Add cmux-remote iOS companion

MO
1mo ago
+21004-83

Summary

Adds cmux-remote, a standalone iOS/iPadOS companion app for remote cmux use, plus the desktop/socket/feed support needed for item-bound remote agent decisions.

Key pieces:

  • standalone iOS/cmux-remote Xcode project with app, widget/Live Activity, AppIntents, tests, docs, privacy manifest, entitlements, and localized resources
  • iOS remote decision handling with host-key pinning, item_id-bound replies, host-scoped notification/Live Activity routing, AFK policy handling, generic Lock Screen-visible labels, and background refresh
  • desktop feed/socket/CLI updates for DiffApprovalRequest, capability advertisement, item_id-required replies, and generic notification copy
  • dedicated .github/workflows/cmux-remote-ios.yml CI gate for the standalone iOS project

Verification

Local build/static gates run on this branch:

  • git diff --cached --check before commit
  • python3 -m json.tool Resources/Localizable.xcstrings >/dev/null
  • python3 -m json.tool iOS/cmux-remote/App/Resources/Localizable.xcstrings >/dev/null
  • plutil -lint iOS/cmux-remote/App/Configuration/Info.plist iOS/cmux-remote/App/Configuration/CmuxRemoteWidgets-Info.plist iOS/cmux-remote/App/Resources/PrivacyInfo.xcprivacy
  • stale declaration scan for BGProcessing, NSSupportsLiveActivitiesFrequentUpdates, and unused Live Activity APNs token plumbing under iOS/cmux-remote
  • xcodebuild -quiet -project iOS/cmux-remote/cmux-remote.xcodeproj -scheme CmuxRemote -configuration Debug -destination 'generic/platform=iOS' -derivedDataPath /tmp/cmux-remote-hardening-ios-25 -skipPackagePluginValidation build CODE_SIGNING_ALLOWED=NO
  • xcodebuild -quiet -project iOS/cmux-remote/cmux-remote.xcodeproj -scheme CmuxRemote -configuration Debug -destination 'generic/platform=iOS' -derivedDataPath /tmp/cmux-remote-hardening-ios-tests-21 -skipPackagePluginValidation build-for-testing CODE_SIGNING_ALLOWED=NO
  • CMUX_SKIP_ZIG_BUILD=1 xcodebuild -quiet -project cmux.xcodeproj -scheme cmux-unit -configuration Debug -destination 'platform=macOS' -derivedDataPath /tmp/cmux-cmux-remote-hardening-unit-skip-zig-7 build-for-testing CODE_SIGNING_ALLOWED=NO
  • CMUX_SKIP_ZIG_BUILD=1 ./scripts/reload.sh --tag cmux-remote-hardening

No local tests were executed, per repo policy.

Review Notes

Four independent adversarial reviewer passes were run during hardening. Valid findings were fixed, including:

  • stale unbound-to-bound decision notification replacement
  • host-switch provenance races in iOS snapshots/events
  • host-scoped stuck notification lifecycle
  • stale host-key TOFU prompt guard
  • macOS notification title source leakage
  • BGProcessing/frequent Live Activity declaration App Review risk
  • unused Live Activity APNs token registration

Final targeted Swift/iOS confirmation returned no current findings and verdict GO.

Release Gates

Still required outside this PR diff:

  • ship iOS + macOS as a paired capability upgrade
  • complete App Store signing/provisioning/export-compliance flow
  • run real-device validation for background refresh, Lock Screen actions, notifications, and Live Activities

View with Codesmith Autofix with Codesmith
Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.

Summary by cubic

Adds a standalone iOS/iPadOS companion app, cmux-remote, and hardens the desktop feed/socket/CLI for secure, item‑bound remote decisions and Lock Screen actions. Also bounds iOS stream state during sends to prevent stale or unsafe commands.

  • New Features

    • End-to-end diff approval: added DiffApprovalRequest across hooks, workstream mapping, CLI persistence, and localized diff notifications.
    • Enforced item_id on v2 feed replies; CLI now sends it; capabilities advertise feed.reply.item_id_required and feed.question_selections.
    • Feed hardening: duplicate-request dedupe, return resolved decision on timeout, and authentication for privileged notification actions; tests cover item_id enforcement and action auth.
    • New iOS/cmux-remote app with widgets/Live Activities, App Intents, background refresh/drain, and stream-send paths now bound to current state for reliability.

  • Migration

    • Update callers of feed.permission.reply, feed.exit_plan.reply, and feed.question.reply to include item_id or they will return invalid_params.
    • Plan a paired iOS + macOS release; complete signing/provisioning/export‑compliance and validate on devices (background refresh, Lock Screen actions, Live Activities).

Summary by CodeRabbit

  • New Features

    • Full iOS/iPadOS cmux-remote app: terminal, browser surface, snippets, host management, command palette, Pencil input, iPad gestures/keyboard shortcuts, widgets and Live Activities, remote decision notifications with one‑tap resolution and AFK auto‑approval.

  • Tests

    • Added extensive unit/integration tests for client, event decoding, shell-escaping, policies, notifications, feed flows and UI helpers.

  • Documentation

    • Added README, architecture, verification, known limitations and CI guidance.

  • Chores

    • New iOS CI workflow for build/lint/package resolution; project and packaging configs.

Review Change Stack