Fix Hive viewer lifecycle, replay identity, and shared-package integration

.github/review-bot-rules/swift-auxiliary-window-close-shortcuts.md

@@ -5,7 +5,7 @@ Standalone cmux-owned windows must have one close-shortcut owner so Cmd+W closes
 Report a failure when the diff introduces or materially changes:
 
 - A user-visible `NSWindow`, `NSPanel`, `NSWindowController`, SwiftUI `Window`, or SwiftUI `WindowGroup` without a stable `cmux.*` window identifier.
-- A `cmux.*` window identifier assignment that is missing from `cmuxAuxiliaryWindowIdentifiers` in `Sources/cmuxApp.swift`.
+- A `cmux.*` window identifier assignment that is missing from `cmuxAuxiliaryWindowIdentifiers` in `Sources/CmuxAuxiliaryWindows.swift`.
 - A new standalone debug, settings, preview, task, editor, browser, file, import, config, or inspector window that can become key but is not covered by `cmuxWindowShouldOwnCloseShortcut`.
 - A custom Cmd+W, `performKeyEquivalent`, or close-menu workaround that bypasses the shared `cmuxWindowShouldOwnCloseShortcut` routing instead of registering the window identifier.
 

.github/test-determinism-allowlist.txt

@@ -2,10 +2,10 @@
 # Format: relpath<TAB>rule<TAB>short reason
 # A finding whose (path, rule) appears here is suppressed.
 # Remove a line once the underlying test is determinized.
-Packages/iOS/CmuxMobileRPC/Tests/CmuxMobileRPCTests/MobileCoreRPCTransportDrainTests.swift	sleep-then-assert	temporary outage debt owned by #8931; remove when determinized
+Packages/Shared/CmuxMobileRPC/Tests/CmuxMobileRPCTests/MobileCoreRPCTransportDrainTests.swift	sleep-then-assert	temporary outage debt owned by #8931; remove when determinized
 Packages/iOS/CmuxMobileShellUI/Tests/CmuxMobileShellUITests/OnboardingMacDiscoveryKeepAliveTests.swift	sleep-then-assert	temporary outage debt owned by #9163; remove when determinized
 cmuxTests/WorkspaceForkConversationContextMenuTests.swift	assert-on-duration	grandfathered
 cmuxTests/WorkspaceForkConversationContextMenuTests.swift	sleep-then-assert	grandfathered
 tests/test_ci_sparkle_build_monotonic.sh	live-network-host	release pretag guard intentionally probes the published appcast and soft-passes offline
 Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxRetryAfterPolicyTests.swift	sleep-then-assert	upstream retry policy timing assertions
-Packages/iOS/CmuxMobileShell/Tests/CmuxMobileShellTests/MobileTerminalLaneCoordinatorTests.swift	sleep-then-assert	upstream coordinator readiness timing assertion
+Packages/Shared/CmuxMobileShell/Tests/CmuxMobileShellTests/MobileTerminalLaneCoordinatorTests.swift	sleep-then-assert	upstream coordinator readiness timing assertion

.github/workflows/ci.yml

@@ -1758,6 +1758,8 @@ jobs:
             CmuxControlSocket
             CmuxFoundation
             CmuxGit
+            CmuxHive
+            CmuxHiveUI
             CmuxMobileTerminalKit
             CmuxMobileWorkspace
             CmuxNotifications

.github/workflows/test-ios.yml

@@ -162,7 +162,7 @@ jobs:
 
       - name: Run CmuxMobilePairedMac package tests
         run: |
-          swift test --package-path Packages/iOS/CmuxMobilePairedMac
+          swift test --package-path Packages/Shared/CmuxMobilePairedMac
 
       - name: Run CmuxMobileChanges package tests
         run: |
@@ -173,13 +173,13 @@ jobs:
           # iOS shell replay/liveness regressions live in this package target.
           # Keep them under the iOS package gate so PR CI enforces the mobile
           # terminal mirror behavior without relying on local-only SwiftPM runs.
-          swift test --package-path Packages/iOS/CmuxMobileShell
+          swift test --package-path Packages/Shared/CmuxMobileShell
 
       - name: Run CmuxMobileShellModel package tests
         run: |
           # Pure shell-model queue and ordering regressions live in this package.
           # Keep them beside the shell package gate so input framing stays covered.
-          swift test --package-path Packages/iOS/CmuxMobileShellModel
+          swift test --package-path Packages/Shared/CmuxMobileShellModel
 
   ios-simulator:
     needs: detect-ios-changes

CLI/CLIError.swift

@@ -1,5 +1,4 @@
-import Foundation
-
+/// Carries CLI failure metadata independently of executable startup.
 struct CLIError: Error, CustomStringConvertible {
     enum SocketFailureKind: Equatable {
         case pathMissing

