* Pre-launch app for browser UI test on headless CI runners
XCUIApplication.launch() blocks ~60s then fails on headless WarpBuild
runners because foreground activation requires a GUI login session.
Apply the same pre-launch strategy used for the display resolution test:
- CI shell launches the app with env vars before running xcodebuild
- Test detects pre-launched app via manifest, uses activate() instead of
launch() to avoid killing and relaunching the app
- Falls back to clicking the window for focus via accessibility framework
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Revert "Pre-launch app for browser UI test on headless CI runners"
This reverts commit a540e2fd99aaa1395b91a8d50caa797cdd7551b8.
* feat: cmux.json for custom commands
* tests: add cmux json tests
* fix: pr review feedback: validation, translations, input handling, and palette improvements
- Fix Danish ("Overfladedef inition") and Norwegian ("rotmapp") translation typos
- Add empty-string check for baseCwd fallback in command palette handlers
- Coalesce \r\n into single Return keypress in sendInput
- Redact command text from timeout log to prevent secret leakage
- Add decode-time validation: reject hybrid/empty commands, ambiguous layout
nodes, wrong split children count, and empty pane surfaces
- Namespace custom command IDs with "cmux.config.command." prefix
- Forward command description to palette subtitle when available
- Update tests for new validation rules and ID prefix
* fix: address PR review feedback — per-window config isolation, blank validation, ancestor walk,
palette sanitization
* fix: fallback to current dir cmux.json watching if no any cmux.json found in full acesor walk
* ci: trigger CI for fork PR
* Add directory trust for cmux.json command confirmation
The confirm dialog now shows the actual command text and has an "Always
trust commands from this folder" checkbox. When checked, future confirm
commands from that directory skip the dialog.
Trust is scoped to the git repo root if the cmux.json is inside a repo,
so trusting once covers all subdirectories. Non-git directories are
trusted by exact path. Global config is always trusted.
Trusted directories are persisted in ~/Library/Application Support/cmux/
trusted-directories.json.
* Add trusted directories section to Settings
Shows all trusted directories with per-directory revoke buttons and a
Clear All option. Placed in a "Custom Commands" section between
Automation and Browser in Settings.
* Replace trusted directories list with editable textarea
One path per line, with a Save button that activates on changes.
Users can add, remove, or edit paths directly.
* Auto-save trusted directories on edit, remove Save button
Matches the behavior of other textarea settings (browser host
whitelist, external URL patterns) which auto-save via @AppStorage.
* Sanitize command text in confirm dialog against BiDi attacks
Strip zero-width and BiDi override characters from the command preview
so the dialog shows exactly what will be executed.
---------
Co-authored-by: austinpower1258 <austinwang115@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
* fix: prevent Japanese IME confirmation Enter from executing command
Korean IME commits a syllable and executes on a single Enter, but
Japanese/Chinese IME use Enter only to confirm conversion — a second
Enter is needed to execute. Restrict the extra Return forwarding in
shouldSendCommittedIMEConfirmKey to Korean input sources only.
* refactor: use case-insensitive check for Korean input source ID
* Export CMUX_SOCKET alongside CMUX_SOCKET_PATH in terminal environment
The app only exported CMUX_SOCKET_PATH when setting up the terminal
environment, but some scripts and hooks (e.g. claude-hook) expect
CMUX_SOCKET. The CLI launcher code already exports both (cmux.swift
lines 9288-9289), but the app-side terminal setup was missing the
alias. This caused claude-hook stop to fail with 'TabManager not
available' when CMUX_SOCKET was empty.
Fixes#1905
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Cache socketPath to avoid redundant call
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix all split panes appearing focused after layout restoration
Ghostty C surfaces default to focused=true (Terminal.zig), but
TerminalSurface.lastFocusState was initialized to false. During
restoration, unfocus() is called before C surfaces exist (views not in
window yet), so the ghostty_surface_set_focus(false) call was silently
dropped. When surfaces were later created, the dedup guard
(false != false) prevented the unfocus from ever reaching the renderer.
Three changes:
- Initialize lastFocusState=true to match Ghostty's default
- In setFocus(), update lastFocusState before the surface-nil guard so
the desired state is tracked even when the C surface doesn't exist yet
- In createSurface(), sync focus state after creation so surfaces that
were logically unfocused before the C surface existed get the correct
state applied
Fixes https://github.com/manaflow-ai/cmux/issues/2080
* Sync focus state unconditionally in createSurface
Per review feedback: always call ghostty_surface_set_focus(createdSurface,
lastFocusState) instead of only syncing when !lastFocusState. This avoids
coupling to Ghostty's default focused=true and is more robust if the
upstream default ever changes.
