Fix fish Claude restore fallback

.github/swift-file-length-budget.tsv

@@ -1,11 +1,11 @@
 # cmux-owned Swift file length budget.
 # Format: max_lines<TAB>relative path
 # Reduce counts as files shrink. CI fails if tracked files exceed this budget.
-34643	CLI/cmux.swift
+34644	CLI/cmux.swift
 17854	Sources/AppDelegate.swift
 16476	Sources/ContentView.swift
 13913	Sources/TerminalController.swift
-12886	Sources/Workspace.swift
+12926	Sources/Workspace.swift
 12348	cmuxTests/AppDelegateShortcutRoutingTests.swift
 12237	Sources/GhosttyTerminalView.swift
 11567	Sources/Panels/BrowserPanel.swift
@@ -46,7 +46,7 @@
 2126	cmuxTests/CmuxConfigTests.swift
 2091	cmuxTests/ShortcutAndCommandPaletteTests.swift
 2078	Sources/SessionPersistence.swift
-1960	Sources/RestorableAgentSession.swift
+1964	Sources/RestorableAgentSession.swift
 1952	Sources/KeyboardShortcutSettingsFileStore.swift
 1900	cmuxTests/NotificationAndMenuBarTests.swift
 1866	Sources/Panels/BrowserWebAuthnSupport.swift
@@ -123,6 +123,7 @@
 768	cmuxUITests/BrowserFixtureInteractionUITests.swift
 762	Packages/iOS/CmuxMobileTransport/Sources/CmuxMobileTransport/CmxNetworkByteTransport.swift
 761	Sources/Mobile/AgentChat/AgentChatSessionRegistry.swift
+761	cmuxTests/AgentSessionAutoResumeSwiftTests.swift
 760	Packages/macOS/CMUXAgentLaunch/Tests/CMUXAgentLaunchTests/AgentLaunchSanitizerTests.swift
 756	Sources/Panels/AgentSessionWebRendererCoordinator.swift
 754	Sources/TerminalController+ControlWorkspaceContext.swift
@@ -160,7 +161,6 @@
 642	cmuxTests/RemoteTmuxControlParserTests.swift
 641	cmuxTests/CommandPaletteNucleoFFITests.swift
 636	Sources/TerminalController+ControlPaneContext.swift
-632	cmuxTests/AgentSessionAutoResumeSwiftTests.swift
 630	Packages/macOS/CmuxSettings/Sources/CmuxSettings/Values/ShortcutWhenClause.swift
 627	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/KeyboardShortcutsSection.swift
 621	cmuxUITests/RightSidebarChromeHeightUITests.swift

CLI/cmux.swift

@@ -26508,7 +26508,7 @@ struct CMUXCLI {
     }
 
     private func nativeProcessDescribesKnownAgent(for pid: pid_t) -> Bool {
-        AgentLaunchCaptureTrust.nativeProcessDescribesKnownAgent(
+        AgentLaunchCaptureTrust().nativeProcessDescribesKnownAgent(
             processName: processName(for: pid),
             arguments: processArguments(for: pid) ?? []
         )
@@ -26669,7 +26669,8 @@ struct CMUXCLI {
         // capture only when its launcher describes this hook's agent kind; otherwise
         // fall back to the agent's own process argv and kind.
         let envLauncher = normalizedHookValue(env["CMUX_AGENT_LAUNCH_KIND"])
-        let envCaptureIsTrusted = AgentLaunchCaptureTrust.launcherDescribesKind(
+        let launchCaptureTrust = AgentLaunchCaptureTrust()
+        let envCaptureIsTrusted = launchCaptureTrust.launcherDescribesKind(
             envLauncher,
             kind: fallbackKind
         )
@@ -26679,15 +26680,15 @@ struct CMUXCLI {
         var processArguments = fallbackPID.flatMap { fallbackPID -> [String]? in
             let pid = pid_t(fallbackPID)
             let candidate = self.processArguments(for: pid)
-            guard AgentLaunchCaptureTrust.nativeProcessDescribesKind(
+            guard launchCaptureTrust.nativeProcessDescribesKind(
                 processName: processName(for: pid),
                 arguments: candidate,
                 kind: fallbackKind
             ) else { return nil }
             return candidate
         }
         if let candidate = processArguments,
-           AgentLaunchCaptureTrust.argvLooksLikeShellWrapper(candidate) {
+           launchCaptureTrust.argvLooksLikeShellWrapper(candidate) {
             // The PID fallback resolved to a shell dispatcher (e.g. the hook's own
             // `sh -c …` wrapper), not the agent. That argv is not a launch.
             processArguments = nil

