Merge remote-tracking branch 'origin/main' into pr-ssh-stack-main

# Conflicts:
#	CLI/cmux.swift
#	Sources/Panels/BrowserPanel.swift
#	Sources/TabManager.swift
#	Sources/Workspace.swift
#	cmuxTests/GhosttyConfigTests.swift

scripts/build-ghostty-cli-helper.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: ./scripts/build-ghostty-cli-helper.sh [--universal | --target <zig-target>] --output <path>
+
+Options:
+  --universal      Build a universal macOS helper (arm64 + x86_64).
+  --target <triple>
+                   Build a single target, e.g. `aarch64-macos` or `x86_64-macos`.
+  --output <path>  Destination path for the built helper.
+EOF
+}
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+GHOSTTY_DIR="$REPO_ROOT/ghostty"
+
+OUTPUT_PATH=""
+TARGET_TRIPLE=""
+UNIVERSAL="false"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --universal)
+      UNIVERSAL="true"
+      shift
+      ;;
+    --target)
+      TARGET_TRIPLE="${2:-}"
+      shift 2
+      ;;
+    --output)
+      OUTPUT_PATH="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -z "$OUTPUT_PATH" ]]; then
+  echo "Missing required --output path" >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ "$UNIVERSAL" == "true" && -n "$TARGET_TRIPLE" ]]; then
+  echo "--universal and --target are mutually exclusive" >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ -n "$TARGET_TRIPLE" ]]; then
+  case "$TARGET_TRIPLE" in
+    aarch64-macos|x86_64-macos)
+      ;;
+    *)
+      echo "Unsupported --target value: $TARGET_TRIPLE" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+if ! command -v zig >/dev/null 2>&1; then
+  echo "error: zig is required to build the Ghostty CLI helper" >&2
+  exit 1
+fi
+
+if [[ ! -f "$GHOSTTY_DIR/build.zig" ]]; then
+  echo "error: Ghostty submodule is missing at $GHOSTTY_DIR" >&2
+  exit 1
+fi
+
+build_helper() {
+  local prefix="$1"
+  local target="${2:-}"
+  local args=(
+    zig build
+    cli-helper
+    -Dapp-runtime=none
+    -Demit-macos-app=false
+    -Demit-xcframework=false
+    -Doptimize=ReleaseFast
+    --prefix
+    "$prefix"
+  )
+
+  if [[ -n "$target" ]]; then
+    args+=("-Dtarget=$target")
+  fi
+
+  (
+    cd "$GHOSTTY_DIR"
+    "${args[@]}"
+  )
+}
+
+TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/cmux-ghostty-helper.XXXXXX")"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+mkdir -p "$(dirname "$OUTPUT_PATH")"
+
+if [[ "$UNIVERSAL" == "true" ]]; then
+  ARM64_PREFIX="$TMP_DIR/arm64"
+  X86_PREFIX="$TMP_DIR/x86_64"
+  build_helper "$ARM64_PREFIX" "aarch64-macos"
+  build_helper "$X86_PREFIX" "x86_64-macos"
+  /usr/bin/lipo -create \
+    "$ARM64_PREFIX/bin/ghostty" \
+    "$X86_PREFIX/bin/ghostty" \
+    -output "$OUTPUT_PATH"
+else
+  SINGLE_PREFIX="$TMP_DIR/single"
+  build_helper "$SINGLE_PREFIX" "$TARGET_TRIPLE"
+  install -m 755 "$SINGLE_PREFIX/bin/ghostty" "$OUTPUT_PATH"
+fi
+
+chmod +x "$OUTPUT_PATH"

scripts/build-sign-upload.sh

@@ -74,6 +74,12 @@ rm -rf build/
 xcodebuild -scheme cmux -configuration Release -derivedDataPath build CODE_SIGNING_ALLOWED=NO build 2>&1 | tail -5
 echo "Build succeeded"
 
+HELPER_PATH="$APP_PATH/Contents/Resources/bin/ghostty"
+if [ ! -x "$HELPER_PATH" ]; then
+  echo "Ghostty theme picker helper not found at $HELPER_PATH" >&2
+  exit 1
+fi
+
 # --- Inject Sparkle keys ---
 echo "Injecting Sparkle keys..."
 SPARKLE_PUBLIC_KEY_DERIVED=$(swift scripts/derive_sparkle_public_key.swift "$SPARKLE_PRIVATE_KEY")
@@ -90,6 +96,9 @@ CLI_PATH="$APP_PATH/Contents/Resources/bin/cmux"
 if [ -f "$CLI_PATH" ]; then
   /usr/bin/codesign --force --options runtime --timestamp --sign "$SIGN_HASH" --entitlements "$ENTITLEMENTS" "$CLI_PATH"
 fi
+if [ -f "$HELPER_PATH" ]; then
+  /usr/bin/codesign --force --options runtime --timestamp --sign "$SIGN_HASH" --entitlements "$ENTITLEMENTS" "$HELPER_PATH"
+fi
 /usr/bin/codesign --force --options runtime --timestamp --sign "$SIGN_HASH" --entitlements "$ENTITLEMENTS" --deep "$APP_PATH"
 /usr/bin/codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 echo "Codesign verified"