* Keep lastFocusState in sync with AppKit responder focus calls
The becomeFirstResponder, resignFirstResponder, and ctrl-key fast paths
call ghostty_surface_set_focus directly without updating lastFocusState.
This could cause the dedup guard in setFocus() to skip a needed call, or
createSurface() to replay a stale state on surface recreation.
Add recordExternalFocusState() and call it alongside each direct C focus
call so lastFocusState stays authoritative.
* Rename lastFocusState to desiredFocusState
The variable now tracks focus intent (may be set before the C surface
exists), not just the last-applied state. Update the name and doc
comment to reflect this.
---------
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
Double-clicking to select text in the terminal was causing unwanted cursor
movement because the mouse position was being updated on both the first and
second clicks. This disrupted the selection gesture and caused the cursor to
jump to a different position than intended.
Fix by only updating the mouse position on the first click (clickCount == 1),
allowing the terminal's selection logic to handle multi-click gestures without
cursor interference.
Fixesmanaflow-ai/cmux#1698
Co-authored-by: BillionClaw <267901332+BillionClaw@users.noreply.github.com>
Use charactersIgnoringModifiers instead of characters when redispatching
Cmd-modified key events in performKeyEquivalent. Cmd-modified keys don't
produce text characters, so event.characters returns an empty string for
Cmd+Shift combos, preventing Ghostty from encoding them as kitty protocol
sequences. charactersIgnoringModifiers returns the actual key character
(e.g. "k" for Cmd+Shift+K) while modifiers are preserved in modifierFlags.
Fixes#1718
Co-authored-by: CHE-3 <schumannzheng@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Publishing changes from background threads is not allowed in macOS 26
(Tahoe). Ghostty action callbacks run on I/O threads but were modifying
AppKit view properties and posting notifications without dispatching to
the main thread.
Fixes:
- GHOSTTY_ACTION_SCROLLBAR: wrap in DispatchQueue.main.async
- GHOSTTY_ACTION_CELL_SIZE: wrap in DispatchQueue.main.async
- GHOSTTY_ACTION_COLOR_CHANGE: wrap background color updates in main async
- GHOSTTY_ACTION_CONFIG_CHANGE: wrap background color clear in main async
ghostty_surface_quicklook_font returns an unretained CTFont pointer that
can become stale on Intel Macs, leading to EXC_BAD_ACCESS (SIGSEGV) when
creating a split. This is a follow-up to the same crash pattern fixed in
#1496.
Add malloc_size validation in cmuxCurrentSurfaceFontSizePoints to detect
freed heap allocations before interpreting the pointer as a CTFont. Also
add hasLiveSurface guards in inheritedTerminalConfig and
rememberTerminalConfigInheritanceSource to skip surfaces whose native
state is closing or closed. All callers already handle nil gracefully by
falling back to inherited config values.
Two root causes for issue #879:
1. GhosttyNSView was missing makeBackingLayer(), so AppKit provided a
generic CALayer as the view's backing layer. libghostty expects
(view.layer as? CAMetalLayer) != nil to set up Metal rendering on
the existing layer. Without a CAMetalLayer backing layer, the Metal
surface defaulted to isOpaque=true, making the terminal area fully
opaque regardless of background-opacity config.
Fix: override makeBackingLayer() to return a CAMetalLayer with
isOpaque=false and bgra8Unorm pixel format (matching standalone
Ghostty's SurfaceView behavior).
2. ghostty_set_window_background_blur(app, window) is exposed in
ghostty.h but was never called in cmux. Without this call the
macOS window never gets the NSVisualEffectView blur backdrop that
background-blur requires.
Fix: add applyWindowBlurIfNeeded() on GhosttyApp that reads
background-blur from config via ghostty_config_get and calls
ghostty_set_window_background_blur when the value is non-zero.
Called from applyBackgroundToKeyWindow() and
applyWindowBackgroundIfActive() whenever the window is made
transparent.
Fixes#879
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: skip Korean from CJK font-codepoint-map auto-injection
The automatic CJK font-codepoint-map injection (PR #1017) maps Korean
ranges to Apple SD Gothic Neo, which has a different style/weight from
the primary terminal font. This overrides Ghostty's native
CTFontCreateForString fallback, which dynamically selects a
better-matching font for Hangul.
Ghostty itself (ghostty-org/ghostty) has no hardcoded CJK font names
and relies entirely on CTFontCreateForString for fallback. For Korean,
this native fallback produces visually consistent results with the
primary font.
