Merge upstream cmux main @ 4e9d779888 (2026-10-01)

.claude/skills/cmux-capture

@@ -0,0 +1 @@
+../../skills/cmux-capture

.gitattributes

@@ -9,14 +9,24 @@ Resources/markdown-viewer/webviews-app/** linguist-generated
 # Xcode string catalogs are one large JSON object keyed by string id. Two
 # branches that each add a different key collide positionally, producing dozens
 # of conflict hunks with no semantic disagreement. scripts/merge-xcstrings.py
-# merges per key and defers to the default driver whenever both sides changed
-# the same key. Register it with scripts/install-git-hooks.sh (run by setup.sh);
+# merges per key and writes an ordinary conflict whenever both sides changed the
+# same key. Register it with scripts/install-git-hooks.sh (run by setup.sh);
 # without that config git silently uses the default driver.
 *.xcstrings merge=xcstrings-v2
 
+# A merge can run right after checking out a fork branch, so a driver resolved
+# from the working tree would run that branch's code with the maintainer's
+# credentials. scripts/install-git-hooks.sh installs reviewed copies into
+# $GIT_COMMON_DIR/cmux-merge-drivers and configures absolute paths to those, so
+# what git executes is not what a branch can rewrite; it also repoints the
+# older checkout-relative merge.xcstrings name at the same trusted copy.
+# scripts/ci/catch_up_pr.py pins every driver to false instead, since catch-up
+# only needs to know which paths are unmerged.
+
 # The Xcode project file collides the same way, and for a sharper reason: no
 # target here is filesystem-synchronized, so adding one source file writes four
 # entries, and two branches adding different files append to all four of the
 # same regions. scripts/merge-pbxproj.py takes the union of entries each side
-# added and defers whenever a hunk is anything else. Same registration.
+# added and writes an ordinary conflict whenever a hunk is anything else. Same
+# registration.
 cmux.xcodeproj/project.pbxproj merge=pbxproj-v1

.github/actions/e2e-run-tests/action.yml

@@ -153,7 +153,16 @@ runs:
       if: ${{ inputs.record-video == 'true' }}
       shell: bash
       run: |
-        brew install --quiet ffmpeg
+        # The helper comes from this workflow's revision (checked out into
+        # .e2e-workflow beside this action) when it is there, since the tested
+        # revision may predate it.
+        helper="$GITHUB_WORKSPACE/.e2e-workflow/scripts/ci/brew-ensure.sh"
+        [ -f "$helper" ] || helper=scripts/ci/brew-ensure.sh
+        if [ -f "$helper" ]; then
+          bash "$helper" ffmpeg
+        else
+          brew install --quiet ffmpeg
+        fi
         FFMPEG_PATH=$(which ffmpeg)
         echo "ffmpeg: $FFMPEG_PATH"
         ffmpeg -version | head -1
@@ -196,10 +205,23 @@ runs:
     # The display-churn regression establishes its own display later.
     # Keep its existing recorder startup check at that point.
 
+    # A runner that cannot capture its display runs the tests without video
+    # instead of failing them: on 2026-09-25/26, 8 of 45 sampled Blacksmith
+    # 12vcpu and 2 of 15 6vcpu jobs stopped here with "could not create image
+    # from display", per machine rather than per pool, and the rescue's
+    # Blacksmith re-runs land on those pools.
     - name: Verify screen capture before dependency setup
+      id: capture
       if: ${{ inputs.record-video == 'true' && inputs.filter != 'DisplayResolutionRegressionUITests' }}
       shell: bash
-      run: python3 scripts/ci/preflight-e2e-screen-capture.py
+      run: |
+        if python3 scripts/ci/preflight-e2e-screen-capture.py; then
+          echo "available=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "available=false" >> "$GITHUB_OUTPUT"
+          echo "::warning::Screen capture is unavailable on $RUNNER_NAME; the tests run without video."
+          echo "**Recording:** skipped, screen capture is unavailable on runner \`$RUNNER_NAME\`; the tests ran without video." >> "$GITHUB_STEP_SUMMARY"
+        fi
 
