feat(remote-session): Stage 2 client-attach (part 1: client protocol) [draft]

.agents/skills/warp-integration-test/SKILL.md

@@ -20,7 +20,7 @@ The core pieces are:
 - `crates/integration/tests/common/mod.rs`
   - The outer Rust test harness used by `cargo test` and `cargo nextest`.
   - Shells out to the integration binary.
-  - Forwards a limited set of env vars (`PATH`, `RUST_*`, `WARP_*`, `WARPUI_*`, `WGPU_*`, display-related vars).
+  - Forwards a limited set of env vars (`PATH`, `RUST_*`, `ZAPLEX_*`, `WARPUI_*`, `WGPU_*`, display-related vars).
   - Re-runs tests up to 10 times when the integration binary exits with the special rerun code.
 - `crates/integration/src/test.rs`
   - Module hub for integration tests.

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -8,15 +8,15 @@ body:
         Thanks for helping improve **Zap** — a community fork of Zap focused on BYOP (bring-your-own-provider) AI, local credentials, and a privacy-first terminal.
 
         **Out of scope (please do not file here):**
-        - Zap cloud account / billing / Zap AI quota / Warpify SSO / Zap Drive cloud sync — these belong to upstream Zap, not Zap.
+        - Zap cloud account / billing / Zap AI quota / Zaplexify SSO / Zap Drive cloud sync — these belong to upstream Zap, not Zap.
         - Issues only reproducible with Zap's first-party cloud agent (Zap ships it disabled).
   - type: checkboxes
     attributes:
       label: "Pre-submit Checks"
       options:
         - label: "I have [searched Zap issues](https://github.com/zerx-lab/warp/issues?q=is%3Aissue+label%3Abug) and there are no duplicates."
           required: true
-        - label: "This bug is in Zap itself — not in upstream Zap's cloud account, billing, Warpify SSO, or cloud-only features."
+        - label: "This bug is in Zap itself — not in upstream Zap's cloud account, billing, Zaplexify SSO, or cloud-only features."
           required: true
         - label: "I have included relevant logs (`RUST_LOG=info` output, panic traces, etc.). Optional, but greatly speeds up triage."
           required: false

.github/ISSUE_TEMPLATE/02_feature_request.yml

@@ -13,7 +13,7 @@ body:
         - **Preserved Zap UX** — Blocks, Workflows, Keymaps, themes; continuously merged from upstream.
         - **Localized UI** — English + Simplified Chinese, community-extensible.
 
-        **Out of scope:** features that require Zap's cloud account, Zap AI gateway, Zap Drive cloud sync, Warpify SSO, billing, team/enterprise admin, or Zap's first-party telemetry. Those belong to upstream Zap.
+        **Out of scope:** features that require Zap's cloud account, Zap AI gateway, Zap Drive cloud sync, Zaplexify SSO, billing, team/enterprise admin, or Zap's first-party telemetry. Those belong to upstream Zap.
   - type: checkboxes
     attributes:
       label: "Pre-submit Checks"
@@ -22,7 +22,7 @@ body:
           required: true
         - label: "I have read the [Zap README](https://github.com/zerx-lab/warp#readme) and this feature is not already supported."
           required: true
-        - label: "This request fits Zap's BYOP / local-first / privacy-first direction (it does NOT require Zap cloud account, Zap AI gateway, Zap Drive cloud sync, Warpify SSO, billing, or telemetry)."
+        - label: "This request fits Zap's BYOP / local-first / privacy-first direction (it does NOT require Zap cloud account, Zap AI gateway, Zap Drive cloud sync, Zaplexify SSO, billing, or telemetry)."
           required: true
   - type: textarea
     id: "describe-solution"

.github/ISSUE_TEMPLATE/03_ssh_tmux.yml

@@ -1,13 +1,13 @@
-name: SSH Warpify (tmux) Issue
-description: "SSH Warpification with tmux fails in Zap. Use this template for that specific scenario."
+name: SSH Zaplexify (tmux) Issue
+description: "SSH Zaplexification with tmux fails in Zap. Use this template for that specific scenario."
 labels: ["bug", "area:ssh"]
 body:
   - type: markdown
     attributes:
       value: |
-        Use this template only when SSH **Warpification** (subshell bootstrap over SSH with tmux) fails in **Zap**.
+        Use this template only when SSH **Zaplexification** (subshell bootstrap over SSH with tmux) fails in **Zap**.
 