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentLaunchCaptureTrust.swift

@@ -1,44 +1,67 @@
 import Foundation
 
-/// Decides whether a captured agent launch command can be trusted for the agent
-/// kind it is stored under.
+/// Decides whether captured agent launch metadata can be trusted for a stored agent kind.
 ///
 /// `CMUX_AGENT_LAUNCH_*` is exported into the agent's process environment by the
 /// cmux launch wrappers and therefore leaks to every descendant process: an agent
 /// started from inside another agent's session (codex under claude, claude under
 /// codex, …) inherits the ANCESTOR's launch capture. A hook that stores that
 /// capture verbatim poisons resume/fork for the session — the rendered command
 /// runs the wrong binary with the wrong flags.
-public enum AgentLaunchCaptureTrust {
+public struct AgentLaunchCaptureTrust: Sendable, Equatable {
     /// Wrapper launchers that legitimately differ from the hook kind they launch.
-    private static let wrapperLaunchersByKind: [String: Set<String>] = [
-        "claude": ["claudeteams"],
-        "codex": ["codexteams"],
-        "opencode": ["omo", "omx", "omc"],
-        "pi": ["omp"],
-    ]
+    private let wrapperLaunchersByKind: [String: Set<String>]
+    private let nativeProcessAliasesByKind: [String: Set<String>]
+    private let shellExecutableBasenames: Set<String>
 
-    private static let nativeProcessAliasesByKind: [String: Set<String>] = [
-        "antigravity": ["agy"],
-        "claude": ["claude"],
-        "codex": ["codex"],
-        "codebuddy": ["codebuddy"],
-        "copilot": ["copilot"],
-        "cursor": ["cursor-agent", "cursor"],
-        "factory": ["droid", "factory"],
-        "gemini": ["gemini"],
-        "grok": ["grok", "grok-macos-aarch64", "grok-macos-aarch"],
-        "kiro": ["kiro", "kiro-cli"],
-        "omp": ["omp"],
-        "opencode": ["opencode", "omo", "omx", "omc"],
-        "pi": ["pi", "omp"],
-        "qoder": ["qodercli", "qoder"],
-        "rovodev": ["rovodev", "rovo", "rovo-dev"],
-    ]
+    /// Creates a launch-capture trust policy with cmux's built-in agent and shell aliases.
+    public init() {
+        wrapperLaunchersByKind = [
+            "claude": ["claudeteams"],
+            "codex": ["codexteams"],
+            "opencode": ["omo", "omx", "omc"],
+            "pi": ["omp"],
+        ]
+
+        nativeProcessAliasesByKind = [
+            "antigravity": ["agy"],
+            "claude": ["claude"],
+            "codex": ["codex"],
+            "codebuddy": ["codebuddy"],
+            "copilot": ["copilot"],
+            "cursor": ["cursor-agent", "cursor"],
+            "factory": ["droid", "factory"],
+            "gemini": ["gemini"],
+            "grok": ["grok", "grok-macos-aarch64", "grok-macos-aarch"],
+            "kiro": ["kiro", "kiro-cli"],
+            "omp": ["omp"],
+            "opencode": ["opencode", "omo", "omx", "omc"],
+            "pi": ["pi", "omp"],
+            "qoder": ["qodercli", "qoder"],
+            "rovodev": ["rovodev", "rovo", "rovo-dev"],
+        ]
+
+        shellExecutableBasenames = [
+            "bash",
+            "csh",
+            "dash",
+            "fish",
+            "ksh",
+            "login",
+            "sh",
+            "tcsh",
+            "zsh",
+        ]
+    }
 