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/CmxPairingCode.swift

@@ -0,0 +1,127 @@
+public import Foundation
+
+/// A short-lived 6-digit Mac-to-Mac pairing code advertised through the team
+/// device registry.
+///
+/// The host Mac publishes the code (and its expiry) as instance labels on its
+/// own `/api/devices` registration; another Mac claims it by typing the code,
+/// matching it against the registry rows it can already see, and pairing with
+/// the matching instance's advertised routes. The code is a rendezvous
+/// selector, not a bearer secret: registry rows (including routes) are already
+/// team-visible, and the pairing RPC still enforces account identity.
+///
+/// ```swift
+/// let minted = CmxPairingCode(code: "042117", expiresAt: expiry)
+/// body["instanceLabels"] = minted.instanceLabels
+/// // …on the claiming Mac:
+/// let active = CmxPairingCode.active(in: instance.labels, now: Date())
+/// ```
+public struct CmxPairingCode: Equatable, Sendable {
+    /// Instance label carrying the 6-digit code.
+    public static let codeLabelKey = "pairing_code"
+    /// Instance label carrying the code's ISO 8601 expiry timestamp.
+    public static let expiresAtLabelKey = "pairing_code_expires_at"
+
+    /// The 6-digit, zero-padded code the user reads off the host Mac.
+    public var code: String
+    /// When the code stops being claimable.
+    public var expiresAt: Date
+
+    /// Creates a pairing code value.
+    /// - Parameters:
+    ///   - code: The 6-digit, zero-padded code string.
+    ///   - expiresAt: When the code stops being claimable.
+    public init(code: String, expiresAt: Date) {
+        self.code = code
+        self.expiresAt = expiresAt
+    }
+
+    /// Generates a fresh 6-digit code (zero-padded, `000000`–`999999`)
+    /// expiring `ttl` from `now`.
+    ///
+    /// - Parameters:
+    ///   - ttl: Code lifetime.
+    ///   - now: Mint-side clock, injected for testability.
+    ///   - generator: Randomness source, injected for testability.
+    /// - Returns: The minted code value.
+    // lint:allow namespace-type — this type owns code/expiry state; this is a value factory.
+    public static func minted(
+        ttl: TimeInterval,
+        now: Date,
+        using generator: inout some RandomNumberGenerator
+    ) -> CmxPairingCode {
+        CmxPairingCode(
+            code: String(format: "%06d", Int.random(in: 0...999_999, using: &generator)),
+            expiresAt: now.addingTimeInterval(ttl)
+        )
+    }
+
+    /// The wire form: the instance labels a registration POST advertises.
+    public var instanceLabels: [String: String] {
+        [
+            Self.codeLabelKey: code,
+            Self.expiresAtLabelKey: Self.iso8601.string(from: expiresAt),
+        ]
+    }
+
+    /// Decodes an unexpired pairing code from registry instance labels.
+    ///
+    /// A missing or unparseable expiry yields `nil` — a claim must never
+    /// succeed against a code whose lifetime cannot be verified.
+    ///
+    /// - Parameters:
+    ///   - labels: The instance's string labels as returned by the registry.
+    ///   - now: The claim-side clock, injected for testability.
+    /// - Returns: The active code, or `nil` when absent or expired.
+    // lint:allow namespace-type — this type owns code/expiry state; this decodes that value.
+    public static func active(in labels: [String: String], now: Date) -> CmxPairingCode? {
+        guard
+            let code = labels[codeLabelKey]?.trimmingCharacters(in: .whitespacesAndNewlines),
+            !code.isEmpty,
+            let rawExpiry = labels[expiresAtLabelKey],
+            let expiresAt = Self.parseISO8601(rawExpiry),
+            expiresAt > now
+        else { return nil }
+        return CmxPairingCode(code: code, expiresAt: expiresAt)
+    }
+
+    /// The user-typed claim input normalized for matching: digits only, so
+    /// `"042 117"` and `"042117"` claim the same code.
+    /// - Parameter rawInput: The text the user typed.
+    /// - Returns: The digit string, or `nil` unless exactly 6 digits remain.
+    // lint:allow namespace-type — normalization is part of this value's claim grammar.
+    public static func normalizedClaimInput(_ rawInput: String) -> String? {
+        let digits = String(rawInput.compactMap { character -> Character? in
+            guard character.unicodeScalars.count == 1,
+                  let scalar = character.unicodeScalars.first,
+                  (48...57).contains(scalar.value) else {
+                return nil
+            }
+            return character
+        })
+        return digits.count == 6 ? digits : nil
+    }
+
+    /// Encoder for the expiry label; fractional seconds match the registry's
+    /// own `toISOString()` timestamps.
+    private static var iso8601: ISO8601DateFormatter {
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        return formatter
+    }
+
+    /// Lenient ISO 8601 parse (fractional and whole-second forms).
+    // lint:allow static-helper — formatter construction stays inside the value's
+    // Sendable boundary and is only used on registry label reads.
+    private static func parseISO8601(_ raw: String) -> Date? {
+        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else { return nil }
+        let fractional = ISO8601DateFormatter()
+        fractional.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        if let date = fractional.date(from: trimmed) { return date }
+        let whole = ISO8601DateFormatter()
+        whole.formatOptions = [.withInternetDateTime]
+        return whole.date(from: trimmed)
+    }
+
+}

