feat: choose where to create a workroom: this Mac, Docker or Apple container (#309) - #320

…app (#309)

Nightly and Release now build the FIXTURE=0 host image once per
architecture, smoke-test that exact image (host-image-test.sh takes it as
WR_HOST_IMAGE), push it by digest, and join the two into one multi-arch
manifest on ghcr. The manifest digest goes into the app build as
WorkroomHostImage, so an app version always runs the image it was tested
with. The hidden remoteHostImage setting still overrides it, and a local
build with neither runs `workroom-host` as before.

A base's image is now pulled explicitly when the runtime doesn't have it,
and `run` passes --pull=never. Left to `run`, a missing image was looked
for on Docker Hub as library/workroom-host, and the error said nothing
about why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

- Every driver's sweep keeps every recorded host's image, not only the
  images it adopted: another context's driver can reach the same daemon,
  and only Docker's in-use refusal was keeping those images, with a
  logged failure each launch.
- Sweep the contexts at once, so a slow daemon holds up no other sweep.
- Check the Codaset sign-in before asking Docker for the current
  context, so a signed-out user is told to sign in, as before.
- Test that a record with no context is written back with no context
  key, so an old record's bytes stay the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…309)

A container someone stopped stays stopped, and Apple's container runtime
has no restart policy, so after a reboot every one of its containers is
down. Opening a workroom (selecting it, or a reload that finds it
selected) now marks its host as opened. That host's connects start its
container first if it is stopped, then wait for ssh.

Background status probes never mark a host opened. They connect to every
reachable remote workroom, so starting on any connect would have booted
them all. Opening also lifts the host's retry window, since a probe of
the stopped container is usually what failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

)

ContainerHostDriver now speaks Apple's `container` CLI as well as
Docker's, picked by Provisioning.dialect. RemoteHosts keys its drivers by
runtime and Docker context, and a descriptor's `driver` names the runtime:
`container` stays Docker, so every existing record is unchanged, and
`apple-container` is Apple's.

Measured against container 1.5.0, which differs from its docs on main:

- There is no `commit`. A derive stops the base, exports its disk,
  starts it again whatever happens, builds the disk back into an image
  from scratch with the host image's own entrypoint and environment, and
  runs it. The image is then removed: the container's disk outlives it,
  and it is the size of the base's whole disk. The builder VM (2 CPUs,
  2 GB) is stopped again after each derive.
- `build --quiet` never returns, so it is never passed.
- Apple removes an image a container is still using, so its sweep keeps
  every image any container was run from, instead of relying on a
  refusal. It reads `--format json`, since there is no `--filter`.
- No restart policy: an Apple container is started when its workroom is
  opened. Published ports survive a stop and start.
- Images are pulled for arm64 only; digest references work throughout.

A base is now marked as one explicitly, since an Apple instance records
no image either, and deriving from an instance would copy its enrolment.
A workroom asked for on another runtime than its project's base is
refused until bases are kept per runtime.

AppleContainerIntegrationTests run the whole lifecycle on the real
runtime; they are opt-in (TEST_RUNNER_WR_APPLE_CONTAINER_TESTS=1), since
CI's macOS runners can't run Apple's VMs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…ainer (#309)

With the remote preview on, a project's New Workroom becomes a submenu:
This Mac, then Docker and Apple Container under "Local containers". It
replaces the separate New Remote Workroom item. Without the preview, as
in every stable build, New Workroom stays a plain item and nothing
changes.

An entry that can't be used now is disabled and says why in its title
and tooltip: Apple's needs Apple silicon and macOS 26, either runtime
may not be installed, and creating one still needs a Codaset sign-in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

)

A project's base record can now hold several bases, one per runtime and
Docker context, in a `bases` list. A record without one is a single
base, as every project made before has it, and a project with one base
keeps that form.

A new workroom derives from the base where it is asked for: Apple's, or
Docker's on the context in use now. A base made before #309 has no
context and still serves Docker. When there is none, a base is made
there and recorded beside the others.

