Isolate app-host tests from runner user config

.github/workflows/ci.yml

@@ -151,6 +151,9 @@ jobs:
       - name: Validate app-host xcodebuild attempt budget
         run: ./tests/test_ci_app_host_xcodebuild_attempts.sh
 
+      - name: Validate app-host user configuration isolation
+        run: python3 tests/test_ci_app_host_home_isolation.py
+
       - name: Validate cmux profiling support scripts
         run: ./tests/test_start_cmux_profiling.sh
 
@@ -548,6 +551,24 @@ jobs:
           mkdir -p "$DERIVED_DATA_PATH"
           echo "CMUX_DERIVED_DATA_PATH=$DERIVED_DATA_PATH" >> "$GITHUB_ENV"
 
+      - name: Prepare isolated app-host home
+        run: |
+          set -euo pipefail
+          APP_HOST_HOME="${RUNNER_TEMP}/cmux-app-host-home-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-shard-${{ matrix.shard }}"
+          rm -rf "$APP_HOST_HOME"
+          mkdir -p \
+            "$APP_HOST_HOME/.config/cmux" \
+            "$APP_HOST_HOME/.config/ghostty" \
+            "$APP_HOST_HOME/Library/Application Support" \
+            "$APP_HOST_HOME/Library/Caches" \
+            "$APP_HOST_HOME/Library/Logs/DiagnosticReports" \
+            "$APP_HOST_HOME/Library/Preferences"
+          chmod -R a+rwX "$APP_HOST_HOME"
+          echo "CFFIXED_USER_HOME=$APP_HOST_HOME" >> "$GITHUB_ENV"
+          echo "XDG_CONFIG_HOME=$APP_HOST_HOME/.config" >> "$GITHUB_ENV"
+          echo "CARGO_HOME=${HOME}/.cargo" >> "$GITHUB_ENV"
+          echo "RUSTUP_HOME=${HOME}/.rustup" >> "$GITHUB_ENV"
+
       - name: Resolve Swift packages
         run: |
           set -euo pipefail

cmux.xcodeproj/project.pbxproj

@@ -11135,6 +11135,8 @@ C0DE71B10000000000000002 /* AppDelegate+AgentChatNotifications.swift */ = {isa =
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = "AppIcon-Debug";
+				CMUX_APP_HOST_HOME = "$(HOME)";
+				CMUX_APP_HOST_XDG_CONFIG_HOME = "$(XDG_CONFIG_HOME:default=$(HOME)/.config)";
 				CMUX_AUTH_CALLBACK_SCHEME = "cmux-dev";
 				CMUX_IROH_RELAY_POLICY_KEY_ID = "cmux-staging-relay-policy-2026-07";
 				CMUX_IROH_RELAY_POLICY_NEXT_KEY_ID = "cmux-staging-relay-policy-2026-08";
@@ -11185,6 +11187,8 @@ C0DE71B10000000000000002 /* AppDelegate+AgentChatNotifications.swift */ = {isa =
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CMUX_APP_HOST_HOME = "$(HOME)";
+				CMUX_APP_HOST_XDG_CONFIG_HOME = "$(XDG_CONFIG_HOME:default=$(HOME)/.config)";
 				CMUX_AUTH_CALLBACK_SCHEME = cmux;
 				CMUX_IROH_RELAY_POLICY_KEY_ID = "cmux-production-relay-policy-2026-07";
 				CMUX_IROH_RELAY_POLICY_NEXT_KEY_ID = "cmux-production-relay-policy-2026-08";

cmux.xcodeproj/xcshareddata/xcschemes/cmux-unit.xcscheme

@@ -29,6 +29,11 @@
       <BuildableReference BuildableIdentifier="primary" BlueprintIdentifier="A5001050" BuildableName="cmux.app" BlueprintName="cmux" ReferencedContainer="container:cmux.xcodeproj"/>
     </MacroExpansion>
     <EnvironmentVariables>
+      <EnvironmentVariable key="HOME" value="$(CMUX_APP_HOST_HOME)" isEnabled="YES"/>
+      <EnvironmentVariable key="CFFIXED_USER_HOME" value="$(CMUX_APP_HOST_HOME)" isEnabled="YES"/>
+      <EnvironmentVariable key="XDG_CONFIG_HOME" value="$(CMUX_APP_HOST_XDG_CONFIG_HOME)" isEnabled="YES"/>
+      <EnvironmentVariable key="CMUX_APP_HOST_EXPECTED_HOME" value="$(CMUX_APP_HOST_HOME)" isEnabled="YES"/>
+      <EnvironmentVariable key="CMUX_APP_HOST_EXPECTED_XDG_CONFIG_HOME" value="$(CMUX_APP_HOST_XDG_CONFIG_HOME)" isEnabled="YES"/>
       <EnvironmentVariable key="SWIFT_BACKTRACE" value="interactive=no,timeout=0s,symbolicate=off,color=no" isEnabled="YES"/>
     </EnvironmentVariables>
   </TestAction>

cmuxTests/MacSentryStartupPolicyTests.swift

@@ -1,4 +1,5 @@
 import Testing
+import Foundation
 
 #if canImport(cmux_DEV)
 @testable import cmux_DEV
@@ -7,6 +8,43 @@ import Testing
 #endif
 
