Move iOS app into repo with public-only Convex sync and proprietary licensing

.github/workflows/build-ghosttykit.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
   pull_request:
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/ci.yml

@@ -49,6 +49,22 @@ jobs:
         with:
           go-version-file: daemon/remote/go.mod
 
+      - name: Install zig
+        run: |
+          set -euo pipefail
+          ZIG_REQUIRED="0.15.2"
+          if command -v zig >/dev/null 2>&1 && zig version 2>/dev/null | grep -q "^${ZIG_REQUIRED}"; then
+            echo "zig ${ZIG_REQUIRED} already installed"
+          else
+            echo "Installing zig ${ZIG_REQUIRED} from tarball"
+            curl -fSL "https://ziglang.org/download/${ZIG_REQUIRED}/zig-x86_64-linux-${ZIG_REQUIRED}.tar.xz" -o /tmp/zig.tar.xz
+            tar xf /tmp/zig.tar.xz -C /tmp
+            sudo mv /tmp/zig-x86_64-linux-${ZIG_REQUIRED}/zig /usr/local/bin/zig
+            sudo rm -rf /usr/local/lib/zig
+            sudo mv /tmp/zig-x86_64-linux-${ZIG_REQUIRED}/lib /usr/local/lib/zig
+            zig version
+          fi
+
       - name: Run remote daemon tests
         working-directory: daemon/remote
         run: go test ./...

.gitmodules

@@ -8,3 +8,7 @@
 [submodule "vendor/bonsplit"]
 	path = vendor/bonsplit
 	url = https://github.com/manaflow-ai/bonsplit.git
+[submodule "vendor/tls.zig"]
+	path = vendor/tls.zig
+	url = https://github.com/ianic/tls.zig
+	branch = zig-0.15.x

CLAUDE.md

@@ -161,7 +161,12 @@ This makes it visible in the GitHub PR UI (Commits tab, check statuses) that the
 - Only explicit focus-intent commands may mutate in-app focus/selection (`window.focus`, `workspace.select/next/previous/last`, `surface.focus`, `pane.focus/last`, browser focus commands, and v1 focus equivalents).
 - All non-focus commands should preserve current user focus context while still applying data/model changes.
 
-## Testing policy
+## Timing policy
+
+- Do not use sleep-based timing in application/runtime code when an event-, state-, or callback-driven mechanism is available.
+- Deterministic sleeps are acceptable in tests when they are the smallest practical verification tool.
+
+## E2E mac UI tests
 
 **Never run tests locally.** All tests (E2E, UI, python socket tests) run via GitHub Actions or on the VM.
 
@@ -237,3 +242,4 @@ Notes:
 - README download button points to `releases/latest/download/cmux-macos.dmg`.
 - Versioning: bump the minor version for updates unless explicitly asked otherwise.
 - Changelog: update `CHANGELOG.md`; docs changelog is rendered from it.
+

LICENSE_SCOPE.md

@@ -0,0 +1,9 @@
+# License Scope
+
+Default repository license:
+- `LICENSE` (GNU AGPL v3) applies to this repository except where a more
+  specific license file governs a subtree.
+
+Directory-specific override:
+- `ios/**` is governed by `ios/LICENSE` and is proprietary / all-rights-reserved.
+- The AGPL license at `LICENSE` does not grant rights for files under `ios/**`.

Packages/CMUXAuthCore/Package.swift

@@ -0,0 +1,25 @@
+// swift-tools-version: 6.0
+import PackageDescription
+
+let package = Package(
+    name: "CMUXAuthCore",
+    platforms: [
+        .iOS(.v18),
+        .macOS(.v15),
+    ],
+    products: [
+        .library(
+            name: "CMUXAuthCore",
+            targets: ["CMUXAuthCore"]
+        ),
+    ],
+    targets: [
+        .target(
+            name: "CMUXAuthCore"
+        ),
+        .testTarget(
+            name: "CMUXAuthCoreTests",
+            dependencies: ["CMUXAuthCore"]
+        ),
+    ]
+)