     # A console session that cannot activate apps fails every UI test after
     # a one-minute wait each, as "Failed to activate application". Probe it
@@ -222,7 +244,11 @@ runs:
     - name: Install tmux
       shell: bash
       run: |
-        if ! command -v tmux >/dev/null 2>&1; then
+        helper="$GITHUB_WORKSPACE/.e2e-workflow/scripts/ci/brew-ensure.sh"
+        [ -f "$helper" ] || helper=scripts/ci/brew-ensure.sh
+        if [ -f "$helper" ]; then
+          bash "$helper" tmux
+        elif ! command -v tmux >/dev/null 2>&1; then
           brew install --quiet tmux
         fi
         tmux -V
@@ -411,7 +437,7 @@ runs:
         TEST_SELECTOR_COUNT: ${{ inputs.count }}
         NORMALIZED_FILTER: ${{ inputs.filter }}
         TEST_TIMEOUT: ${{ inputs.test-timeout }}
-        RECORD_VIDEO: ${{ inputs.record-video }}
+        RECORD_VIDEO: ${{ inputs.record-video == 'true' && steps.capture.outputs.available != 'false' && 'true' || 'false' }}
         DOGFOOD_SCENARIO_B64: ${{ inputs.dogfood-scenario }}
         # App-host crash recovery must not stall on interactive backtraces
         # (mirrors ci.yml's tests job hardening).
@@ -553,7 +579,13 @@ runs:
           XCTESTRUN_PATH="$CMUX_UI_XCTESTRUN"
           mkdir -p "$RUNNER_TEMP/cmux-app-host-xcresults"
           XCODEBUILD_CMD=(
-            xcodebuild
+            # UI dispatches used to invoke xcodebuild directly, bypassing the
+            # per-machine app-host lock and bounded retries already used by
+            # cmuxTests. Keep UI's existing non-isolated host environment,
+            # while applying the same runner-communication recovery. The
+            # wrapper removes a caller-owned result bundle before each retry.
+            env CMUX_CI_APP_HOST_ISOLATION_REQUIRED=0
+            scripts/ci/run-app-host-xcodebuild.sh
             -xctestrun "$XCTESTRUN_PATH"
             -resultBundlePath "$RUNNER_TEMP/cmux-app-host-xcresults/cmuxUITests.xcresult"
             -destination "platform=macOS"
@@ -794,7 +826,7 @@ runs:
 
     - name: Upload recording artifact
       id: recording
-      if: ${{ always() && inputs.record-video == 'true' }}
+      if: ${{ always() && inputs.record-video == 'true' && steps.capture.outputs.available != 'false' }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: test-recording
@@ -848,7 +880,7 @@ runs:
         COMMIT_SHA: ${{ inputs.source-revision }}
         REF_DISPLAY: ${{ inputs.ref-display }}
         RUN_ID: ${{ github.run_id }}
-        RECORD_VIDEO: ${{ inputs.record-video }}
+        RECORD_VIDEO: ${{ inputs.record-video == 'true' && steps.capture.outputs.available != 'false' && 'true' || 'false' }}
         RECORDING_URL: ${{ steps.recording.outputs.artifact-url }}
       shell: bash
       run: |

.github/contributor/welcome.md

@@ -6,5 +6,6 @@ A few things that help:
 
 - [Start here](https://github.com/manaflow-ai/cmux/blob/main/docs/start-here.md) covers what reviewers look for, what CI runs for you, and what happens next.
 - If the CLA check asks, reply with the sentence it gives you.
+- You don't need to run the app-host or UI tests locally. CI runs the ones your diff touches once a maintainer approves the first workflow run.
 - The [verification ladder](https://github.com/manaflow-ai/cmux/blob/main/docs/contributor-verification.md) shows which checks fit your change. Say in the description which ones you ran.
 - If we end up fixing the same problem another way, we'll credit you with a `Co-authored-by` trailer and link the fix here.

.github/labels.json

@@ -145,6 +145,26 @@
       "name": "help wanted",
       "color": "008672",
       "description": "Nobody on the team is working on this and we would take a patch"
+    },
+    {
+      "name": "difficulty:1",
+      "color": "5319E7",
+      "description": "Onboarding: one small, explicit surface"
+    },
+    {
+      "name": "difficulty:2",
+      "color": "5319E7",
+      "description": "Focused: one package or feature boundary"
+    },
+    {
+      "name": "difficulty:3",
+      "color": "5319E7",
+      "description": "Systems: multiple components or a runtime lifecycle"
+    },
+    {
+      "name": "difficulty:4",
+      "color": "5319E7",
+      "description": "Architecture: security, protocol, migration, release, or broad design"
     }
   ]
 }

.github/workflows/app-host-test-rerun.yml

@@ -228,6 +228,12 @@ jobs:
             mkdir -p "$dest"
             rsync -aL "$(dirname "$framework_source")/" "$dest/"
           done
+          # Source-backed test fixtures resolve #fileID through this stable
+          # location, so baseline runs do not need the producer root.
+          CMUX_CI_RUNTIME_SOURCE_ROOT=/private/tmp/cmux-test-source \
+            "$GITHUB_WORKSPACE/.rerun-tools/scripts/ci/canonical-build-root.sh" \
+            --runtime-source "$PWD"
+          echo "CMUX_CI_RUNTIME_SOURCE_ROOT=/private/tmp/cmux-test-source" >> "$GITHUB_ENV"
           receipt="$COMPILE_DERIVED_DATA/Build/Products/cmux-test-products.json"
           cat "$receipt"
           test "$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["revision"])' "$receipt")" = "$SOURCE_SHA"

.github/workflows/ci-failure-attribution.yml

@@ -8,7 +8,8 @@ name: CI failure attribution
 #   red or cancelled   each failed job gets a verdict (machine, code, unknown)
 #                      in the job summary and in one comment on the pull
 #                      request, edited in place; when every failed job of a
-#                      failed attempt 1 is machine, the failed jobs are re-run
+#                      failed attempt 1 or 2 is machine, the failed jobs are
+#                      re-run (attempt 3 goes to Blacksmith, which ends it)
 #   green              that comment, if any, says it passes now
 #
 # A PR's code never runs here: main's script reads the run's job logs and