 @Suite struct MacSentryStartupPolicyTests {
+    @Test func appHostUsesSchemeScopedUserConfigurationHome() throws {
+        let environment = ProcessInfo.processInfo.environment
+        let expectedHome = try #require(
+            environment["CMUX_APP_HOST_EXPECTED_HOME"],
+            "The cmux-unit scheme must publish its resolved app-host home"
+        )
+        let expectedXDGConfigHome = try #require(
+            environment["CMUX_APP_HOST_EXPECTED_XDG_CONFIG_HOME"],
+            "The cmux-unit scheme must publish its resolved XDG config home"
+        )
+
+        #expect(environment["HOME"] == expectedHome)
+        #expect(environment["CFFIXED_USER_HOME"] == expectedHome)
+        #expect(environment["XDG_CONFIG_HOME"] == expectedXDGConfigHome)
+        #expect(FileManager.default.homeDirectoryForCurrentUser.path == expectedHome)
+        #expect(
+            FileManager.default.urls(
+                for: .applicationSupportDirectory,
+                in: .userDomainMask
+            ).first?.path
+                == URL(fileURLWithPath: expectedHome, isDirectory: true)
+                    .appendingPathComponent(
+                        "Library/Application Support",
+                        isDirectory: true
+                    ).path
+        )
+        #expect(
+            NSString(string: "~/Library/Application Support")
+                .expandingTildeInPath
+                == URL(fileURLWithPath: expectedHome, isDirectory: true)
+                    .appendingPathComponent(
+                        "Library/Application Support",
+                        isDirectory: true
+                    ).path
+        )
+    }
+
     @Test func xctestLaunchDoesNotStartSentry() {
         #expect(
             MacSentryStartupPolicy(

scripts/ci/run-app-host-xcodebuild.sh

@@ -29,6 +29,25 @@ if [ -z "${CMUX_APP_HOST_TEST_LOCK_ACTIVE:-}" ]; then
     "$lock_file" "$lock_wait_seconds" "$0" "$@"
 fi
 
+# xcodebuild must retain the console user's real HOME so Xcode and its package
+# toolchains remain available. Capture isolation only after the lock re-exec,
+# pass it as build settings, then remove the app-host-only redirects from the
+# driver environment. The cmux-unit TestAction applies them to the launched app.
+app_host_xcodebuild_settings=()
+app_host_home=""
+if [ -n "${CFFIXED_USER_HOME:-}" ]; then
+  if [ -z "${XDG_CONFIG_HOME:-}" ]; then
+    echo "FAIL: CFFIXED_USER_HOME requires XDG_CONFIG_HOME for app-host isolation" >&2
+    exit 1
+  fi
+  app_host_home="$CFFIXED_USER_HOME"
+  app_host_xcodebuild_settings+=(
+    "CMUX_APP_HOST_HOME=$CFFIXED_USER_HOME"
+    "CMUX_APP_HOST_XDG_CONFIG_HOME=$XDG_CONFIG_HOME"
+  )
+  unset CFFIXED_USER_HOME XDG_CONFIG_HOME
+fi
+
 # Resolve a CI-scoped root so app-host cleanup targets every CI app-host on this
 # Mac (this run AND orphans left by previous runs, which live under a different
 # per-run DerivedData path), while never matching a human's tagged dev build
@@ -51,6 +70,27 @@ kill_stale_app_host() {
     pkill -f "${ci_app_host_root%/}/.*Build/Products/.*cmux DEV" 2>/dev/null || true
 }
 
+validate_app_host_config_paths() {
+  local log_path="$1"
+  [ -n "$app_host_home" ] || return 0
+
+  local expected_root="${app_host_home%/}/Library/Application Support/com.mitchellh.ghostty"
+  local line
+  while IFS= read -r line; do
+    case "$line" in
+      *"path=$expected_root"*) ;;
+      *)
+        echo "FAIL: Ghostty accessed configuration outside the isolated app-host home" >&2
+        echo "$line" >&2
+        return 1
+        ;;
+    esac
+  done < <(
+    grep -E '\[(config|default)\].*path=.*Library/Application Support/com\.mitchellh\.ghostty' \
+      "$log_path" || true
+  )
+}
+
 attempt=1
 while [ "$attempt" -le "$max_attempts" ]; do
   log_path="${log_stem}-attempt-${attempt}.log"
@@ -64,10 +104,15 @@ while [ "$attempt" -le "$max_attempts" ]; do
   set +e
   TEST_RUNNER_CMUX_TEST_PROCESS=1 \
     CMUX_XCODEBUILD_NONINTERACTIVE_LOG_PATH="$log_path" \
-    scripts/ci/xcodebuild_noninteractive.py xcodebuild "$@"
+    scripts/ci/xcodebuild_noninteractive.py xcodebuild "$@" \
+      "${app_host_xcodebuild_settings[@]}"
   status=$?
   set -e
 
