Add iOS agent event feed

CLI/FeedEventClassifier.swift

@@ -79,7 +79,7 @@ struct FeedEventClassifier {
     /// Whether any of `source`'s registered events carry the
     /// ``FeedEventSemantic/nativeApprovalPrompt`` semantic.
     private static func sourceRaisesNativeApprovalPrompts(_ source: String) -> Bool {
-        feedEventSemanticRegistry[source]?.values.contains(.nativeApprovalPrompt) == true
+        feedEventSemanticRegistry[normalizedSource(source)]?.values.contains(.nativeApprovalPrompt) == true
     }
 
     /// User-attention semantic of a hook/feed event, independent of the
@@ -92,6 +92,10 @@ struct FeedEventClassifier {
         /// Resolved against the tool name so Claude's `ExitPlanMode` /
         /// `AskUserQuestion` approvals route to their dedicated kinds.
         case approvalRequest
+        /// A structured user question, boolean confirmation, or elicitation
+        /// form. These share the AskUserQuestion wire envelope so older
+        /// agents still receive the same reply bridge.
+        case questionRequest
         /// A tool is about to run but no approval is pending. Telemetry
         /// only. Used by agents that expose a *separate* approval event
         /// (Claude, Codex, Hermes) so their pre-tool hook never escalates.
@@ -140,8 +144,61 @@ struct FeedEventClassifier {
         source: String,
         event: String
     ) -> FeedEventSemantic {
-        let table = feedEventSemanticRegistry[source] ?? telemetryOnlyFeedEventSemantics
-        return table[event] ?? .unknown
+        let sourceKey = normalizedSource(source)
+        let table = feedEventSemanticRegistry[sourceKey] ?? telemetryOnlyFeedEventSemantics
+        if let semantic = table[event] {
+            return semantic
+        }
+        // The agent ecosystems do not share one spelling for a structured
+        // user-input request. Once a source is registered in the cmux hook
+        // catalog, normalize the small, explicit family of question names so
+        // new MCP/app-server adapters do not silently become telemetry. This
+        // remains fail-closed for unknown sources and for all other unknown
+        // event names.
+        if registeredFeedSources.contains(sourceKey), isQuestionEventName(event) {
+            return .questionRequest
+        }
+        return .unknown
+    }
+
+    private static func normalizedSource(_ source: String) -> String {
+        let value = source.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        switch value {
+        case "claude-code": return "claude"
+        case "cursor-agent": return "cursor"
+        case "open-code": return "opencode"
+        case "gemini-cli": return "gemini"
+        case "grok-code": return "grok"
+        case "rovo": return "rovodev"
+        case "agy": return "antigravity"
+        default: return value
+        }
+    }
+
+    private static func isQuestionEventName(_ event: String) -> Bool {
+        let normalized = event.unicodeScalars.filter { CharacterSet.alphanumerics.contains($0) }
+            .map(String.init)
+            .joined()
+            .lowercased()
+        return [
+            "askuserquestion",
+            "askuserconfirmation",
+            "askuser",
+            "booleanquestion",
+            "confirmationrequest",
+            "questionasked",
+            "questionv2asked",
+            "questionrequest",
+            "elicitation",
+            "elicitationrequest",
+            "mcpelicitation",
+            "mcpserverelicitationrequest",
+            "requestuserinput",
+            "userinputrequest",
+            "inputrequest",
+            "toolrequestuserinput",
+            "itemtoolrequestuserinput",
+        ].contains(normalized)
     }
 