-        - Cloud-account or Warpify-SSO issues belong to upstream Zap, not Zap.
+        - Cloud-account or Zaplexify-SSO issues belong to upstream Zap, not Zap.
         - For non-tmux SSH bootstrap failures, use the *Legacy SSH* template instead.
   - type: checkboxes
     attributes:

.github/ISSUE_TEMPLATE/04_ssh_legacy.yml

@@ -5,10 +5,10 @@ body:
   - type: markdown
     attributes:
       value: |
-        Use this template when **Zap** fails to bootstrap a subshell over SSH (the legacy non-tmux Warpify path).
+        Use this template when **Zap** fails to bootstrap a subshell over SSH (the legacy non-tmux Zaplexify path).
 
-        - Cloud-account or Warpify-SSO issues belong to upstream Zap, not Zap.
-        - If your failure is specifically with **tmux Warpification**, use the *SSH Warpify (tmux)* template instead.
+        - Cloud-account or Zaplexify-SSO issues belong to upstream Zap, not Zap.
+        - If your failure is specifically with **tmux Zaplexification**, use the *SSH Zaplexify (tmux)* template instead.
   - type: checkboxes
     attributes:
       label: "Pre-submit Checks"
@@ -77,7 +77,7 @@ body:
     id: "xtrace-output"
     attributes:
       label: "Include shell xtrace output"
-      description: "Run `WARP_DEBUG_MODE=1 ssh YOUR-HOSTNAME-HERE` from inside Zap and paste the full output starting from the SSH command block. Redact secrets before posting."
+      description: "Run `ZAPLEX_DEBUG_MODE=1 ssh YOUR-HOSTNAME-HERE` from inside Zap and paste the full output starting from the SSH command block. Redact secrets before posting."
     validations:
       required: true
   - type: dropdown

.github/ISSUE_TEMPLATE/config.yml

@@ -11,4 +11,4 @@ contact_links:
     about: Architecture notes, upstream-sync plan, and design docs in the repo.
   - name: Upstream Zap (reference only)
     url: https://github.com/warpdotdev/warp
-    about: Zap is an unaffiliated community fork — upstream Zap is shown for reference only. Cloud / billing / account / Warpify SSO issues belong upstream, not here.
+    about: Zap is an unaffiliated community fork — upstream Zap is shown for reference only. Cloud / billing / account / Zaplexify SSO issues belong upstream, not here.

.github/STAKEHOLDERS

@@ -86,12 +86,12 @@
 /crates/input_classifier/ @harryalbert
 /crates/natural_language_detection/ @harryalbert
 
-# Blocklist UX / modality and cloud mode UI / shell compatibility / completions and bootstrap / warpifying
+# Blocklist UX / modality and cloud mode UI / shell compatibility / completions and bootstrap / zaplexifying
 /app/src/ai/blocklist/ @zachbai
 /app/src/root_view.rs @zachbai
 /app/src/terminal/bootstrap.rs @zachbai
-/app/src/terminal/warpify/ @zachbai
-/app/src/settings_view/warpify_page.rs @zachbai
+/app/src/terminal/zaplexify/ @zachbai
+/app/src/settings_view/zaplexify_page.rs @zachbai
 /app/assets/bundled/bootstrap/ @zachbai
 /crates/warp_completer/ @zachbai @szgupta @alokedesai
 

.github/actions/prepare_environment/action.yml

@@ -38,11 +38,11 @@ runs:
     - name: Add Strawberry Perl to PATH and point openssl-src at it (Windows)
       if: ${{ inputs.target_os == 'windows' }}
       shell: bash
-      # openssl-sys (vendored) 用 openssl-src 跑 `perl ./Configure` 编译 OpenSSL。
-      # 仅把 Strawberry 加进 PATH 不可靠:cargo build script spawn 的裸 `perl` 仍会
-      # 解析到 Git 自带的 MSYS perl(缺 Locale::Maketext::Simple,Configure 报错退出 2)。
-      # 显式设 OPENSSL_SRC_PERL 指向 Strawberry perl 绝对路径,绕开 PATH 解析,
-      # 与 openssl-src 官方 CI 做法一致。
+      # openssl-sys (vendored) uses openssl-src to run `perl ./Configure` to compile OpenSSL.
+      # Just adding Strawberry to PATH is unreliable; perl spawned by cargo build scripts still
+      # resolves to the built-in MSYS perl from Git (lacking Locale::Maketext::Simple, Configure fails with exit 2).
+      # Explicitly set OPENSSL_SRC_PERL to point to the absolute path of Strawberry perl, bypassing PATH resolution,
+      # consistent with the official openssl-src CI approach.
       run: |
         echo "C:/Strawberry/perl/bin" >> $GITHUB_PATH
         echo "OPENSSL_SRC_PERL=C:/Strawberry/perl/bin/perl" >> $GITHUB_ENV
@@ -175,3 +175,16 @@ runs:
       if: ${{ inputs.target_os == 'macos' && inputs.is_self_hosted != 'true' }}
       with:
         xcode-version: '26'
+
+    # Xcode 26 ships the Metal toolchain as a separately downloadable component;
+    # without it `xcrun metal` is missing and crates/warpui/build.rs fails to
+    # compile the .metal shaders ("cannot execute tool 'metal' due to missing
+    # Metal Toolchain"). Must run AFTER setup-xcode so it targets the selected
+    # Xcode. `script/macos/install_build_deps` runs `xcodebuild -downloadComponent
+    # MetalToolchain`.
+    - name: Install macOS build deps (Metal toolchain)
+      if: ${{ inputs.target_os == 'macos' && inputs.is_self_hosted != 'true' }}
+      shell: bash
+      run: |
+        cd "${{ steps.repo-root.outputs.path }}"
+        ./script/macos/install_build_deps