     /// True when `launcher` plausibly describes a launch of agent `kind`.
+    ///
     /// A nil/empty launcher is trusted: hooks fall back to their own kind.
-    public static func launcherDescribesKind(_ launcher: String?, kind: String) -> Bool {
+    /// - Parameters:
+    ///   - launcher: The captured launcher label, if any.
+    ///   - kind: The agent kind that owns the captured session.
+    /// - Returns: Whether the launcher belongs to the supplied kind.
+    public func launcherDescribesKind(_ launcher: String?, kind: String) -> Bool {
         guard let launcher = launcher?.trimmingCharacters(in: .whitespacesAndNewlines),
               !launcher.isEmpty else {
             return true
@@ -51,35 +74,73 @@ public enum AgentLaunchCaptureTrust {
         return wrapperLaunchersByKind[normalizedKind]?.contains(normalizedLauncher) == true
     }
 
+    /// True when `executable` is a known shell or login executable, not an agent binary.
+    /// - Parameter executable: The captured executable path or argv token.
+    /// - Returns: Whether the executable basename matches a known shell.
+    public func executableLooksLikeShell(_ executable: String?) -> Bool {
+        guard let executable = executable?.trimmingCharacters(in: .whitespacesAndNewlines),
+              !executable.isEmpty else {
+            return false
+        }
+        let basename = (executable as NSString).lastPathComponent
+            .trimmingCharacters(in: CharacterSet(charactersIn: "-"))
+            .lowercased()
+        return shellExecutableBasenames.contains(basename)
+    }
+
     /// True when a captured argv describes a shell dispatcher (`sh -c …`,
     /// `zsh -lc …`) rather than an agent launch. This happens when the
     /// launch-capture PID fallback resolves to the hook's own dispatch shell
     /// instead of the agent process. Requires both a shell argv[0] basename and
-    /// a command-string flag, so an agent that merely shares a shell's name
-    /// (e.g. a wrapper script named `fish`) is not misclassified.
-    public static func argvLooksLikeShellWrapper(_ arguments: [String]) -> Bool {
-        guard let argv0 = arguments.first?.trimmingCharacters(in: .whitespacesAndNewlines),
-              !argv0.isEmpty else {
+    /// shell dispatcher/profile-startup flags, so an agent that merely shares a
+    /// shell's name (e.g. a wrapper script named `fish`) is not misclassified.
+    /// - Parameter arguments: The captured process argv, including argv[0].
+    /// - Returns: Whether argv is a shell command-string dispatcher.
+    public func argvLooksLikeShellWrapper(_ arguments: [String]) -> Bool {
+        guard executableLooksLikeShell(arguments.first) else { return false }
+        var sawShellStartupOnlyFlag = false
+        for argument in arguments.dropFirst() {
+            if shellCommandStringFlag(argument) {
+                return true
+            }
+            if shellStartupOnlyFlag(argument) {
+                sawShellStartupOnlyFlag = true
+                continue
+            }
+            if argument == "--" || !argument.hasPrefix("-") {
+                return false
+            }
             return false
         }
-        let name = (argv0 as NSString).lastPathComponent.lowercased()
-        let shells: Set<String> = ["sh", "bash", "zsh", "dash", "fish", "csh", "tcsh", "ksh"]
-        guard shells.contains(name) else { return false }
-        guard arguments.count >= 2 else { return false }
-        // A combined short option whose letters are shell mode flags and that
-        // includes `c` (-c, -lc, -ic, -lic, …): the command-string form.
-        let flag = arguments[1]
+        return sawShellStartupOnlyFlag
+    }
+
+    private func shellCommandStringFlag(_ flag: String) -> Bool {
         guard flag.hasPrefix("-"), !flag.hasPrefix("--") else { return false }
         let letters = flag.dropFirst()
         return !letters.isEmpty
             && letters.contains("c")
             && letters.allSatisfy { "cilms".contains($0) }
     }
 