+  if ! validate_app_host_config_paths "$log_path"; then
+    exit 1
+  fi
+
   if grep -Fq 'path = "/tmp/cmux-debug.sock"' "$log_path"; then
     echo "FAIL: app-host used default debug socket instead of an XCTest-scoped socket" >&2
     exit 1

scripts/ci/run-in-console-session.sh

@@ -27,6 +27,13 @@ if [ "$#" -eq 0 ]; then
   exit 2
 fi
 
+# App-host CI redirects Apple and XDG state while retaining the console user's
+# real HOME for Xcode and the GUI login session. Never let a reused runner's
+# personal SSH agent leak into tests that model agent forwarding explicitly.
+if [ -n "${CFFIXED_USER_HOME:-}" ]; then
+  unset SSH_AUTH_SOCK
+fi
+
 console_user="$(stat -f %Su /dev/console 2>/dev/null || true)"
 if [ -n "$console_user" ] && [ "$console_user" != "root" ] \
   && console_uid="$(id -u "$console_user" 2>/dev/null)" && sudo -n true 2>/dev/null; then
@@ -43,7 +50,8 @@ if [ -n "$console_user" ] && [ "$console_user" != "root" ] \
     CMUX_XCODEBUILD_NONINTERACTIVE_IDLE_TIMEOUT_SECONDS \
     CMUX_XCODEBUILD_NONINTERACTIVE_POST_TEST_TIMEOUT_SECONDS \
     CMUX_XCODEBUILD_NONINTERACTIVE_TIMEOUT_SECONDS \
-    CMUX_APP_HOST_XCODEBUILD_ATTEMPTS)
+    CMUX_APP_HOST_XCODEBUILD_ATTEMPTS \
+    CFFIXED_USER_HOME XDG_CONFIG_HOME CARGO_HOME RUSTUP_HOME)
   env_pairs=()
   for var in "${forward[@]}"; do
     if [ -n "${!var+set}" ]; then

