosttyConfig.swift
-1295	cmuxTests/MobileHostAuthorizationTests.swift
 1285	cmuxUITests/SidebarHelpMenuUITests.swift
 1277	cmuxTests/RestorableAgentSessionIndexTests.swift
 1258	Sources/Feed/FeedCoordinator.swift
@@ -112,7 +112,6 @@
 824	Sources/MainWindowFocusController.swift
 813	Packages/iOS/CmuxMobileShellUI/Sources/CmuxMobileShellUI/TerminalComposerView.swift
 810	Packages/macOS/CmuxSwiftRender/Tests/CmuxSwiftRenderTests/SwiftViewInterpreterTests.swift
-803	Packages/iOS/CmuxMobilePairedMac/Sources/CmuxMobilePairedMac/MobilePairedMacStore.swift
 802	Sources/WorkspaceContentView.swift
 797	Sources/ClosedItemHistory.swift
 779	cmuxUITests/BrowserOmnibarSuggestionsUITests.swift
@@ -191,8 +190,8 @@
 560	cmuxTests/CLISSHPTYResizeInputTests.swift
 558	Packages/macOS/CmuxGit/Sources/CmuxGit/Parsing/GitMetadataService+Config.swift
 552	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/BrowserSection.swift
+551	Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/BackingUpPairedMacStore.swift
 549	Sources/Panels/BrowserAutomation.swift
-547	Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/BackingUpPairedMacStore.swift
 541	Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/Pane/ControlCommandCoordinator+Pane.swift
 540	Packages/macOS/CmuxWorkspaces/Sources/CmuxWorkspaces/Coordinators/WorkspaceReorderCoordinator.swift
 539	CLI/CMUXCLI+Themes.swift
@@ -206,6 +205,7 @@
 528	cmuxUITests/AutomationSocketUITests.swift
 527	CLI/CLISocketPathResolver.swift
 527	cmuxTests/BrowserHTTPBasicAuthPromptTests.swift
+526	Packages/iOS/CmuxMobilePairedMac/Tests/CmuxMobilePairedMacTests/MobilePairedMacStoreTests.swift
 526	Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/Workstream/WorkstreamStore.swift
 525	Packages/macOS/CmuxSettings/Sources/CmuxSettings/SocketControl/SocketControlSettings.swift
 524	CLI/CMUXCLI+AutoNaming.swift

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxAttachTicketCompactCoder.swift

@@ -12,10 +12,9 @@ import Foundation
 /// expiry. It does keep non-secret pairing context: the Mac account email,
 /// shared pairing compatibility level, and app version/build, so the phone can
 /// fail fast on an account mismatch and warn before continuing across
-/// compatibility skew. A pairing QR never expires;
-/// the owner's Stack access token is the
-/// host's sole authorization gate (`MobileHostService.authorizationError(for:)`),
-/// so ticket age authorizes nothing.
+/// compatibility skew. A pairing QR never expires and carries no bearer token;
+/// token-bearing RPC tickets are delivered through the direct RPC payload, not
+/// through the compact QR URL.
 ///
 /// Compatibility:
 /// - New decoders accept both grammars: ``CmxAttachTicketInput`` routes a
@@ -45,9 +44,9 @@ public struct CmxAttachTicketCompactCoder: Sendable {
     /// Encode a ticket into the compact JSON grammar.
     ///
     /// Any `authToken`, `macDisplayName`, and `expiresAt` on the ticket are
-    /// intentionally not encoded: the token never authorizes anything on the
-    /// host (Stack auth is the sole gate), the name is read post-handshake
-    /// from `mobile.host.status`, and a pairing QR never expires.
+    /// intentionally not encoded: QR/deep-link URLs are not bearer credentials,
+    /// the name is read post-handshake from `mobile.host.status`, and a pairing
+    /// QR never expires.
     public func encode(_ ticket: CmxAttachTicket) throws -> Data {
         let encoder = JSONEncoder()
         encoder.outputFormatting = [.sortedKeys, .withoutEscapingSlashes]