.github/workflows/build-remote-server.yml

@@ -0,0 +1,95 @@
+# Build-remote-server — baut NUR das Linux-remote-server-Binary (statisch musl),
+# das auf dem SSH-Ziel-Host (z.B. devhost) als Daemon läuft.
+#
+# Hintergrund: zaplex ist eine macOS-App, aber die persistente Remote-Session
+# läuft als Daemon auf dem Linux-Ziel-Host. Der Client (DMG) erwartet das Binary
+# unter ~/.zaplex/remote-server/zaplex-<GIT_RELEASE_TAG>. Im Fork-Setup schlägt der
+# Auto-Download (zerx-lab/warp releases) fehl, daher wird dieses Binary als
+# Artefakt gebaut und manuell auf den Ziel-Host gelegt (check_binary besteht dann,
+# der Download-Pfad wird nie genommen).
+#
+# Aufruf:  gh workflow run build-remote-server.yml -R byte5ai/zaplex --ref <branch> \
+#            [-f dmg_tag=v0.daemontest]
+# Danach:  gh run download <id> -R byte5ai/zaplex -n zaplex-remote-server-linux-x86_64
+#          → Binary nach  ~/.zaplex/remote-server/zaplex-<dmg_tag>  auf dem Ziel-Host,
+#            chmod 755.  (muss zum dmg_tag des getesteten DMG passen.)
+#
+# Statischer musl-Build (zigbuild) → läuft auf jedem Linux x86_64 unabhängig von
+# der glibc-Version des Hosts. Spiegelt den CLI-Build aus zap_release.yml.
+
+name: Build remote-server (Linux)
+
+on:
+  workflow_dispatch:
+    inputs:
+      dmg_tag:
+        description: "GIT_RELEASE_TAG — muss zum getesteten DMG passen (kosmetisch für die Binary-Version)"
+        type: string
+        default: v0.daemontest
+
+env:
+  CARGO_TERM_COLOR: always
+  CHANNEL: oss
+
+jobs:
+  build_remote_server:
+    name: Build Linux remote-server (musl x86_64)
+    runs-on: ubuntu-22.04
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Free up disk space
+        shell: bash
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \
+            /usr/local/.ghcup /opt/hostedtoolcache/CodeQL /usr/share/swift || true
+          df -h /
+
+      - uses: ./.github/actions/prepare_environment
+        with:
+          target_os: linux
+          is_self_hosted: false
+          install_release_deps: true
+
+      - name: Install zig + cargo-zigbuild for static musl build
+        run: |
+          set -euo pipefail
+          rustup target add x86_64-unknown-linux-musl
+          ZIG_VERSION="0.13.0"
+          ZIG_DIR="$HOME/.local/zig-${ZIG_VERSION}"
+          if [ ! -x "${ZIG_DIR}/zig" ]; then
+            mkdir -p "${ZIG_DIR}"
+            curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-x86_64-${ZIG_VERSION}.tar.xz" \
+              | tar -xJ -C "${ZIG_DIR}" --strip-components=1
+          fi
+          echo "${ZIG_DIR}" >> "$GITHUB_PATH"
+          cargo install --locked cargo-zigbuild --version ^0.19
+        shell: bash
+
+      - name: Build remote-server CLI (static musl via zigbuild)
+        id: bundle_cli
+        run: |
+          script/bundle --channel "$CHANNEL" --arch x86_64 --artifact cli --packages none \
+            --target x86_64-unknown-linux-musl
+        shell: bash
+        env:
+          GIT_RELEASE_TAG: ${{ inputs.dmg_tag }}
+          APPIMAGE_EXTRACT_AND_RUN: 1
+          USE_ZIGBUILD: "true"
+          PKG_CONFIG_ALLOW_CROSS: 1
+
+      - name: Stage binary under the name the client expects
+        # The client looks for ~/.zaplex/remote-server/zaplex-<GIT_RELEASE_TAG>
+        # (remote_server_binary(): binary_name()=`zaplex` + `-<tag>` suffix), so
+        # stage the artifact under exactly that name for drop-in placement.
+        run: cp "${{ steps.bundle_cli.outputs.executable_path }}" "zaplex-${{ inputs.dmg_tag }}"
+        shell: bash
+
+      - name: Upload remote-server binary
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: zaplex-remote-server-linux-x86_64
+          path: zaplex-${{ inputs.dmg_tag }}
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/pr-check.yml