tests/test_ci_app_host_home_isolation.py

@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+"""Guard app-host XCTest against persistent console-user configuration."""
+
+from pathlib import Path
+import xml.etree.ElementTree as ET
+
+import yaml
+
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW_PATH = ROOT / ".github/workflows/ci.yml"
+WORKFLOW = yaml.safe_load(WORKFLOW_PATH.read_text(encoding="utf-8"))
+CONSOLE_WRAPPER = (ROOT / "scripts/ci/run-in-console-session.sh").read_text(
+    encoding="utf-8"
+)
+APP_HOST_WRAPPER = (ROOT / "scripts/ci/run-app-host-xcodebuild.sh").read_text(
+    encoding="utf-8"
+)
+UNIT_SCHEME_PATH = (
+    ROOT / "cmux.xcodeproj/xcshareddata/xcschemes/cmux-unit.xcscheme"
+)
+PROJECT = (ROOT / "cmux.xcodeproj/project.pbxproj").read_text(encoding="utf-8")
+
+
+def require(text: str, needle: str, context: str) -> None:
+    if needle not in text:
+        raise SystemExit(f"FAIL: {context} is missing {needle!r}")
+
+
+def require_step(job_name: str, step_name: str) -> dict:
+    if not isinstance(WORKFLOW, dict):
+        raise SystemExit("FAIL: workflow must be a mapping")
+
+    jobs = WORKFLOW.get("jobs")
+    if not isinstance(jobs, dict):
+        raise SystemExit("FAIL: workflow jobs must be a mapping")
+
+    job = jobs.get(job_name)
+    if not isinstance(job, dict):
+        raise SystemExit(f"FAIL: workflow job {job_name!r} is missing")
+
+    steps = job.get("steps")
+    if not isinstance(steps, list):
+        raise SystemExit(f"FAIL: workflow job {job_name!r} steps must be a list")
+
+    matches = []
+    for index, step in enumerate(steps):
+        if not isinstance(step, dict):
+            raise SystemExit(
+                f"FAIL: workflow job {job_name!r} step {index} must be a mapping"
+            )
+        if step.get("name") == step_name:
+            matches.append(step)
+    if len(matches) != 1:
+        raise SystemExit(
+            f"FAIL: workflow job {job_name!r} must contain exactly one "
+            f"{step_name!r} step"
+        )
+    return matches[0]
+
+
+def main() -> int:
+    setup_step = require_step(
+        "app-host-unit-tests", "Prepare isolated app-host home"
+    )
+    setup_run = setup_step.get("run")
+    if not isinstance(setup_run, str):
+        raise SystemExit("FAIL: isolated app-host setup step has no run script")
+
+    requirements = {
+        "per-shard app-host home": (
+            "APP_HOST_HOME=\"${RUNNER_TEMP}/cmux-app-host-home-"
+            "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-shard-${{ matrix.shard }}\""
+        ),
+        "Core Foundation home redirect": (
+            'echo "CFFIXED_USER_HOME=$APP_HOST_HOME" >> "$GITHUB_ENV"'
+        ),
+        "XDG configuration redirect": (
+            'echo "XDG_CONFIG_HOME=$APP_HOST_HOME/.config" >> "$GITHUB_ENV"'
+        ),
+        "console-user write access": 'chmod -R a+rwX "$APP_HOST_HOME"',
+        "real Cargo toolchain home": 'echo "CARGO_HOME=${HOME}/.cargo" >> "$GITHUB_ENV"',
+        "real rustup toolchain home": 'echo "RUSTUP_HOME=${HOME}/.rustup" >> "$GITHUB_ENV"',
+    }
+    for context, needle in requirements.items():
+        require(setup_run, needle, context)
+
+    guard_step = require_step(
+        "workflow-guard-tests", "Validate app-host user configuration isolation"
+    )
+    if guard_step.get("run") != "python3 tests/test_ci_app_host_home_isolation.py":
+        raise SystemExit("FAIL: workflow-guard-tests does not run this guard")
+
+    require(
+        CONSOLE_WRAPPER,
+        "CFFIXED_USER_HOME XDG_CONFIG_HOME CARGO_HOME RUSTUP_HOME",
+        "console-session environment forwarding",
+    )
+    require(
+        CONSOLE_WRAPPER,
+        "unset SSH_AUTH_SOCK",
+        "ambient SSH agent removal",
+    )
+    require(
+        CONSOLE_WRAPPER,
+        'env HOME="$console_home"',
+        "console-session Unix home preservation",
+    )
+
+    scheme_root = ET.parse(UNIT_SCHEME_PATH).getroot()
+    test_action = scheme_root.find("TestAction")
+    if test_action is None:
+        raise SystemExit("FAIL: cmux-unit scheme has no TestAction")
+    environment_variables = test_action.find("EnvironmentVariables")
+    if environment_variables is None:
+        raise SystemExit("FAIL: cmux-unit TestAction has no environment variables")
+    scheme_environment = {
+        item.get("key"): item.get("value")
+        for item in environment_variables.findall("EnvironmentVariable")
+        if item.get("isEnabled") == "YES"
+    }
+    expected_scheme_environment = {
+        "HOME": "$(CMUX_APP_HOST_HOME)",
+        "CFFIXED_USER_HOME": "$(CMUX_APP_HOST_HOME)",
+        "XDG_CONFIG_HOME": "$(CMUX_APP_HOST_XDG_CONFIG_HOME)",
+        "CMUX_APP_HOST_EXPECTED_HOME": "$(CMUX_APP_HOST_HOME)",
+        "CMUX_APP_HOST_EXPECTED_XDG_CONFIG_HOME": (
+            "$(CMUX_APP_HOST_XDG_CONFIG_HOME)"
+        ),
+    }
+    for key, value in expected_scheme_environment.items():
+        if scheme_environment.get(key) != value:
+            raise SystemExit(
+                f"FAIL: cmux-unit TestAction must set {key}={value}"
+            )
+
+    for context, needle in {
+        "app-host HOME build-setting default": 'CMUX_APP_HOST_HOME = "$(HOME)";',
+        "app-host XDG build-setting default": (
+            'CMUX_APP_HOST_XDG_CONFIG_HOME = '
+            '"$(XDG_CONFIG_HOME:default=$(HOME)/.config)";'
+        ),
+    }.items():
+        if PROJECT.count(needle) < 2:
+            raise SystemExit(
+                f"FAIL: Debug and Release app targets need {context}: {needle}"
+            )
+
+    for context, needle in {
+        "app-host HOME xcodebuild override": (
+            '"CMUX_APP_HOST_HOME=$CFFIXED_USER_HOME"'
+        ),
+        "app-host XDG xcodebuild override": (
+            '"CMUX_APP_HOST_XDG_CONFIG_HOME=$XDG_CONFIG_HOME"'
+        ),
+        "Ghostty app-support path validation": (
+            "validate_app_host_config_paths"
+        ),
+    }.items():
+        require(APP_HOST_WRAPPER, needle, context)
+
+    print("PASS: app-host XCTest receives an isolated launch home")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())