+    private func shellStartupOnlyFlag(_ flag: String) -> Bool {
+        switch flag {
+        case "--no-config", "--no-rcs", "--noprofile", "--norc":
+            return true
+        default:
+            return false
+        }
+    }
+
     /// True when PID-derived process metadata describes the same native agent as
     /// the hook kind. This keeps unrelated parents, including Xcode test hosts
     /// and the cmux app executable, from becoming persisted resume commands.
-    public static func nativeProcessDescribesKind(
+    /// - Parameters:
+    ///   - processName: The process name reported by the system, if any.
+    ///   - arguments: The captured process argv.
+    ///   - kind: The hook kind that owns the session.
+    /// - Returns: Whether the process metadata describes the hook kind.
+    public func nativeProcessDescribesKind(
         processName: String?,
         arguments: [String]?,
         kind: String
@@ -95,7 +156,12 @@ public enum AgentLaunchCaptureTrust {
         }
     }
 
-    public static func nativeProcessDescribesKnownAgent(
+    /// True when PID-derived process metadata describes any built-in agent.
+    /// - Parameters:
+    ///   - processName: The process name reported by the system, if any.
+    ///   - arguments: The captured process argv.
+    /// - Returns: Whether the metadata matches a known agent alias.
+    public func nativeProcessDescribesKnownAgent(
         processName: String?,
         arguments: [String]
     ) -> Bool {
@@ -105,7 +171,7 @@ public enum AgentLaunchCaptureTrust {
         }
     }
 
-    private static func nativeProcessDescriptors(
+    private func nativeProcessDescriptors(
         processName: String?,
         arguments: [String]
     ) -> Set<String> {
@@ -140,15 +206,15 @@ public enum AgentLaunchCaptureTrust {
         return descriptors
     }
 
-    private static func normalizedAgentName(_ value: String?) -> String? {
+    private func normalizedAgentName(_ value: String?) -> String? {
         guard let value = value?.trimmingCharacters(in: .whitespacesAndNewlines),
               !value.isEmpty else {
             return nil
         }
         return value.lowercased()
     }
 
-    private static func processBasename(_ value: String?) -> String? {
+    private func processBasename(_ value: String?) -> String? {
         guard let value = value?.trimmingCharacters(in: .whitespacesAndNewlines),
               !value.isEmpty else {
             return nil

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentResumeArgv.swift

@@ -15,8 +15,13 @@ import Foundation
 /// per-kind verb (``builtInKind(kind:sessionId:executablePath:arguments:)``). Callers that also
 /// support custom Vault agents slot that resolution between the two.
 public struct AgentResumeArgv: Sendable, Equatable {
-    /// Creates a resume-argv builder. The type holds no state.
-    public init() {}
+    private let launchCaptureTrust: AgentLaunchCaptureTrust
+
+    /// Creates a resume-argv builder.
+    /// - Parameter launchCaptureTrust: The trust policy used to reject inherited shell dispatch captures.
+    public init(launchCaptureTrust: AgentLaunchCaptureTrust = AgentLaunchCaptureTrust()) {
+        self.launchCaptureTrust = launchCaptureTrust
+    }
 
     /// The shell token that resolves cmux's `claude` wrapper at exec time.
     ///
@@ -367,7 +372,12 @@ public struct AgentResumeArgv: Sendable, Equatable {
         arguments: [String],
         fallbackExecutable: String
     ) -> (executable: String, tail: [String]) {
-        let executable = normalized(executablePath) ?? normalized(arguments.first) ?? fallbackExecutable
+        guard let executable = normalized(executablePath) ?? normalized(arguments.first) else {
+            return (fallbackExecutable, [])
+        }
+        if launchCaptureTrust.argvLooksLikeShellWrapper(arguments) {
+            return (fallbackExecutable, [])
+        }
         let tail = arguments.isEmpty ? [] : Array(arguments.dropFirst())
         return (executable, tail)
     }