Decouple iOS primary terminal scroll

Packages/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite+TerminalOutputDelivery.swift

@@ -29,7 +29,11 @@ extension MobileShellComposite {
         terminalOutputQueuesBySurfaceID[surfaceID] = queue
         if let immediate {
             continuation.yield(
-                MobileTerminalOutputChunk(data: immediate.bytes, streamToken: streamToken)
+                MobileTerminalOutputChunk(
+                    data: immediate.bytes,
+                    streamToken: streamToken,
+                    activeScreen: immediate.activeScreen
+                )
             )
         }
     }
@@ -45,6 +49,10 @@ extension MobileShellComposite {
               terminalOutputStreamTokensBySurfaceID[surfaceID] == streamToken else {
             return
         }
-        continuation.yield(MobileTerminalOutputChunk(data: next.bytes, streamToken: streamToken))
+        continuation.yield(MobileTerminalOutputChunk(
+            data: next.bytes,
+            streamToken: streamToken,
+            activeScreen: next.activeScreen
+        ))
     }
 }

Packages/CmuxMobileShell/Sources/CmuxMobileShell/TerminalOutputDelivery.swift

@@ -29,6 +29,15 @@ struct TerminalOutputDelivery: Equatable, Sendable {
             frame.vtPatchBytes()
         }
     }
+
+    var activeScreen: MobileTerminalRenderGridFrame.Screen? {
+        switch payload {
+        case .bytes:
+            nil
+        case .renderGrid(let frame):
+            frame.activeScreen
+        }
+    }
 }
 
 /// Backpressure queue for one mounted mobile terminal output stream.

Packages/CmuxMobileShell/Tests/CmuxMobileShellTests/TerminalOutputDeliveryQueueTests.swift

@@ -90,6 +90,22 @@ import Testing
     #expect(!vt.contains("old"))
 }
 
+@Test func terminalOutputDeliveryCarriesRenderGridActiveScreen() throws {
+    let frame = try MobileTerminalRenderGridFrame(
+        surfaceID: "terminal",
+        stateSeq: 1,
+        columns: 12,
+        rows: 2,
+        rowSpans: [],
+        activeScreen: .alternate
+    )
+    let delivery = TerminalOutputDelivery(renderGrid: frame, replaceable: false)
+    let rawDelivery = TerminalOutputDelivery(bytes: Data("raw".utf8), replaceable: false)
+
+    #expect(delivery.activeScreen == .alternate)
+    #expect(rawDelivery.activeScreen == nil)
+}
+
 @Test func terminalOutputQueuePreservesNonreplaceableBarriers() {
     var queue = TerminalOutputDeliveryQueue()
     let inFlight = TerminalOutputDelivery(bytes: Data("in-flight".utf8), replaceable: false)

Packages/CmuxMobileShellModel/Sources/CmuxMobileShellModel/MobileTerminalOutputSinking.swift

@@ -1,3 +1,4 @@
+public import CMUXMobileCore
 public import Foundation
 
 /// A seam exposing per-surface terminal output as an `AsyncStream`.
@@ -14,10 +15,18 @@ public import Foundation
 /// propagation is a structured, cancellable `AsyncSequence` instead of a stored
 /// callback.
 public struct MobileTerminalOutputChunk: Sendable {
+    /// The active terminal screen captured by the render-grid frame that
+    /// produced ``data``. Raw byte fallback chunks carry `nil`.
+    public let activeScreen: MobileTerminalRenderGridFrame.Screen?
     public let data: Data
     public let streamToken: UUID
 
-    public init(data: Data, streamToken: UUID) {
+    public init(
+        data: Data,
+        streamToken: UUID,
+        activeScreen: MobileTerminalRenderGridFrame.Screen? = nil
+    ) {
+        self.activeScreen = activeScreen
         self.data = data
         self.streamToken = streamToken
     }

Packages/CmuxMobileShellUI/Sources/CmuxMobileShellUI/GhosttySurfaceRepresentable.swift

@@ -137,6 +137,7 @@ struct GhosttySurfaceRepresentable: UIViewRepresentable {
                 for await chunk in store.terminalOutputStream(surfaceID: surfaceID) {
                     guard !Task.isCancelled else { return }
                     guard let surfaceView else { return }
+                    surfaceView.applyTerminalOutputMetadata(activeScreen: chunk.activeScreen)
                     await surfaceView.processOutputAndWait(chunk.data)
                     store.terminalOutputDidProcess(
                         surfaceID: surfaceID,

Packages/CmuxMobileTerminal/Sources/CmuxMobileTerminal/GhosttySurfaceView.swift

@@ -8,37 +8,6 @@ import UIKit
 
 private let log = Logger(subsystem: "ai.manaflow.cmux.ios", category: "ghostty.surface")
 
