PR #32585 - manaflow-ai/cmux

Summary

Release prep for 0.65.3 (https://github.com/manaflow-ai/cmux/issues/34741), combined into one PR. Replaces https://github.com/manaflow-ai/cmux/pull/32589 and https://github.com/manaflow-ai/cmux/pull/32636, and supersedes https://github.com/manaflow-ai/cmux/pull/26602. Fixes https://github.com/manaflow-ai/cmux/issues/26003.

1. Hide Chief behind a flag

New flag chief-enabled-release, off by default in every build, dev builds included. Turn it on with cmux __internal_flags, which also works in release builds. Only app-host test processes run with it on, so the existing Chief tests keep exercising Chief.
The flag goes through ChiefSettings.isEnabled, so existing gates hide Home, palette entries, chief.* socket methods and mobile capabilities.
Also hidden when off: View > Chief, the Settings card and its search rows, the Open Chief shortcut row, the Dock's New Chief button, Dock config and restore, socket-created Chief panes, and chief in cmux --help.
A session saved with Chief on loses its Home and Chief panes, including Dock tabs, so nothing stays stuck in the sidebar.
Reopen Closed Tab skips a Chief tab closed while Chief was on, and Reopen Closed Workspace drops its Chief panes (a Chief-only workspace stays closed).
Left in place: --type chief in CLI help, the chief suggestion, chief.* keys in cmux.json, its template and docs. cmux chief memory and cmux chief dispatch still run.
tests_v2/test_chief_native_home.py skips while Chief is off, and scripts/chief/record-motion.sh needs the flag on first.

Keep this flag out of PostHog for now. A remote value overrides a local __internal_flags choice and disables its toggle.

2. Keep the iroh relay TLS hotfix on main

Brings over the v0.65.2.1 and v0.65.2.2 fix, which exists only on release branches: iroh's platform-verifier feature, CaTlsConfig::system(), and the guard test, which now also checks that call. The default cmux-tui build doesn't compile iroh and the macOS app's own iroh library already uses the system verifier, so those shipped binaries don't change. iOS still pins an xcframework without it, and coderouter deliberately uses bundled webpki roots. https://github.com/manaflow-ai/cmux/issues/25452 stays open.

3. Owned-pool guard (now on main)

The owned-pool guard fix that was here landed alone in https://github.com/manaflow-ai/cmux/pull/33311 (carried from this PR). After rebasing on main those hunks dropped out, so this PR no longer touches scripts/ci/.

Testing

python3 tests/test_cmux_tui_no_bundled_webpki_roots.py: passes. scripts/lint-feature-flags.py and scripts/verify-local.py --only localization: pass.
Runtime, isolated tagged build at f6b0c130632300e3fd9a96614c19d3c3d6c72baf: no flag means no Home and no chief.* methods; override on brings them back.
Dev build of 303a4d0e3fb54f28cd40080bca5e6735c3de29c2 compiled.
cmuxTests/ChiefDisabledHomeTests.swift runs in macos / app-host unit tests (changed suites); it passed at 1a32d02b62, and results for this head are posted on the PR.
Not verified: a click in the Feature Flags window, live toggling, a release-configuration build, and Home removal from a real saved session.
Reviews on earlier heads are posted on this PR, https://github.com/manaflow-ai/cmux/pull/32589 and https://github.com/manaflow-ai/cmux/pull/32636.

Changelog

No entry for Chief, which was never in a stable release, or for CI. 0.65.2.1 already announced the TLS fix.

Base 0ad82b815901c07b3a01517ecd88ee96ff7502b6, head 4a001c364709c67793fb3c13fa516cf6116085ad. Agent: Claude Code.

🤖 Generated with Claude Code