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxPairingQRCode.swift

@@ -9,9 +9,8 @@ import Foundation
 /// account/build context to check before dialing. The account value is the
 /// opaque Stack user id, never the email itself. Everything else the earlier
 /// grammars carried has a better channel or no reason to exist:
-/// - **No auth token.** The owner's Stack access token is the host's sole
-///   authorization gate; a token in the QR authorized nothing and made the
-///   code look like a leaked credential.
+/// - **No auth token.** A QR URL is not a bearer credential; token-bearing RPC
+///   tickets are returned through the direct attach-ticket payload.
 /// - **No expiry.** Ticket age authorizes nothing, so a code that sat on
 ///   screen for an hour still pairs.
 /// - **No display name, no device id.** Both arrive post-handshake from

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxTransport.swift

@@ -214,10 +214,9 @@ public struct CmxAttachTicket: Codable, Equatable, Sendable {
     public let macAppBuild: String?
     public let routes: [CmxAttachRoute]
     /// When the ticket's attach token stops being usable, or `nil` for tickets
-    /// that never expire (the pairing QR carries no token and no expiry; Stack
-    /// auth is the host's sole authorization gate). Expiry is data for the
-    /// token consumers (`MobileCoreRPCClient`, the host's ticket store), not a
-    /// structural validity condition; see ``isExpired(at:)``.
+    /// that never expire (the pairing QR carries no token and no expiry). Expiry
+    /// is data for the token consumers (`MobileCoreRPCClient`, the host's ticket
+    /// store), not a structural validity condition; see ``isExpired(at:)``.
     public let expiresAt: Date?
     public let authToken: String?
 
@@ -290,9 +289,9 @@ public struct CmxAttachTicket: Codable, Equatable, Sendable {
     }
 
     /// Structural validity only. Expiry is intentionally NOT validated here:
-    /// a scanned pairing QR must keep working however long it sat on screen
-    /// (the host authorizes by Stack account, not by ticket age). Token-based
-    /// consumers check ``isExpired(at:)`` where the token is actually used.
+    /// a scanned pairing QR must keep working however long it sat on screen.
+    /// Token-based consumers check ``isExpired(at:)`` where the token is
+    /// actually used.
     public func validate() throws {
         guard version == Self.currentVersion else {
             throw CmxAttachTicketError.unsupportedVersion(version)

Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxAttachTicketCompactCoderTests.swift

@@ -130,8 +130,8 @@ private func legacyDecoder() -> JSONDecoder {
     // Routes round-trip losslessly even with custom ids ("ws" differs from
     // the synthesized "websocket", so it is carried verbatim).
     #expect(decoded.routes == ticket.routes)
-    // Dropped by design: the auth token never authorizes anything, the name
-    // arrives via `mobile.host.status`, and a pairing QR never expires.
+    // Dropped by design: QR URLs are not bearer credentials, the name arrives
+    // via `mobile.host.status`, and a pairing QR never expires.
     #expect(decoded.authToken == nil)
     #expect(decoded.macDisplayName == nil)
     #expect(decoded.expiresAt == nil)

Packages/Shared/CmuxSyncStore/Tests/CmuxSyncStoreTests/CmuxSyncStoreTests.swift

@@ -393,7 +393,7 @@ let sortKey: @Sendable (SyncWireRecord) -> Double = { DeviceSyncFacade.sortKey(f
     actor FakePairedStore: MobilePairedMacStoring {
         var macs: [MobilePairedMac]
         init(macs: [MobilePairedMac]) { self.macs = macs }
-        func upsert(macDeviceID: String, displayName: String?, routes: [CmxAttachRoute], markActive: Bool, stackUserID: String?, teamID: String?, now: Date) async throws {}
+        func upsert(macDeviceID: String, displayName: String?, routes: [CmxAttachRoute], attachToken: String?, attachTokenExpiresAt: Date?, markActive: Bool, stackUserID: String?, teamID: String?, now: Date) async throws {}
         func loadAll(stackUserID: String?, teamID: String?) async throws -> [MobilePairedMac] {
             guard let stackUserID else { return macs }
             return macs.filter { $0.stackUserID == stackUserID }

Packages/iOS/CmuxMobilePairedMac/Sources/CmuxMobilePairedMac/MobilePairedMac.swift