Remove the Korean branch from cjkFontMappings() so Ghostty's native
fallback handles Hangul rendering. Japanese and Chinese mappings are
unaffected.
* test: update CJK font mapping tests for Korean removal
- testCJKFontMappingsReturnsAppleSDGothicNeoWithHangulForKorean
→ renamed to testCJKFontMappingsReturnsNilForKoreanOnly
→ asserts nil since Korean is no longer auto-mapped
- testCJKFontMappingsMultiLanguageMapsScriptSpecificRanges
→ renamed to testCJKFontMappingsMultiLanguageSkipsKorean
→ asserts no Apple SD Gothic Neo mapping exists
→ Japanese mappings remain unchanged
---------
Co-authored-by: dante-ad-shield <danate@ad-shield.io>
Four call sites used `line.data(using: .utf8)!` to convert a String to
Data for FileHandle.write(). While .utf8 encoding never fails for Swift
strings (making the force unwrap safe in practice), `Data(line.utf8)` is
the idiomatic Swift equivalent that avoids the force unwrap entirely.
Changed files:
- GhosttyTerminalView.swift (3 occurrences: init log, surface log, size log)
- WorkspaceContentView.swift (1 occurrence: panel debug log)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(terminal): cover Return after Korean IME commit
* fix(terminal): execute Return after Korean IME commit
---------
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
The synchronizeScrollView() method was constantly resetting the scroll
position to match the terminal's scrollbar state, even when the user had
manually scrolled up to review scrollback. This caused the 'doomscroll'
bug where panes would fight the user's scroll position.
- Add userScrolledAwayFromBottom flag to track scroll intent
- Only auto-scroll when at bottom or when scrollbar indicates following
- Reset flag when user scrolls back to bottom
- Add 5-point threshold to tolerate minor float drift
Fixes#1577
Co-authored-by: BillionClaw <267901332+BillionClaw@users.noreply.github.com>
Add lastFocusState tracking to TerminalSurface to avoid sending duplicate
focus events to the terminal surface. This fixes double prompt / extra redraw
issues when using zsh with Powerlevel10k and switching workspaces.
Fixes#1566
Co-authored-by: BillionClaw <267901332+BillionClaw@users.noreply.github.com>
* Fix stale Claude status in sidebar by adding missing hooks and OSC suppression
The Claude Code integration only used 3 hooks (SessionStart, Stop, Notification),
leaving gaps that caused stale sidebar status. Now uses 6 hooks:
- SessionEnd: clears status when Claude exits (covers Ctrl+C where Stop doesn't fire)
- UserPromptSubmit: clears "Needs input" and sets "Running" on new prompt
- PreToolUse (async): clears "Needs input" when Claude resumes after permission grant
Also:
- Suppress OSC 9/99 desktop notifications for workspaces with active Claude hook
sessions to prevent duplicates from the raw OSC path
- Store Claude process PID in status entries for stale-session detection
- Add 30-second sweep timer that checks agent PIDs and clears stale entries
(safety net for SIGKILL/crash where no hook fires)
- Update wrapper test expectations for the new hook set
Fixes https://github.com/manaflow-ai/cmux/issues/1301
* Don't show "Running" status on Claude launch, only when actually working
SessionStart now registers the PID for tracking and OSC suppression via
set_agent_pid without setting a visible status entry. "Running" only
appears when the user submits a prompt (UserPromptSubmit) or Claude
starts using tools (PreToolUse).
Added set_agent_pid / clear_agent_pid socket commands to decouple PID
tracking from visible status entries. OSC suppression checks agentPIDs
instead of statusEntries so it works during the initial idle period.
* Don't restore status entries across app restarts
Status entries are ephemeral runtime state tied to running processes
(e.g. claude_code "Running"). Restoring them after restart shows stale
status for processes that no longer exist.
* Address PR review comments and remove debug logging
- session-end: only clear status/PID/notifications when Stop didn't fire first
- PID sweep: check errno == ESRCH instead of treating all kill(pid,0) failures as dead
- Validate CMUX_CLAUDE_PID > 0
- Propagate tracked PID in pre-tool-use setClaudeStatus
- OSC suppression: use tabManagerFor(tabId:) for multi-window support
- clearAgentPID: resolve tab UUID before async dispatch
- restoreSessionSnapshot: also clear agentPIDs alongside statusEntries
- Fix AskUserQuestion surfaceId overwrite (wrong workspace notification)
- Fix notification text matching for "Claude Code needs your attention"
- AskUserQuestion: render option labels as bracketed inline text
- Remove artificial text truncation limits
- Remove temporary JSONL debug logging from all handlers
* Use resolveTabIdForSidebarMutation in clearAgentPID
