fix(events): survive receive-timeout reconfiguration churn during replay - #13888

I have read the CLA Document v2.2 and I hereby sign the CLA

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

Merge Risk: ⚪ Minimal · up to df04a

The change is mergeable after normal checks. The real socket and CLI wrapper path has not been exercised by the reported automated tests.

❌ Failed checks (1 error, 1 warning)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Addressed in 98efa0d: the classification is now typed (CLIError.socketFailureKind == .receiveTimeoutConfiguration thrown from configureReceiveTimeout) instead of substring matching, so a malformed frame whose content mentions errno 22 stays fatal. Added malformed-frame cases carrying both markers to pin that behavior.

Addressed: configureResponseReceiveTimeout now rethrows the original CLIError after close (typed .receiveTimeoutConfiguration survives to the classifier); the localized 'Socket read error' conversion remains only for untyped errors.

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

Addressed both minors in d0f2eb8: (1) the Unix connect failure path now uses the full close() cleanup so a retry reconfigures SO_RCVTIMEO on the fresh socket; (2) configureResponseReceiveTimeout is internal and the regression test now drives it on an unconnected socket, asserting the typed .receiveTimeoutConfiguration failure survives the wrapper and classifies as transient.

Reviewed, and thank you! Skipping setsockopt when the timeout is already set, the typed .receiveTimeoutConfiguration error that --reconnect treats as transient, and closing the fd on connect failure all look right, and each CodeRabbit round was addressed. The only conflict was the test group in project.pbxproj, so I merged main in, kept both sides and re-normalized. I also approved CI and turned on auto-merge :)

Now that CI has run, one thing to fix: the new test file doesn't compile in cmuxTests.

cmuxTests/EventStreamTransientErrorTests.swift:22:17: error: 'CMUXCLI' (aka 'CmuxTuiRemoteRouting') cannot be constructed because it has no accessible initializers
cmuxTests/EventStreamTransientErrorTests.swift:47:22: error: cannot find 'SocketClient' in scope

cmuxTests is hosted by the app, so the CLI's types (CMUXCLI, SocketClient, CLIError) aren't visible there. CMUXCLI is even aliased to something else in that target. On main, CLI behavior gets tested one of two ways:

• Run the cmux binary as a process and check its output, like cmuxTests/CMUXCLIErrorOutputRegressionTests.swift does. You could point cmux events --reconnect at a socket that fails the timeout setup.
• Move the pure classification into a package and unit-test it there, like Fix cmux events access-denied stream error #10712 did with SocketStreamErrorKind in CmuxControlSocket.

The second is probably less work here: the "is this error transient?" decision is pure logic. The fix itself still looks right to me. I turned auto-merge off until the test builds; push when you're ready and I'll approve CI again :)

Pushed df04a91 — the failing suite was my mistake: cmuxTests is app-hosted and can't see CLI types. Went with the second option you suggested:

• The "is this failure transient?" decision now lives in CmuxControlSocket as EventStreamReconnectPolicy — pure logic over a typed EventStreamSocketFailureKind and the message text. The legacy marker list moved verbatim, and the non-CLIError fallback path is an explicit parameter. isTransientEventStreamError is now just the CLIError→policy mapping.
• Unit tests moved to the package target (EventStreamReconnectPolicyTests): typed-kind transient, event content that merely mentions errno text stays fatal, protocol errors stay fatal, the legacy connection markers, and the untyped-description fallback.
• cmuxTests/EventStreamTransientErrorTests.swift and its pbxproj wiring are removed (./scripts/sync-test-wiring --check is clean).

One coverage note: the old fourth test drove SocketClient.configureResponseReceiveTimeout on a real unconnected socket to prove the typed failure survives the wrapper. There's no CLI-free home for that (SocketClient is CLI-target), so it leaves the automated suites with this change — happy to add a process-level cmux events --reconnect case later if you want that path pinned.

Verification: no Swift toolchain on this Linux box — scripts/verify-local.py --only swift-syntax reports UNSUPPORTED here, so the package build and tests (swift-package-tests lane) plus the static checks on CI are the first real compile of these files.

Thanks for digging into this, @LuckVd. The dedupe itself looks correct (close() resets the cached value, and you also fixed the connect-failure path that skipped that reset), but I don't think we can land it as is yet:

• On macOS, setsockopt returns EINVAL once the socket has been shut down in both directions, which for an AF_UNIX socket happens when the peer closes. The arguments are fine (optlen is MemoryLayout<timeval>.size), so this looks like the stream being closed right after the replay, not setsockopt churn.
• If the peer closes after the ack has been read, the dedupe skips later calls, the buffered frames are read, and read() ends with "Event stream closed", which is already transient. That converges.
• If the peer closes before the first readStreamLine, that first configureReceiveTimeout(45) is never deduped (connectOnce set the response timeout, not 45). With every .receiveTimeoutConfiguration failure now transient, --reconnect retries with the same cursor about once a second with no output, forever. EBADF and ENOTSOCK would loop the same way.
• EventStreamReconnectPolicyTests only checks the classification. Nothing reproduces events --cursor-file --reconnect exits with EINVAL (socket receive timeout) when the cursor is older than the retained in-memory log #12756 (ack plus buffered events, then peer close).

What I'd suggest: set the receive timeout once per stream in streamV2, treat EINVAL from that call as "peer closed" (drain what is already buffered, then throw "Event stream closed"), keep EBADF/ENOTSOCK fatal, and add a socket test where the peer writes an ack and one event and then closes. It would also help to find out what closes the stream after a replay (possibly writeEventsStreamLine failing in Sources/CmuxEventStream.swift). Happy to help if you want to take another pass.

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

Merged, thank you @LuckVd! Your dedupe in configureReceiveTimeout is what fixes the replay case: setting SO_RCVTIMEO again before every frame is what hit EINVAL once the server had closed. I added a small follow-up on top: macOS returns EINVAL from setsockopt once the peer has closed an AF_UNIX socket while buffered frames stay readable, so readStreamLine now keeps reading through that EINVAL, only EINVAL is typed as transient (EBADF/ENOTSOCK stay fatal), configureResponseReceiveTimeout keeps its old "Socket read error" message, and a process-level test replays an ack plus two events and closes. Compile admission and package tests were green.

Merge receipt for 68f5bb67e1, merged 2026-09-25 12:19:55 UTC

• Not verified at merge: ci-status (not reported), CLI product tests (in progress), guards (17) (failure), linux-preflight (failure)
• Verified: macOS compile admission, Web complexity, web-validation, Fast static checks, GhosttyKit release check, macOS admission gate, swift-package-tests, Testbox broker trust boundary
• Skipped by policy: app-host unit tests, browser, Claude wrapper regressions, release-admission, release-build, remote-daemon, suite-coverage, tests-build-and-lag, web, web-build, web-database-tests, web-tests
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.