Deleting builds an environment per runtime and context, so a project
whose workrooms span Docker and Apple's runtime is taken down whole.
Each base is cleared from config as it goes, so a failure part-way
leaves only what is still live recorded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

- Never stop Apple's builder after a derive: it is one VM for the whole
  Mac, and stopping it killed any other build in flight, another
  project's derive included.
- A derive stops the base only if it was running, and starts it again in
  a task of its own, so a cancelled derive can't leave it down. `stop`
  and `start` are no-ops when already done (1.5.0, measured), so a base a
  reboot left stopped is still derived from.
- Give each Apple container explicit CPUs and memory. The runtime's own
  default is a 1 GB VM, too little for a compiler or an agent. It now
  gets half the cores and a quarter of the memory (2-8 GB), and both can
  be overridden with the hidden containerCPUs/containerMemory settings.
- Escape `$` in the derived image's ENV, WORKDIR and USER: a builder
  expands it, and the image holds the values already expanded.
- Delete the exported disk as soon as the image is built, and have the
  sweep remove the staging folders of derives a crash cut short.
- Take a derived image's process config from the host image when the
  base's own image is gone, since Apple removes images in use.
- Mark bases as bases when a delete adopts them, and check the host's
  own runtime, not any runtime, before reporting a session ended.
- The export's bound is an hour: it prints nothing until it is done, so
  its silence bound is a total one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…t never enrolled (#309)

`wr-agent credential relay --port <port>`, with a secret on stdin,
records where the Mac answers for this workroom and makes
`wr-agent credential` git's helper, as enrolling does. It is idempotent,
so the app can run it on every connect.

`credential get` then answers a workroom that never enrolled by sending
the secret and a github.com request to that port on the box's loopback,
which the app carries back to itself. Only the answer's username and
password reach git. An enrolled workroom always mints its own token and
never asks the relay. When the app isn't connected, git is told to open
the workroom in Workroom.

Anything in the workroom can read the secret and ask, which is the
accepted trade for a local container workroom: it gets the GitHub access
the user's own `gh` has, as a workroom on the Mac itself does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…iner workrooms (#309)

A local container workroom no longer needs a Codaset sign-in. A base
decides how its workrooms reach GitHub, once, and records it: the broker
when signed in to Codaset, else, or when the broker refuses because the
repository's owner hasn't installed the Codaset App, the Mac's own `gh`.

A relayed base clones, and a relayed workroom fetches and branches, with
`gh auth token` as git's header, the way a broker clone token goes. The
workroom never enrols. Later git in it asks `wr-agent credential`, which
the app points at a port on the box's loopback on every connect. The
app carries that port back to CredentialRelay's listener on the Mac's
loopback, which checks the workroom's per-launch secret and answers
github.com over https only, from `gh auth git-credential get`.

The reverse-forward registry is lifted out of the Debug-only broker
route into ReverseForwardRegistry, which both now use.

Accepted (D9 in #309): anything in the workroom can ask, so it has the
user's gh access while the app is connected to it, as a workroom on the
Mac itself does. When the app isn't connected, git is told to open the
workroom. Remote workrooms always enrol.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…309)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

From the review of the relay:

- Set SO_NOSIGPIPE on every accepted connection. Without it, any local
  process could connect, send junk and reset, and the reply's `send`
  raised SIGPIPE, which ended the app. A test of reset peers crashes with
  "signal pipe" without the fix.
- End a `gh` that hangs (a keychain prompt) at its deadline: its output is
  now read on another queue, so the wait can time out. Ignore SIGPIPE on
  its stdin too.
- Keep accepting through descriptor or memory pressure, and forget a
  listener that stops for any other reason, so the next install listens
  again.
- Serve at most 8 requests at once and turn the rest away, and bound each
  request's arrival as a whole, so a flood of slow connections can't hold
  threads or descriptors.
- Refuse to make a secret the system's random source didn't fill, and
  compare secrets in time that depends on their lengths only.
- Close a workroom's relay when it is deleted, retry an install that
  failed, and keep the broker's "install the App" refusal when the gh
  fallback has nothing either.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

With the remote preview on, the context menu's New Workroom opens a
submenu with This Mac, Docker and Apple Container, and a runtime entry
is disabled exactly when its title gives a reason. Without the preview
it stays one plain item.

A fixture launch turns the preview on with -WorkroomUITestRemotePreview,
mirrored into Defaults, since a launch argument would shadow the Bool
key. Without the flag it's pinned off, so no other test sees the
submenu.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…got (#309)

A project's first container workroom pulls the workroom-host image, a
couple of hundred MB, and the row's spinner said nothing for however
long that took. The pull's output is now read as it arrives
(HostStream.communicate's onOutput, stdout and stderr alike) and turned
into a fraction by ImagePullProgress. Without a terminal, Docker prints
only each layer's state, so its fraction is the layers done of those
seen. Apple's container prints `[step/steps] … N%`, which gives its step
and percent.