Packages/CMUXAuthCore/Sources/CMUXAuthCore/CMUXAuthConfig.swift

@@ -0,0 +1,39 @@
+import Foundation
+
+public enum CMUXAuthEnvironment: Sendable {
+    case development
+    case production
+}
+
+public struct CMUXAuthConfig: Equatable, Sendable {
+    public let projectId: String
+    public let publishableClientKey: String
+
+    public init(projectId: String, publishableClientKey: String) {
+        self.projectId = projectId
+        self.publishableClientKey = publishableClientKey
+    }
+
+    public static func resolve(
+        environment: CMUXAuthEnvironment,
+        overrides: [String: String] = [:],
+        developmentProjectId: String,
+        productionProjectId: String,
+        developmentPublishableClientKey: String,
+        productionPublishableClientKey: String
+    ) -> Self {
+        let projectId: String
+        let publishableClientKey: String
+
+        switch environment {
+        case .development:
+            projectId = overrides["STACK_PROJECT_ID_DEV"] ?? developmentProjectId
+            publishableClientKey = overrides["STACK_PUBLISHABLE_CLIENT_KEY_DEV"] ?? developmentPublishableClientKey
+        case .production:
+            projectId = overrides["STACK_PROJECT_ID_PROD"] ?? productionProjectId
+            publishableClientKey = overrides["STACK_PUBLISHABLE_CLIENT_KEY_PROD"] ?? productionPublishableClientKey
+        }
+
+        return Self(projectId: projectId, publishableClientKey: publishableClientKey)
+    }
+}

Packages/CMUXAuthCore/Sources/CMUXAuthCore/CMUXAuthIdentityStore.swift

@@ -0,0 +1,29 @@
+import Foundation
+
+public final class CMUXAuthIdentityStore: @unchecked Sendable {
+    private let keyValueStore: CMUXAuthKeyValueStore
+    private let key: String
+    private let decoder = JSONDecoder()
+    private let encoder = JSONEncoder()
+
+    public init(keyValueStore: CMUXAuthKeyValueStore, key: String) {
+        self.keyValueStore = keyValueStore
+        self.key = key
+    }
+
+    public func save(_ user: CMUXAuthUser) throws {
+        let data = try encoder.encode(user)
+        keyValueStore.set(data, forKey: key)
+    }
+
+    public func load() throws -> CMUXAuthUser? {
+        guard let data = keyValueStore.data(forKey: key) else {
+            return nil
+        }
+        return try decoder.decode(CMUXAuthUser.self, from: data)
+    }
+
+    public func clear() {
+        keyValueStore.removeObject(forKey: key)
+    }
+}

Packages/CMUXAuthCore/Sources/CMUXAuthCore/CMUXAuthSessionCache.swift

@@ -0,0 +1,32 @@
+import Foundation
+
+public protocol CMUXAuthKeyValueStore: AnyObject {
+    func bool(forKey defaultName: String) -> Bool
+    func data(forKey defaultName: String) -> Data?
+    func set(_ value: Any?, forKey defaultName: String)
+    func removeObject(forKey defaultName: String)
+}
+
+extension UserDefaults: CMUXAuthKeyValueStore {}
+
+public final class CMUXAuthSessionCache: @unchecked Sendable {
+    private let keyValueStore: CMUXAuthKeyValueStore
+    private let key: String
+
+    public init(keyValueStore: CMUXAuthKeyValueStore, key: String) {
+        self.keyValueStore = keyValueStore
+        self.key = key
+    }
+
+    public var hasTokens: Bool {
+        keyValueStore.bool(forKey: key)
+    }
+
+    public func setHasTokens(_ value: Bool) {
+        keyValueStore.set(value, forKey: key)
+    }
+
+    public func clear() {
+        keyValueStore.removeObject(forKey: key)
+    }
+}