-// lint:allow namespace-enum — file-local DEBUG input-trace logger on the off-limits typing-latency render path; type reshape deferred to the GhosttySurfaceView UI-god-object split wave.
-enum TerminalInputDebugLog {
-    private static let isEnabled = ProcessInfo.processInfo.environment["CMUX_INPUT_DEBUG"] == "1"
-    private static let logger = Logger(subsystem: "ai.manaflow.cmux.ios", category: "ghostty.input")
-
-    static func log(_ message: String) {
-        #if DEBUG
-        if ProcessInfo.processInfo.environment["XCTestConfigurationFilePath"] != nil {
-            return
-        }
-        #endif
-        guard isEnabled else { return }
-        logger.debug("input: \(message, privacy: .public)")
-    }
-
-    static func textSummary(_ text: String) -> String {
-        let summary = String(reflecting: text)
-        guard summary.count > 96 else { return summary }
-        return "\(summary.prefix(96))..."
-    }
-
-    static func dataSummary(_ data: Data) -> String {
-        let prefix = data.prefix(32)
-        let prefixData = Data(prefix)
-        let hex = prefix.map { String(format: "%02X", $0) }.joined(separator: " ")
-        let utf8 = String(data: prefixData, encoding: .utf8) ?? "<non-utf8>"
-        let suffix = data.count > prefix.count ? " ..." : ""
-        return "len=\(data.count) hex=\(hex)\(suffix) utf8=\(textSummary(utf8))"
-    }
-}
-
 @MainActor
 public protocol GhosttySurfaceViewDelegate: AnyObject {
     func ghosttySurfaceView(_ surfaceView: GhosttySurfaceView, didProduceInput data: Data)
@@ -622,6 +591,8 @@ public final class GhosttySurfaceView: UIView, TerminalSurfaceHosting {
     private var lastAppliedContentScale: CGFloat = 0
     private var surfaceHasReceivedOutput: Bool = false
     private var shouldScrollInitialOutputToBottom = true
+    private var activeScreen: MobileTerminalRenderGridFrame.Screen = .primary
+    private let scrollForwardingPolicy = MobileTerminalScrollForwardingPolicy()
     /// Serial background queue for `ghostty_surface_process_output`, which
     /// blocks on libghostty's internal renderer/IO futex. Running it on the
     /// main thread hangs the app until the scene-update watchdog kills it.
@@ -1811,6 +1782,9 @@ public final class GhosttySurfaceView: UIView, TerminalSurfaceHosting {
         let cell = pendingScrollCell
         pendingScrollLines = 0
         applyLocalScrollbackScroll(lines: lines, col: cell.col, row: cell.row)
+        guard scrollForwardingPolicy.shouldForwardToHost(activeScreen: activeScreen) else {
+            return
+        }
         delegate?.ghosttySurfaceView(self, didScrollLines: lines, atCol: cell.col, row: cell.row)
     }
 
@@ -2109,6 +2083,20 @@ public final class GhosttySurfaceView: UIView, TerminalSurfaceHosting {
         processOutput(data, completion: nil)
     }
 
+    /// Applies metadata attached to the next terminal output chunk.
+    ///
+    /// Render-grid output carries the authoritative active screen, which lets
+    /// local scrollback stay phone-local on the primary screen while alternate
+    /// screen TUIs still receive host mouse-wheel events.
+    /// - Parameter activeScreen: The active screen from the render-grid frame,
+    ///   or `nil` for raw byte fallback chunks.
+    public func applyTerminalOutputMetadata(
+        activeScreen: MobileTerminalRenderGridFrame.Screen?
+    ) {
+        guard let activeScreen else { return }
+        self.activeScreen = activeScreen
+    }
+
     /// Process terminal output and return after the output has been applied.
     ///
     /// The call still performs libghostty output processing on the serial

Packages/CmuxMobileTerminal/Sources/CmuxMobileTerminal/TerminalInputDebugLog.swift

@@ -0,0 +1,35 @@
+#if canImport(UIKit)
+import Foundation
+import OSLog
+
+// lint:allow namespace-enum — DEBUG input-trace logger on the off-limits typing-latency render path; type reshape deferred to the GhosttySurfaceView UI-god-object split wave.
+enum TerminalInputDebugLog {
+    private static let isEnabled = ProcessInfo.processInfo.environment["CMUX_INPUT_DEBUG"] == "1"
+    private static let logger = Logger(subsystem: "ai.manaflow.cmux.ios", category: "ghostty.input")
+
+    static func log(_ message: String) {
+        #if DEBUG
+        if ProcessInfo.processInfo.environment["XCTestConfigurationFilePath"] != nil {
+            return
+        }
+        #endif
+        guard isEnabled else { return }
+        logger.debug("input: \(message, privacy: .public)")
+    }
+
+    static func textSummary(_ text: String) -> String {
+        let summary = String(reflecting: text)
+        guard summary.count > 96 else { return summary }
+        return "\(summary.prefix(96))..."
+    }
+
+    static func dataSummary(_ data: Data) -> String {
+        let prefix = data.prefix(32)
+        let prefixData = Data(prefix)
+        let hex = prefix.map { String(format: "%02X", $0) }.joined(separator: " ")
+        let utf8 = String(data: prefixData, encoding: .utf8) ?? "<non-utf8>"
+        let suffix = data.count > prefix.count ? " ..." : ""
+        return "len=\(data.count) hex=\(hex)\(suffix) utf8=\(textSummary(utf8))"
+    }
+}
+#endif