@@ -3,15 +3,19 @@ public import Foundation
 
 /// A Mac paired with this iOS device, persisted across launches.
 ///
-/// Auth tokens are never persisted, only enough to re-mint a fresh attach
-/// ticket via the StackAuth-authenticated manual host flow on next launch.
+/// The attach token is local-only durable reconnect state; backup sync deliberately
+/// omits it so only this device can redeem the ticket without a Stack round trip.
 public struct MobilePairedMac: Codable, Equatable, Sendable, Identifiable {
     /// Stable identifier of the paired Mac device.
     public var macDeviceID: String
     /// Human-readable name of the Mac, if the pairing payload supplied one.
     public var displayName: String?
     /// Attach routes advertised by the Mac, ordered by priority (lowest first).
     public var routes: [CmxAttachRoute]
+    /// Local-only attach ticket secret used for fast reconnect while unexpired.
+    public var attachToken: String? = nil
+    /// Expiration time for ``attachToken``.
+    public var attachTokenExpiresAt: Date? = nil
     /// When this pairing was first recorded.
     public var createdAt: Date
     /// When this pairing was last refreshed or used.
@@ -40,6 +44,20 @@ public struct MobilePairedMac: Codable, Equatable, Sendable, Identifiable {
     /// The Mac device identifier doubles as the stable `Identifiable` id.
     public var id: String { macDeviceID }
 
+    private enum CodingKeys: String, CodingKey {
+        case macDeviceID
+        case displayName
+        case routes
+        case createdAt
+        case lastSeenAt
+        case isActive
+        case stackUserID
+        case teamID
+        case customName
+        case customColor
+        case customIcon
+    }
+
     /// The name to show: the user's custom override if set, else the Mac-reported
     /// name, else the device id.
     public var resolvedName: String {
@@ -53,6 +71,8 @@ public struct MobilePairedMac: Codable, Equatable, Sendable, Identifiable {
     ///   - macDeviceID: Stable identifier of the paired Mac device.
     ///   - displayName: Optional human-readable Mac name.
     ///   - routes: Attach routes advertised by the Mac.
+    ///   - attachToken: Local-only attach ticket secret for fast reconnect.
+    ///   - attachTokenExpiresAt: Expiration time for `attachToken`.
     ///   - createdAt: When the pairing was first recorded.
     ///   - lastSeenAt: When the pairing was last refreshed.
     ///   - isActive: Whether this pairing is currently active for its scope.
@@ -61,6 +81,8 @@ public struct MobilePairedMac: Codable, Equatable, Sendable, Identifiable {
         macDeviceID: String,
         displayName: String?,
         routes: [CmxAttachRoute],
+        attachToken: String? = nil,
+        attachTokenExpiresAt: Date? = nil,
         createdAt: Date,
         lastSeenAt: Date,
         isActive: Bool,
@@ -73,6 +95,8 @@ public struct MobilePairedMac: Codable, Equatable, Sendable, Identifiable {
         self.macDeviceID = macDeviceID
         self.displayName = displayName
         self.routes = routes
+        self.attachToken = attachToken
+        self.attachTokenExpiresAt = attachTokenExpiresAt
         self.createdAt = createdAt
         self.lastSeenAt = lastSeenAt
         self.isActive = isActive

Packages/iOS/CmuxMobilePairedMac/Sources/CmuxMobilePairedMac/MobilePairedMacStore+Connection.swift

@@ -0,0 +1,26 @@
+import SQLite3
+
+extension MobilePairedMacStore {
+    /// Open the SQLite connection and set connection pragmas. `nonisolated`
+    /// `static` so the actor's synchronous initializer can build the handle
+    /// without hopping isolation. Opened with `SQLITE_OPEN_FULLMUTEX` so SQLite
+    /// serializes access internally; the actor adds an outer serialization layer.
+    /// Schema migration runs lazily on first store access via `ensureReady()`.
+    nonisolated static func openConnection(path: String) throws -> OpaquePointer {
+        var handle: OpaquePointer?
+        let flags = SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX
+        let rc = sqlite3_open_v2(path, &handle, flags, nil)
+        guard rc == SQLITE_OK, let handle else {
+            if let handle { sqlite3_close_v2(handle) }
+            throw MobilePairedMacStoreError.openFailed(rc)
+        }
+        for pragma in ["PRAGMA foreign_keys = ON;", "PRAGMA journal_mode = WAL;"] {
+            let prc = sqlite3_exec(handle, pragma, nil, nil, nil)
+            guard prc == SQLITE_OK else {
+                sqlite3_close_v2(handle)
+                throw MobilePairedMacStoreError.stepFailed(prc, "")
+            }
+        }
+        return handle
+    }
+}