Packages/CMUXAuthCore/Sources/CMUXAuthCore/CMUXAuthState.swift

@@ -0,0 +1,102 @@
+import Foundation
+
+public struct CMUXAuthAutoLoginCredentials: Equatable, Sendable {
+    public let email: String
+    public let password: String
+
+    public init(email: String, password: String) {
+        self.email = email
+        self.password = password
+    }
+}
+
+public enum CMUXAuthLaunchConfig {
+    public static func autoLoginCredentials(
+        from environment: [String: String],
+        clearAuth: Bool,
+        mockDataEnabled: Bool
+    ) -> CMUXAuthAutoLoginCredentials? {
+        if clearAuth || mockDataEnabled {
+            return nil
+        }
+        guard let email = environment["CMUX_UITEST_STACK_EMAIL"], !email.isEmpty else {
+            return nil
+        }
+        guard let password = environment["CMUX_UITEST_STACK_PASSWORD"], !password.isEmpty else {
+            return nil
+        }
+        return CMUXAuthAutoLoginCredentials(email: email, password: password)
+    }
+
+    public static func fixtureUser(
+        from environment: [String: String],
+        clearAuth: Bool,
+        mockDataEnabled: Bool
+    ) -> CMUXAuthUser? {
+        if clearAuth || mockDataEnabled {
+            return nil
+        }
+        guard environment["CMUX_UITEST_AUTH_FIXTURE"] == "1" else {
+            return nil
+        }
+        return CMUXAuthUser(
+            id: environment["CMUX_UITEST_AUTH_USER_ID"] ?? "uitest_user",
+            primaryEmail: environment["CMUX_UITEST_AUTH_EMAIL"] ?? "uitest@cmux.local",
+            displayName: environment["CMUX_UITEST_AUTH_NAME"] ?? "UI Test"
+        )
+    }
+}
+
+public enum CMUXAuthMagicLinkCode {
+    public static func compose(code: String, nonce: String) -> String {
+        code + nonce
+    }
+}
+
+public struct CMUXAuthState: Equatable, Sendable {
+    public let isAuthenticated: Bool
+    public let currentUser: CMUXAuthUser?
+    public let isRestoringSession: Bool
+
+    public init(isAuthenticated: Bool, currentUser: CMUXAuthUser?, isRestoringSession: Bool) {
+        self.isAuthenticated = isAuthenticated
+        self.currentUser = currentUser
+        self.isRestoringSession = isRestoringSession
+    }
+
+    public static func primed(
+        clearAuthRequested: Bool,
+        mockDataEnabled: Bool,
+        fixtureUser: CMUXAuthUser?,
+        autoLoginCredentials: CMUXAuthAutoLoginCredentials?,
+        cachedUser: CMUXAuthUser?,
+        hasTokens: Bool,
+        mockUser: CMUXAuthUser
+    ) -> Self {
+        if clearAuthRequested {
+            return .cleared()
+        }
+
+        if mockDataEnabled {
+            return Self(isAuthenticated: true, currentUser: mockUser, isRestoringSession: false)
+        }
+
+        if let fixtureUser {
+            return Self(isAuthenticated: true, currentUser: fixtureUser, isRestoringSession: false)
+        }
+
+        if autoLoginCredentials != nil {
+            return Self(isAuthenticated: true, currentUser: cachedUser, isRestoringSession: false)
+        }
+
+        return Self(
+            isAuthenticated: hasTokens,
+            currentUser: cachedUser,
+            isRestoringSession: false
+        )
+    }
+
+    public static func cleared() -> Self {
+        Self(isAuthenticated: false, currentUser: nil, isRestoringSession: false)
+    }
+}

Packages/CMUXAuthCore/Sources/CMUXAuthCore/CMUXAuthUser.swift

@@ -0,0 +1,13 @@
+import Foundation
+
+public struct CMUXAuthUser: Codable, Equatable, Sendable {
+    public let id: String
+    public let primaryEmail: String?
+    public let displayName: String?
+
+    public init(id: String, primaryEmail: String?, displayName: String?) {
+        self.id = id
+        self.primaryEmail = primaryEmail
+        self.displayName = displayName
+    }
+}