Packages/Shared/CMUXMobileCore/Sources/CMUXMobileCore/MobileTerminalRenderGridFrame+CellWidth.swift

@@ -13,7 +13,9 @@ extension String {
         return clipped
     }
 
-    var renderGridEstimatedCellWidth: Int {
+    /// The estimated total grid-cell width of the string (wide glyphs count 2,
+    /// combining marks 0), matching the host's span-width accounting.
+    public var renderGridEstimatedCellWidth: Int {
         reduce(0) { width, character in
             width + character.renderGridEstimatedCellWidth
         }
@@ -25,13 +27,18 @@ extension MobileTerminalRenderGridFrame.RowSpan {
         text.unicodeScalars.contains { $0.isRenderGridWidthSensitiveScalar }
     }
 
-    var gridCellWidth: Int {
+    /// The span's total width in grid cells: the wire `cell_width` when the
+    /// host sent one, else the text's estimated width. This is the column
+    /// advance to the next span, not a per-glyph width.
+    public var gridCellWidth: Int {
         cellWidth ?? max(1, text.renderGridEstimatedCellWidth)
     }
 }
 
 extension Character {
-    var renderGridEstimatedCellWidth: Int {
+    /// The grid-cell width of one character (0 combining, 2 wide, else 1),
+    /// matching the host's span-width accounting.
+    public var renderGridEstimatedCellWidth: Int {
         let scalars = unicodeScalars
         guard scalars.contains(where: { !$0.isRenderGridZeroWidthScalar }) else {
             return 0

Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxPairingCodeTests.swift

@@ -0,0 +1,68 @@
+import Foundation
+import Testing
+@testable import CMUXMobileCore
+
+/// Deterministic generator so minted codes are reproducible in tests.
+private struct SeededGenerator: RandomNumberGenerator {
+    var state: UInt64
+    mutating func next() -> UInt64 {
+        state = state &* 6_364_136_223_846_793_005 &+ 1_442_695_040_888_963_407
+        return state
+    }
+}
+
+struct CmxPairingCodeTests {
+    private let now = Date(timeIntervalSince1970: 1_000)
+
+    @Test func mintedProducesSixDigitZeroPaddedCodeAndTTLExpiry() {
+        var generator = SeededGenerator(state: 7)
+        let minted = CmxPairingCode.minted(ttl: 600, now: now, using: &generator)
+        #expect(minted.code.count == 6)
+        let allDigits = minted.code.allSatisfy(\.isNumber)
+        #expect(allDigits)
+        #expect(minted.expiresAt == now.addingTimeInterval(600))
+    }
+
+    @Test func instanceLabelsRoundTripThroughActive() {
+        let minted = CmxPairingCode(code: "042117", expiresAt: now.addingTimeInterval(600))
+        let decoded = CmxPairingCode.active(in: minted.instanceLabels, now: now)
+        #expect(decoded == minted)
+    }
+
+    @Test func activeRejectsExpiredMissingOrUnparseableExpiry() {
+        let expired = CmxPairingCode(code: "042117", expiresAt: now.addingTimeInterval(-1))
+        #expect(CmxPairingCode.active(in: expired.instanceLabels, now: now) == nil)
+        #expect(CmxPairingCode.active(
+            in: [CmxPairingCode.codeLabelKey: "042117"],
+            now: now
+        ) == nil)
+        #expect(CmxPairingCode.active(
+            in: [
+                CmxPairingCode.codeLabelKey: "042117",
+                CmxPairingCode.expiresAtLabelKey: "not-a-date",
+            ],
+            now: now
+        ) == nil)
+        #expect(CmxPairingCode.active(in: [:], now: now) == nil)
+    }
+
+    @Test func activeAcceptsWholeSecondExpiryForm() {
+        let labels = [
+            CmxPairingCode.codeLabelKey: "042117",
+            CmxPairingCode.expiresAtLabelKey: "1970-01-01T00:33:20Z",
+        ]
+        let decoded = CmxPairingCode.active(in: labels, now: now)
+        #expect(decoded?.code == "042117")
+        #expect(decoded?.expiresAt == Date(timeIntervalSince1970: 2_000))
+    }
+
+    @Test func normalizedClaimInputAcceptsExactlySixDigits() {
+        #expect(CmxPairingCode.normalizedClaimInput("042117") == "042117")
+        #expect(CmxPairingCode.normalizedClaimInput(" 042 117 ") == "042117")
+        #expect(CmxPairingCode.normalizedClaimInput("042-117") == "042117")
+        #expect(CmxPairingCode.normalizedClaimInput("42117") == nil)
+        #expect(CmxPairingCode.normalizedClaimInput("0421178") == nil)
+        #expect(CmxPairingCode.normalizedClaimInput("０４２１１７") == nil)
+        #expect(CmxPairingCode.normalizedClaimInput("") == nil)
+    }
+}