Packages/CmuxMobileTerminalKit/Sources/CmuxMobileTerminalKit/MobileTerminalScrollForwardingPolicy.swift

@@ -0,0 +1,22 @@
+public import CMUXMobileCore
+
+/// Decides whether a mobile terminal scroll gesture must be sent to the Mac.
+public struct MobileTerminalScrollForwardingPolicy: Sendable {
+    /// Creates the forwarding policy.
+    public init() {}
+
+    /// Returns whether a scroll should be forwarded to the host surface.
+    ///
+    /// Primary-screen scrollback is already mirrored into the phone's local
+    /// Ghostty surface, so forwarding would make scroll feel network-bound.
+    /// Alternate-screen scroll must still reach the host so TUIs with mouse
+    /// reporting receive wheel events.
+    /// - Parameter activeScreen: The screen currently rendered by the mobile
+    ///   Ghostty mirror.
+    /// - Returns: `true` when the scroll should be sent to the Mac.
+    public func shouldForwardToHost(
+        activeScreen: MobileTerminalRenderGridFrame.Screen
+    ) -> Bool {
+        activeScreen == .alternate
+    }
+}

Packages/CmuxMobileTerminalKit/Tests/CmuxMobileTerminalKitTests/MobileTerminalScrollForwardingPolicyTests.swift

@@ -0,0 +1,17 @@
+import CMUXMobileCore
+import CmuxMobileTerminalKit
+import Testing
+
+@Suite struct MobileTerminalScrollForwardingPolicyTests {
+    @Test func primaryScreenScrollStaysLocal() {
+        let policy = MobileTerminalScrollForwardingPolicy()
+
+        #expect(policy.shouldForwardToHost(activeScreen: .primary) == false)
+    }
+
+    @Test func alternateScreenScrollForwardsToHost() {
+        let policy = MobileTerminalScrollForwardingPolicy()
+
+        #expect(policy.shouldForwardToHost(activeScreen: .alternate))
+    }
+}

ios/Config/Info.plist

@@ -16,6 +16,8 @@
 	<string>$(CMUX_DEV_TAG)</string>
 	<key>CMUXGitSHA</key>
 	<string>$(CMUX_GIT_SHA)</string>
+	<key>CMUXApiBaseURL</key>
+	<string>$(CMUX_API_BASE_URL)</string>
 	<key>CFBundleName</key>
 	<string>$(PRODUCT_NAME)</string>
 	<key>CFBundlePackageType</key>
@@ -63,8 +65,10 @@
 		     ONLY WKWebView web content from ATS; the app's own API/auth/pairing
 		     traffic stays under ATS and still requires HTTPS. NSAllowsLocalNetworking
 		     alone would not cover routable private-LAN dev servers. -->
-		<key>NSAllowsArbitraryLoadsInWebContent</key>
-		<true/>
+			<key>NSAllowsArbitraryLoads</key>
+			<true/>
+			<key>NSAllowsArbitraryLoadsInWebContent</key>
+			<true/>
 	</dict>
 	<key>UIApplicationSceneManifest</key>
 	<dict>

ios/cmuxPackage/Sources/cmuxFeature/MobileAuthComposition.swift

@@ -140,7 +140,7 @@ public struct MobileAuthComposition {
     private static func localConfigStringOverrides(in bundle: Bundle) -> [String: String] {
         guard let path = bundle.path(forResource: "LocalConfig", ofType: "plist"),
               let dict = NSDictionary(contentsOfFile: path) as? [String: Any] else {
-            return [:]
+            return infoPlistStringOverrides(in: bundle)
         }
         var overrides: [String: String] = [:]
         for (key, value) in dict {
@@ -151,6 +151,18 @@ public struct MobileAuthComposition {
                 }
             }
         }
+        for (key, value) in infoPlistStringOverrides(in: bundle) where overrides[key] == nil {
+            overrides[key] = value
+        }
         return overrides
     }
+
+    private static func infoPlistStringOverrides(in bundle: Bundle) -> [String: String] {
+        guard let apiBaseURL = bundle.object(forInfoDictionaryKey: "CMUXApiBaseURL") as? String else {
+            return [:]
+        }
+        let trimmed = apiBaseURL.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty, !trimmed.hasPrefix("$(") else { return [:] }
+        return ["ApiBaseURL": trimmed]
+    }
 }