     /// Tool names that carry their own dedicated approval wire event rather
@@ -166,6 +223,8 @@ struct FeedEventClassifier {
         switch semantic {
         case .approvalRequest:
             return actionable(dedicatedApprovalEvent(for: toolName) ?? "PermissionRequest")
+        case .questionRequest:
+            return actionable("AskUserQuestion")
         case .toolStartMaybeApproval:
             if let dedicated = dedicatedApprovalEvent(for: toolName) {
                 return actionable(dedicated)
@@ -271,6 +330,11 @@ struct FeedEventClassifier {
             "SubagentStart": .subagentStart,
             "SubagentStop": .subagentResponse,
             "Notification": .statusNotification,
+            "AskUserQuestion": .questionRequest,
+            "AskUserConfirmation": .questionRequest,
+            "BooleanQuestion": .questionRequest,
+            "Elicitation": .questionRequest,
+            "ElicitationRequest": .questionRequest,
         ],
         "codex": [
             // Codex runs PermissionRequest hooks before its own approval
@@ -303,6 +367,13 @@ struct FeedEventClassifier {
             "subagent_stop": .subagentResponse,
             "Notification": .statusNotification,
             "notification": .statusNotification,
+            "AskUserQuestion": .questionRequest,
+            "AskUserConfirmation": .questionRequest,
+            "BooleanQuestion": .questionRequest,
+            "Elicitation": .questionRequest,
+            "ElicitationRequest": .questionRequest,
+            "tool/requestUserInput": .questionRequest,
+            "requestUserInput": .questionRequest,
         ],
         "hermes-agent": [
             // `pre_tool_call` is a tool *starting* — Hermes raises a
@@ -321,6 +392,9 @@ struct FeedEventClassifier {
             "on_session_reset": .sessionStart,
             "on_session_end": .sessionEnd,
             "on_session_finalize": .sessionEnd,
+            "ask_user": .questionRequest,
+            "question": .questionRequest,
+            "elicitation": .questionRequest,
         ],
         // Gemini CLI consumes the generic PreToolUse decision schema and has
         // no separate approval event, so it deliberately opts in to blocking.
@@ -336,6 +410,8 @@ struct FeedEventClassifier {
             "userPromptSubmit": .promptSubmit,
             "agentSpawn": .sessionStart,
             "stop": .response,
+            "askUserQuestion": .questionRequest,
+            "ask_user": .questionRequest,
         ],
     ]
 
@@ -356,6 +432,13 @@ struct FeedEventClassifier {
         "SubagentStart": .subagentStart,
         "SubagentStop": .subagentResponse,
         "Notification": .statusNotification,
+        "AskUserQuestion": .questionRequest,
+        "AskUserConfirmation": .questionRequest,
+        "BooleanQuestion": .questionRequest,
+        "Elicitation": .questionRequest,
+        "ElicitationRequest": .questionRequest,
+        "tool/requestUserInput": .questionRequest,
+        "requestUserInput": .questionRequest,
     ]
 
     /// Safe fallback for unregistered sources. Familiar event names preserve
@@ -376,6 +459,15 @@ struct FeedEventClassifier {
         "Notification": .statusNotification,
     ]
 
+    /// Sources with an installed cmux hook integration. They may opt into the
+    /// explicit question-name normalization above; unknown integrations stay
+    /// telemetry-only until their wire contract is reviewed.
+    private static let registeredFeedSources: Set<String> = [
+        "claude", "codex", "opencode", "grok", "pi", "omp", "campfire", "amp",
+        "cursor", "gemini", "kiro", "antigravity", "rovodev", "hermes-agent",
+        "copilot", "codebuddy", "factory", "qoder", "kimi",
+    ]
+
     /// Tools that mutate state and deserve a user-visible approve/
     /// deny prompt in Feed. Keyed on the canonical tool names Claude,
     /// Codex, and similar agents emit. Read-only tools (Read, Grep,

Packages/iOS/CmuxMobileRPC/Sources/CmuxMobileRPC/MobileCoreRPCClient.swift

@@ -731,12 +731,18 @@ public final class MobileCoreRPCClient: MobileSyncing, Sendable {
              "mobile.events.probe":
             return false
         case "notification.feed.list", "notification.feed.mark_read", "notification.feed.mark_unread",
-             "notification.feed.mark_all_read":
+             "notification.feed.mark_all_read", "workstream.feed.list":
             // Feed authority is the authenticated account/peer connection, not
             // a workspace-selection ticket. Omit an irrelevant scoped attach
             // token so legacy pairings cannot accidentally narrow the global
             // feed; Stack auth is still attached to every TCP request.
             return true
+        case "workstream.feed.action", "workstream.feed.reply":
+            return !ticketCoverage.ticketCoversTerminalRequest(
+                ticket: ticket,
+                workspaceSelection: workspaceSelection.value,
+                terminalSelection: terminalSelection.value
+            )
         case "mobile.browser.list", "mobile.browser.create":
             return !ticketCoverage.ticketCoversWorkspaceRequest(
                 ticket: ticket,

Packages/iOS/CmuxMobileRPC/Sources/CmuxMobileRPC/MobileWorkstreamFeedExports.swift

@@ -0,0 +1,3 @@
+/// Workstream DTOs live in the lower shell-model package so aggregation and
+/// RPC decoding share one schema without a dependency cycle.
+public import CmuxMobileShellModel

Packages/iOS/CmuxMobileRPC/Tests/CmuxMobileRPCTests/MobileCoreRPCNotificationFeedAuthTests.swift

@@ -9,6 +9,7 @@ import Testing
         "notification.feed.mark_read",
         "notification.feed.mark_unread",
         "notification.feed.mark_all_read",
+        "workstream.feed.list",
     ])
     func feedRequestsUseAccountAuthorizationWithoutWorkspaceTicketScope(method: String) async throws {
         let route = try hostPortRoute(kind: .debugLoopback, host: "127.0.0.1", port: 58_465)
@@ -32,9 +33,14 @@ import Testing
             ticket: ticket,
             allowsStackAuthFallback: true
         )
-        let params: [String: Any] = ["notification.feed.mark_read", "notification.feed.mark_unread"].contains(method)
-            ? ["notification_ids": ["notification"]]
-            : [:]
+        let params: [String: Any]
+        if ["notification.feed.mark_read", "notification.feed.mark_unread"].contains(method) {
+            params = ["notification_ids": ["notification"]]
+        } else if method == "workstream.feed.list" {
+            params = ["cursor": "00000000-0000-0000-0000-000000000300"]
+        } else {
+            params = [:]
+        }
         let request = try MobileCoreRPCClient.requestData(method: method, params: params)
 
         let task = Task { try await client.sendRequest(request) }
@@ -47,5 +53,46 @@ import Testing
         #expect(frame.attachToken == nil)
         #expect(frame.stackAccessToken == "test-stack-token")
         #expect(frame.hasAuth)
+        if method == "workstream.feed.list" {
+            #expect(frame.cursor == "00000000-0000-0000-0000-000000000300")
+        }
+    }
+
+    @Test(arguments: ["workstream.feed.action", "workstream.feed.reply"])
+    func feedMutationsPreserveMatchingScopedTicket(method: String) async throws {
+        let route = try hostPortRoute(kind: .debugLoopback, host: "127.0.0.1", port: 58_465)
+        let transport = QueuedCancellationProbeTransport()
+        let runtime = TestMobileSyncRuntime(
+            transportFactory: QueuedCancellationProbeTransportFactory(transport: transport),
+            stackAccessToken: "test-stack-token"
+        )
+        let ticket = try CmxAttachTicket(
+            workspaceID: "workspace-main",
+            terminalID: "surface-main",
+            macDeviceID: "test-mac",
+            macDisplayName: "Test Mac",
+            routes: [route],
+            expiresAt: Date().addingTimeInterval(60),
+            authToken: "ticket-secret"
+        )
+        let client = MobileCoreRPCClient(
+            runtime: runtime,
+            route: route,
+            ticket: ticket,
+            allowsStackAuthFallback: true
+        )
+        let request = try MobileCoreRPCClient.requestData(method: method, params: [
+            "workspace_id": "workspace-main",
+            "surface_id": "surface-main",
+        ])
+
+        let task = Task { try await client.sendRequest(request) }
+        let sent = try await transport.waitForSentRequestCount(1)
+        task.cancel()
+        _ = try? await task.value
+
+        let frame = try #require(sent.first)
+        #expect(frame.attachToken == "ticket-secret")
+        #expect(frame.stackAccessToken == "test-stack-token")
     }
 }

Packages/iOS/CmuxMobileRPC/Tests/CmuxMobileRPCTests/TransportTestDoubles.swift

@@ -73,6 +73,7 @@ struct RecordedRPCRequest: Sendable {
     var workspaceID: String?
     var terminalID: String?
     var text: String?
+    var cursor: String?
     var hasAuth: Bool
     var attachToken: String?
     var stackAccessToken: String?
@@ -88,6 +89,7 @@ func recordedRPCRequest(from payload: Data) throws -> RecordedRPCRequest {
         workspaceID: params["workspace_id"] as? String,
         terminalID: params["terminal_id"] as? String ?? params["surface_id"] as? String,
         text: params["text"] as? String,
+        cursor: params["cursor"] as? String,
         hasAuth: auth != nil,
         attachToken: auth?["attach_token"] as? String,
         stackAccessToken: auth?["stack_access_token"] as? String

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/AgentFeedCacheStore.swift

@@ -0,0 +1,51 @@
+import Foundation
+
+/// Account/team-scoped, bounded disk cache for authenticated Feed snapshots.
+actor AgentFeedCacheStore {
+    private let directory: URL
+    private let fileManager: FileManager
+    private let maxMacCount = 20
+
+    init(directory: URL? = nil, fileManager: FileManager = .default) {
+        self.fileManager = fileManager
+        self.directory = directory
+            ?? URL.cachesDirectory.appending(path: "AgentFeed", directoryHint: .isDirectory)
+    }
+
+    func load(scopeKey: String) -> [AgentFeedCachedSnapshot] {
+        guard let data = try? Data(contentsOf: fileURL(scopeKey: scopeKey)),
+              let snapshots = try? JSONDecoder().decode([AgentFeedCachedSnapshot].self, from: data) else {
+            return []
+        }
+        return Array(snapshots.sorted { $0.cachedAt > $1.cachedAt }.prefix(maxMacCount))
+    }
+
+    func upsert(_ snapshot: AgentFeedCachedSnapshot, scopeKey: String) {
+        var snapshots = load(scopeKey: scopeKey)
+        snapshots.removeAll { $0.ownerKey == snapshot.ownerKey }
+        snapshots.insert(snapshot, at: 0)
+        do {
+            try fileManager.createDirectory(at: directory, withIntermediateDirectories: true)
+            try JSONEncoder().encode(Array(snapshots.prefix(maxMacCount)))
+                .write(to: fileURL(scopeKey: scopeKey), options: .atomic)
+        } catch {
+            // Cache failure is non-fatal; the authenticated host remains authoritative.
+        }
+    }
+
+    func clear(scopeKey: String) {
+        try? fileManager.removeItem(at: fileURL(scopeKey: scopeKey))
+    }
+
+    func clearAll() {
+        try? fileManager.removeItem(at: directory)
+    }
+
+    private func fileURL(scopeKey: String) -> URL {
+        let filename = Data(scopeKey.utf8).base64EncodedString()
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "=", with: "")
+        return directory.appending(path: "\(filename).json")
+    }
+}

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/AgentFeedCachedSnapshot.swift

@@ -0,0 +1,11 @@
+import Foundation
+
+/// Authenticated host response retained for offline Feed restoration.
+struct AgentFeedCachedSnapshot: Codable, Sendable {
+    let ownerKey: String
+    let macDeviceID: String
+    let instanceTag: String?
+    let displayName: String
+    let responseData: Data
+    let cachedAt: Date
+}

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/AgentFeedMacSnapshot.swift

@@ -0,0 +1,11 @@
+import CmuxMobileShellModel
+
+/// Last authoritative workstream snapshot received from one Mac.
+struct AgentFeedMacSnapshot {
+    var pages: MobileAgentFeedPageAccumulator
+    var items: [MobileAgentFeedItem]
+
+    var revision: UInt64 { pages.revision }
+    var nextCursor: String? { pages.nextCursor }
+    var hasMore: Bool { pages.hasMore }
+}