Packages/iOS/CmuxMobilePairedMac/Package.swift → Packages/Shared/CmuxMobilePairedMac/Package.swift

@@ -15,7 +15,7 @@ let package = Package(
         ),
     ],
     dependencies: [
-        .package(path: "../../Shared/CMUXMobileCore"),
+        .package(path: "../CMUXMobileCore"),
     ],
     targets: [
         .target(

Packages/iOS/CmuxMobileRPC/Package.swift → Packages/Shared/CmuxMobileRPC/Package.swift

@@ -15,7 +15,7 @@ let package = Package(
         ),
     ],
     dependencies: [
-        .package(path: "../../Shared/CMUXMobileCore"),
+        .package(path: "../CMUXMobileCore"),
         .package(path: "../CmuxMobileShellModel"),
         .package(path: "../CmuxMobileSupport"),
     ],

Packages/iOS/CmuxMobileShell/Package.swift → Packages/Shared/CmuxMobileShell/Package.swift

@@ -19,11 +19,11 @@ let package = Package(
         ),
     ],
     dependencies: [
-        .package(path: "../../Shared/CMUXMobileCore"),
-        .package(path: "../../Shared/CmuxAgentChat"),
-        .package(path: "../CmuxMobileChanges"),
+        .package(path: "../CMUXMobileCore"),
+        .package(path: "../CmuxAgentChat"),
+        .package(path: "../../iOS/CmuxMobileChanges"),
         .package(path: "../CmuxMobileDiagnostics"),
-        .package(path: "../CmuxMobileBrowserStream"),
+        .package(path: "../../iOS/CmuxMobileBrowserStream"),
         .package(path: "../CmuxMobilePairedMac"),
         .package(path: "../CmuxMobileRPC"),
         .package(path: "../CmuxMobileShellModel"),

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/DeviceRegistryService.swift → Packages/Shared/CmuxMobileShell/Sources/CmuxMobileShell/DeviceRegistryService.swift

@@ -643,16 +643,24 @@ public actor DeviceRegistryService: DeviceRegistryRefreshing {
                 value = try? CmxAttachRoute(from: decoder)
             }
         }
+        struct FailableLabel: Decodable {
+            let value: String?
+            init(from decoder: any Decoder) throws {
+                value = try? decoder.singleValueContainer().decode(String.self)
+            }
+        }
         struct Instance: Decodable {
             let tag: String?
             let routes: [FailableRoute]?
             let lastSeenAt: String?
+            let labels: [String: FailableLabel]?
         }
         struct Device: Decodable {
             let deviceId: String
             let platform: String?
             let displayName: String?
             let lastSeenAt: String?
+            let isOwnedByCurrentUser: Bool?
             let instances: [Instance]?
         }
         struct ListResponse: Decodable {
@@ -669,7 +677,8 @@ public actor DeviceRegistryService: DeviceRegistryRefreshing {
                 return RegistryAppInstance(
                     tag: tag?.isEmpty == false ? tag! : "default",
                     routes: (instance.routes ?? []).compactMap(\.value),
-                    lastSeenAt: Self.parseTimestamp(instance.lastSeenAt)
+                    lastSeenAt: Self.parseTimestamp(instance.lastSeenAt),
+                    labels: (instance.labels ?? [:]).compactMapValues(\.value)
                 )
             }
             return RegistryDevice(
@@ -678,7 +687,8 @@ public actor DeviceRegistryService: DeviceRegistryRefreshing {
                     ? device.platform! : "mac",
                 displayName: device.displayName,
                 lastSeenAt: Self.parseTimestamp(device.lastSeenAt),
-                instances: instances
+                instances: instances,
+                isOwnedByCurrentUser: device.isOwnedByCurrentUser ?? false
             )
         }
     }