ios/scripts/reload.sh

@@ -44,6 +44,7 @@ SIMULATOR_NAME="${IOS_SIMULATOR_NAME:-iPhone 17}"
 DEVICE_ID="${IOS_DEVICE_ID:-}"
 DEVICE_NAME="${IOS_DEVICE_NAME:-}"
 DEVELOPMENT_TEAM="${IOS_DEVELOPMENT_TEAM:-}"
+CMUX_API_BASE_URL="${CMUX_API_BASE_URL:-}"
 LAUNCH=1
 RELOAD_SIMULATOR=1
 RELOAD_DEVICE=0
@@ -408,6 +409,7 @@ reload_simulator() {
     PRODUCT_DISPLAY_NAME="$DISPLAY_NAME" \
     CMUX_GIT_SHA="$GIT_SHA" \
     CMUX_DEV_TAG="$TAG" \
+    CMUX_API_BASE_URL="$CMUX_API_BASE_URL" \
     EXCLUDED_SOURCE_FILE_NAMES=Info.plist \
     CODE_SIGNING_ALLOWED=NO \
     SWIFT_OPTIMIZATION_LEVEL=-O \
@@ -509,6 +511,7 @@ reload_device() {
     PRODUCT_DISPLAY_NAME="$DISPLAY_NAME"
     CMUX_GIT_SHA="$GIT_SHA"
     CMUX_DEV_TAG="$TAG"
+    CMUX_API_BASE_URL="$CMUX_API_BASE_URL"
     EXCLUDED_SOURCE_FILE_NAMES=Info.plist
     CODE_SIGNING_ALLOWED=YES
     CODE_SIGN_STYLE=Automatic

web/app/handler/after-sign-in/route.ts

@@ -2,13 +2,13 @@ import { cookies } from "next/headers";
 import { NextRequest, NextResponse } from "next/server";
 import { stackServerApp } from "../../lib/stack";
 import { env } from "../../env";
+import { isAllowedNativeReturnTo } from "../native-auth-helpers";
 import type { Locale } from "../../../i18n/routing";
 import { locales, routing } from "../../../i18n/routing";
 
 export const dynamic = "force-dynamic";
 
 const NATIVE_SCHEME = "cmux://";
-const NATIVE_SCHEMES = new Set(["cmux", "cmux-nightly"]);
 const NATIVE_HANDOFF_COOKIE = "cmux-native-auth-handoff";
 const NATIVE_HANDOFF_PARAM = "cmux_auth_handoff";
 
@@ -23,42 +23,6 @@ type LocalizedAfterSignInMessages = {
   messages: AfterSignInMessages;
 };
 
-function isLocalRequest(request: NextRequest): boolean {
-  const hostHeader = request.headers.get("host");
-  const host = (hostHeader?.split(":")[0] ?? request.nextUrl.hostname).toLowerCase();
-  return host === "localhost" || host === "127.0.0.1" || host === "::1";
-}
-
-function localAllowedNativeSchemes(): Set<string> {
-  const values = [
-    process.env.CMUX_AUTH_CALLBACK_SCHEME,
-    process.env.CMUX_ALLOWED_NATIVE_CALLBACK_SCHEMES,
-    process.env.CMUX_DEV_NATIVE_CALLBACK_SCHEMES,
-  ];
-  const schemes = new Set<string>();
-  for (const value of values) {
-    for (const raw of value?.split(/[\s,]+/) ?? []) {
-      const scheme = raw.trim().replace(/:\/\/.*$/, "").replace(/:$/, "");
-      if (/^cmux-dev-[a-z0-9-]+$/.test(scheme)) schemes.add(scheme);
-    }
-  }
-  return schemes;
-}
-
-function isAllowedNativeReturnTo(href: string, request: NextRequest): boolean {
-  try {
-    const url = new URL(href);
-    if (url.hostname !== "auth-callback") return false;
-    if (url.pathname !== "" && url.pathname !== "/") return false;
-    const scheme = url.protocol.replace(":", "");
-    if (NATIVE_SCHEMES.has(scheme)) return true;
-    if (scheme === "cmux-dev") return isLocalRequest(request);
-    return isLocalRequest(request) && localAllowedNativeSchemes().has(scheme);
-  } catch {
-    return false;
-  }
-}
-
 function findStackCookie(
   cookieStore: { getAll: () => { name: string; value: string }[] },
   baseName: string