The fraction reaches the create through a task-local, so
HostDriver.create keeps its shape and two creates at once each hear only
their own. The project row's spinner becomes a circle that fills, with
the percentage in its tooltip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

… the download ring (#309)

A tooltip on the submenu's parent showed on top of the submenu, covering
This Mac (seen in a screenshot of the XCUITest). Each entry keeps its own
tooltip.

-WorkroomUITestImagePull <fraction> seeds the fixture project mid-download,
so an XCUITest checks the row's ring shows that fraction, and both tests
attach screenshots.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…uns (#309)

While a create holds a project, or a delete is taking it, its New
Workroom entries were greyed out with nothing to say why. They now read
"— a workroom is already being created" or "— the project is being
deleted". A runtime's own reason (not installed, needs macOS 26) comes
first, since it outlasts the create in flight. The XCUITest checks it
against a project the fixture seeds mid-download.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

The reason a create in flight blocks the project was repeated after
every entry. It is now one line at the top of the submenu, above
entries that are simply greyed out. A runtime's own reason (not
installed, needs macOS 26) stays on its entry, since it is that entry's
alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

… host it's on (#309)

With the remote preview on, a project row's "+" opens the same places
menu as the context menu's New Workroom: This Mac, Docker, Apple
Container. Both come from one builder, so they can't drift. The menu is
drawn as a plain button, so the "+" looks exactly as it did; checked
against a screenshot of the preview-off button. Without the preview,
"+" still creates on this Mac at once.

A remote workroom's network icon now says what kind of host it is on
in its tooltip: "Docker container (orbstack) on this Mac", "Apple
container on this Mac", or a provider by its driver's name, instead of
just "Remote workroom".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

… tabs and panes (#309)

A workroom tab, a pane's title bar and a detached pane's title showed
the cube for every workroom. One on a host (a container on this Mac or
a remote provider) now wears the network glyph instead, the sidebar's
own sign for it, with the host's kind ("Docker container (orbstack) on
this Mac") as the tab's and pane's tooltip. One on this Mac keeps the
cube, and a root its house. TerminalTarget.workroomGlyph is the one
rule every site reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

… a trailing badge (#309)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

With the remote preview on, picking a project in File ▸ New Workroom… (⌘N, ⌥⌘N and the tab
bar's +) no longer creates on this Mac straight away: it asks This Mac, Docker or Apple Container,
with the sidebar menu's rules for what's off and why. A container workroom can now land as a
split, as one on this Mac does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…oms (#309)

- The credential relay re-forwards when its listener's port moves, retries an
  install that didn't take, bounds gh however it ends, and only answers a
  known secret's request from its answering slots, so idle strangers can't
  hold them.
- A derive checks the broker or the Mac's gh token before it copies the base.
- New Workroom's menus and picker read sign-in from memory, not the Keychain,
  and find gh's sign-in where gh does (GH_TOKEN, GH_CONFIG_DIR, XDG).
- A create re-reads its project, so a stale picker can't overwrite a base's
  record, can land as a split, and says when a signed-in user's base fell
  back to their own gh.
- Opening a workroom starts its container once, even mid-probe; a container
  stopped later stays stopped.
- Image errors say why (runtime not running, registry refused, network); the
  download ring clears when the pull ends; stderr counts against silence.
- Each remote workroom carries its own base's repository; Apple's sweep
  removes leftover derive snapshots.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…ightly (#309)

Container workrooms are Nightly-only until #260, so Release no longer waits on
the host-image build. release.sh refuses a Nightly without a digest-pinned
image, and host-image.yml checks the pinned digest can be pulled anonymously.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…309)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

`make actions-lint` and a `workflows` CI job run actionlint 1.7.12, shellcheck
included, over every workflow. The job isn't behind the changes selector: it
takes seconds, and a workflow edit is what the selector would skip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

…wift infers (#309)

Xcode 26.3 couldn't convert the interpolated String literals to the split's
Substrings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

- An opened workroom's start is spent whatever comes of it: a container that
  won't start is left to the status sweep's backoff, not restarted by it.
- An Apple derive cut off mid-stop starts its base again.
- gh's output is read on the relay's own thread, to EOF or the deadline, so a
  timeout leaves no reader or descriptor behind.
- A pull's stdout and stderr keep their own line buffers.
- The row "+" UI test waits for each runtime's entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD

Fetching and running its download script from a tag ran whatever that tag
pointed at.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TT213ESeZ5wmW6ZYty3mD