@@ -51,10 +51,10 @@ jobs:
         run: rustup target add x86_64-unknown-linux-gnu
         shell: bash
 
-      - name: cargo check (default = zap-oss bin)
+      - name: cargo check (default = zaplex bin)
         # `cargo check --workspace` would pull in wasm/preview channel-gated
         # targets; check only the default oss bin + its dependency graph, matching
         # the release_linux compile target. (Cargo.lock is gitignored, so no
         # --locked here.)
-        run: cargo check --bin zap-oss
+        run: cargo check --bin zaplex
         shell: bash

.github/workflows/test-dmg.yml

@@ -0,0 +1,93 @@
+# Test-DMG-Pipeline — schlanker macOS-Build NUR fürs Testen.
+#
+# Baut ausschließlich das macOS-Build, das gerade getestet werden soll, und lädt
+# es als Workflow-Artefakt hoch. KEIN Windows/Linux/Intel, KEIN GitHub-Release
+# (anders als zap_release.yml). Gedacht für den schnellen Test-Loop — analog zu
+# test-dispatch.yml für Rust-Tests.
+#
+# Aufruf:  gh workflow run test-dmg.yml -R byte5ai/zaplex --ref <branch> \
+#            [-f arch=aarch64|x86_64] [-f dmg_tag=v0.daemontest]
+#
+# Das .dmg ist ad-hoc-signiert (wie zap_release.yml, --selfsign) → beim ersten
+# Öffnen auf dem Mac einmal:  xattr -rd com.apple.quarantine /Applications/Zap.app
+# (bzw. das .dmg), siehe issue #51. Kein Developer-ID/Notarize im OSS-Channel.
+#
+# `dmg_tag` wird als GIT_RELEASE_TAG eingebrannt und bestimmt den remote-server-
+# Pfad, den der Client auf dem Ziel-Host prüft: ~/.zaplex/remote-server/zaplex-<tag>.
+# Fixer Default, damit das Daemon-Binary auf dem Ziel-Host deterministisch
+# vorab platziert werden kann.
+
+name: Test DMG
+
+on:
+  workflow_dispatch:
+    inputs:
+      arch:
+        description: "macOS-Architektur (aarch64 = Apple Silicon, x86_64 = Intel)"
+        type: choice
+        default: aarch64
+        options:
+          - aarch64
+          - x86_64
+      dmg_tag:
+        description: "GIT_RELEASE_TAG (bestimmt den remote-server-Pfad auf dem Ziel-Host)"
+        type: string
+        default: v0.daemontest
+      fast:
+        description: "Schnell bauen (Debug-Profil: Minuten statt ~Stunde). Für Funktionstests. Aus = release-lto (langsam, optimiert)."
+        type: boolean
+        default: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CHANNEL: oss
+
+jobs:
+  build_dmg:
+    name: Build Test DMG (macOS ${{ inputs.arch }})
+    runs-on: ${{ inputs.arch == 'x86_64' && 'macos-26-intel' || 'macos-26' }}
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: ./.github/actions/prepare_environment
+        with:
+          target_os: macos
+          cache_key: macos-${{ inputs.arch }}
+          is_self_hosted: false
+          install_release_deps: true
+
+      - name: Ensure rust target is installed
+        run: rustup target add ${{ inputs.arch }}-apple-darwin
+        shell: bash
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version: stable
+
+      - name: Install cargo-bundle
+        run: script/install_cargo_bundle
+
+      - name: Install create-dmg
+        run: brew install create-dmg
+
+      # --selfsign = ad-hoc-Signatur (kein Developer-ID-Cert nötig), identisch zu
+      # zap_release.yml. dmg_name_suffix nur fürs Dateinaming.
+      - name: Build ${{ inputs.arch }} bundle (ad-hoc signed)
+        id: bundle_app
+        run: |
+          script/bundle --channel "$CHANNEL" --arch ${{ inputs.arch }} \
+            --dmg-name-suffix "${{ inputs.arch == 'x86_64' && 'intel' || 'arm64' }}" --selfsign \
+            ${{ inputs.fast && '--debug' || '' }}
+        shell: bash
+        env:
+          GIT_RELEASE_TAG: ${{ inputs.dmg_tag }}
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: zap-test-dmg-${{ inputs.arch }}
+          path: ${{ steps.bundle_app.outputs.dmg_path }}
+          if-no-files-found: error
+          retention-days: 7