Repository navigation
Support native Windows SSH machines in cmux-tui - #9682
Closed
lawrencecchen wants to merge 108 commits into
Closed
lawrencecchen wants to merge 108 commits into
lawrencecchen wants to merge 108 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughNative Windows SSH support adds shell-aware bootstrapping, companion installation, authenticated local sockets, persistent mux ownership, ConPTY validation, and package checks. Machine connections gain cancellation and deadlines. Asynchronous tests use deterministic stream and signal synchronization. ChangesNative Windows remote runtime
Connection lifecycle and recovery
Deterministic asynchronous tests
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (3 errors, 1 warning)
✅ Passed checks (21 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
lawrencecchen
force-pushed
the
feat-tui-native-windows
branch
from
August 6, 2026 02:36
9c9a859 to
c3896be
Compare
lawrencecchen
force-pushed
the
feat-tui-native-windows
branch
from
August 6, 2026 02:43
c3896be to
2b115c3
Compare
lawrencecchen
marked this pull request as ready for review
August 6, 2026 03:13
Bugbot is paused — on-demand spend limit reachedBugbot uses usage-based billing for this team and has hit its on-demand spend limit. A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue. |
Contributor
|
Too many files changed for review (820 files, 100 file limit). |
Bugbot is paused — on-demand spend limit reachedBugbot uses usage-based billing for this team and has hit its on-demand spend limit. A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue. |
Bugbot is paused — on-demand spend limit reachedBugbot uses usage-based billing for this team and has hit its on-demand spend limit. A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue. |
Bugbot is paused — on-demand spend limit reachedBugbot uses usage-based billing for this team and has hit its on-demand spend limit. A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue. |
# Conflicts: # cmux-tui/crates/cmux-tui-core/src/mux.rs # cmux-tui/crates/cmux-tui-core/src/workspace_registry.rs # cmux-tui/crates/cmux-tui/src/machine_provider_client.rs
Bugbot is paused — on-demand spend limit reachedBugbot uses usage-based billing for this team and has hit its on-demand spend limit. A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue. |
Bugbot is paused — on-demand spend limit reachedBugbot uses usage-based billing for this team and has hit its on-demand spend limit. A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue. |
* test: remove APNs wall-clock waits * test: prove APNs owner event synchronization * ci: retain exact-head cmux-tui verification * test(auth): bound push registration waits * test(auth): release request observers * test(auth): consume buffered request count * test(auth): remove racy stream cancellation check
This was referenced Aug 14, 2026
lawrencecchen
added
the
stale-revisit
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #9447.
Adds native x86_64 Windows OpenSSH machines without requiring WSL. The client detects
cmd.exe, installs a matching Windows companion over SCP, protects remote state with a current-user DACL, bridges the mux control socket on Windows, and launches terminal surfaces through ConPTY.Packaged npm and PyPI distributions carry the matching Windows companion. Development builds discover the matching sibling executable or accept
CMUX_TUI_WINDOWS_REMOTE_BINARY.Windows sessions use a detached resident mux owner. Carrier loss no longer owns or closes the mux or its ConPTY children. The per-machine connection hub keeps connected carriers warm while cmux-tui runs, selection is immediate, and each connection attempt has a finite deadline with visible loading and copyable errors.
The stale-owner recovery is deliberately narrow. SSH bootstrap accepts a failed legacy stop only for an explicit Windows
cmd.exetarget whose bounded stderr contains bothmux.sockand exact(os error 10050). The native Windows helper treats raw WSAENETDOWN 10050 as an absent orphaned AF_UNIX socket. An unrelated-error negative test prevents generic 10050 transport failures from being hidden.The Windows stdio carrier now flushes every opaque AF_UNIX read chunk to stdout. Rust's line-buffered
StdoutLockpreviously retained the owner's first 100-byte Noise reply until EOF, so the client waited, timed out, and closed stdin before the next handshake frame. The relay still forwards the existing length-delimited Noise bytes unchanged.Verification:
d4a57a569331c175ab2400277e5a8bd38a0f7d49run: https://github.com/manaflow-ai/cmux/actions/runs/31095220439cmux-windows: started an isolated resident owner, force-killed only that PID, confirmedmux.sockremained, recovered withremote-stop, started a replacement owner, and cleanly stopped it33a5a14afareal-Windows stdio proof: authenticated handshake timed out after 6.25 seconds and reported the carrier closure556f066df3real-Windows stdio proof: the identical authenticated handshake passed in 1.37 secondscargo +1.94.0 zigbuild -p cmux-tui --target x86_64-pc-windows-gnu --bin cmux-tui --locked,rustfmt --check, andgit diff --checkpassThe exact pre-fix full run https://github.com/manaflow-ai/cmux/actions/runs/31108875010 has an unrelated bindings job setup failure. The unchanged job omits
npm ci, so global TypeScript lacks@types/node, and Zig 0.16 rejects the unchanged adapter's olderstd.fs.FileAPI. PR 9682 changes neither binding source nor that job. PR 9387 separately restores the public resource API tocmux.protocol/2.Note
High Risk
Changes authentication boundaries (owner-only local evidence), remote daemon lifecycle on Windows, SSH bootstrap/install, and DACL enforcement—security-critical remote access paths with large cross-platform surface area.
Overview
Enables native Windows OpenSSH machines without WSL: SSH bootstrap detects
cmd.exe, installs a matching Windows companion via SCP, and runsremote-linkthrough one cmd-safe remote command with resolved shell/binary targets.On Windows remotes, the daemon can listen on a DACL-protected AF_UNIX socket with owner-only local carrier auth, an async socket bridge for blocking
uds_windowsI/O, secure LOCALAPPDATA state directories, and mux control over the same socket path. Carrier-scoped session policy (resume_lease = 0) closes logical sessions when the stdio carrier drops so a detached resident mux owner keeps ConPTY children alive across SSH reconnects.SSH provider changes add Windows cmd remotes, stderr diagnostics on carrier close, and a registry of resolved targets; legacy Windows
remote-stopfailures are ignored only for narrow upgrade cases (explicit unsupported message or stalemux.sock+ os error 10050).CI and packaging require
include_windows=truefor npm/PyPI, download the Windows artifact into package verification, and expand hosted Windows smoke (native tests, remote-probe/link, OpenSSH script, ConPTY). Machine connections gain cancellation checks and timeout messaging; non-Unix mux recovery discards unrecoverable restored terminals instead of empty tabs.Smaller fixes: iOS push registration tests wait on AsyncStream snapshots instead of clock polling; relay e2e disables heartbeat during forced disconnect; PATH resolution skips zero-byte Windows app execution aliases.
Reviewed by Cursor Bugbot for commit e9b03ae. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit