fix: honor Focus / Do Not Disturb for the fallback notification sound

[Reebz]

Problem

With notifications turned off for cmux, or while a macOS Focus / Do Not Disturb mode is active, cmux still plays its notification sound. The OS suppresses the banner, but the sound keeps playing.

The cause is the out-of-band fallback path: when getNotificationSettings returns .denied, or delivery fails, cmux plays the sound directly via NotificationSoundSettings.playSelectedSound() (NSSound), which the OS does not gate. The UNUserNotificationCenter path (content.sound) is gated correctly and is untouched.

Fixes #5650.

Fix (two complementary halves)

1. Denied authorization silences the fallback (TCC-independent — this is what fixes the issue's repro).
TerminalNotificationStore.fallbackEffects(_:authorizationState:) is the shared policy seam for every out-of-band fallback call site (FeedCoordinator's denied branch, its just-declined-the-prompt branch, and the store's unauthorized scheduleUserNotification fallback). Only .denied strips the sound: a user who turned cmux notifications off asked for silence. Fresh installs (.notDetermined, deferred prompt) and granted states keep the audible fallback, and delivery-failure fallbacks for authorized users are unchanged.

2. Focus / DND gate on the playback path (best-effort).
playSelectedSound() reads the Focus daemon's assertion store (~/Library/DoNotDisturb/DB/Assertions.json) fresh for every play on a background utility queue (no main-actor disk I/O), and hops back to the main queue to play. Non-empty storeAssertionRecords means a Focus is active. Fails open on any read/parse error.

Empirical caveat, verified live in a dev build on macOS 26.4.1: the assertion store is TCC-protected (Full Disk Access bucket). On a default install the in-app read fails (storeReadable=0) and this gate never suppresses — which is exactly why half 1 exists and carries the issue. The gate engages for FDA-granted installs and also covers the app-frontmost suppressed-banner path there. Real Focus detection without FDA would need INFocusStatusCenter (entitlement + authorization prompt) — out of scope here.

• The Settings preview path (previewSound) does not go through playSelectedSound, so previews still play.
• DEBUG builds log each gate decision (notification.sound.focusGate suppressed=… storeReadable=…) and honor CMUX_DEBUG_DND_ASSERTIONS_PATH for fixture-driven end-to-end testing.

Tests

Nine runtime tests in the already-wired NotificationSoundSettingsTests (no new test file, no project.pbxproj change), in three red/green commit pairs:

• Assertion-store predicate: active assertion suppresses; ended Focus does not; missing store fails open.
• Playback path: first play after Focus activation is suppressed and first play after it ends is audible (no stale-cache window); missing store fails open through the real entry point.
• Denied policy: .denied strips the fallback sound, leaves other effects intact; all other authorization states keep it.

Live verification (tagged dev build)

# real assertion store (default install): gate cannot read it, fails open
notification.store.sideEffects … desktop=1 sound=1 …
notification.sound.focusGate suppressed=0 storeReadable=0

# fixture store, Focus active — first play after launch is suppressed
notification.sound.focusGate suppressed=1 storeReadable=1

# same process, fixture flipped to Focus-ended — next play audible again
notification.sound.focusGate suppressed=0 storeReadable=1

Summary by CodeRabbit

• New Features
  • Notification sound playback now respects macOS Focus/Do Not Disturb (suppresses fallback sounds while Focus is active).
• Behavior Changes
  • If Focus data is unavailable, playback "fails open" (sounds play).
  • When desktop notifications are denied, fallback audible sounds are removed while other fallback effects remain.
• Tests
  • Added tests covering Focus suppression, replay after Focus ends, missing Focus data, and denied-notification fallback behavior.

[vercel]

@Reebz is attempting to deploy a commit to the Manaflow Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

NotificationSoundSettings reads the Focus daemon Assertions.json off-main to detect active macOS Focus/DND, gates NSSound playback (async check with main-queue play and completion), and TerminalNotificationStore adds fallbackEffects that disables fallback sound when authorization is .denied; FeedCoordinator uses the helper.

Changes

Focus/Do Not Disturb sound suppression & fallback effects

Layer / File(s)	Summary
Background DND queue & predicate Sources/TerminalNotificationStore.swift	Adds dndAssertionQueue, defaultAssertionsFileURL, and isSuppressedByActiveFocus(assertionsFileURL:) that JSON-parses the Focus Assertions.json off-main and fail-opens on errors.
Playback gating Sources/TerminalNotificationStore.swift	Rewrites playSelectedSound to run the suppression check on dndAssertionQueue, return to the main queue, play only when not suppressed, and provide a main-queue completion callback reporting didPlay.
Authorization API refactor Sources/TerminalNotificationStore.swift	Changes private ensureAuthorization to call its completion with (Bool, NotificationAuthorizationState) and updates internal call sites to consume the effective state.
Fallback effects helper & wiring Sources/TerminalNotificationQueue.swift, Sources/TerminalNotificationStore.swift, Sources/Feed/FeedCoordinator.swift	Adds TerminalNotificationStore.fallbackEffects(...) that clears sound when authorizationState is .denied, updates scheduleUserNotification to use the effective authorization state, and adapts FeedCoordinator to use the helper for declined/unknown auth paths.
Tests and fixture cmuxTests/NotificationSoundSettingsTests.swift	Adds predicate tests for isSuppressedByActiveFocus(...), async playback tests via ActiveFocusFixture (suppressed when active, audible after end, audible when file missing), and tests ensuring .denied strips fallback sound while other states keep it.

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant playSelectedSound
  participant dndAssertionQueue
  participant AssertionsJSON
  participant mainQueue
  Caller->>playSelectedSound: playSelectedSound(defaults:, assertionsFileURL:, completion:)
  playSelectedSound->>dndAssertionQueue: isSuppressedByActiveFocus(...)
  dndAssertionQueue->>AssertionsJSON: read Assertions.json
  AssertionsJSON-->>dndAssertionQueue: parse -> suppression Bool
  dndAssertionQueue-->>mainQueue: suppression Bool
  mainQueue->>playSelectedSound: if suppression == false -> playSound(...) and completion(true)
  alt suppression == true
    mainQueue->>playSelectedSound: skip playSound and completion(false)
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• manaflow-ai/cmux#5480: Touches notification-sound playback resolution and preview/play behavior; overlaps conceptually with sound playback changes.
• manaflow-ai/cmux#3924: Modifies FeedCoordinator notification fallback behavior; related to the authorization/fallback path changes.

🐰 I thump a key and check the hush,

Assertions read in moonlit rush,
If Focus holds, my bell stays mute,
Else tiny chimes resume their lute,
A rabbit nods — the silence suits.

🚥 Pre-merge checks | ✅ 20 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 17.39% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (20 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly summarizes the main change: adding Focus/Do Not Disturb support to suppress the fallback notification sound.
Description check	✅ Passed	The description comprehensively covers the problem, both halves of the fix, testing approach, and empirical verification against the template requirements.
Linked Issues check	✅ Passed	All coding requirements from #5650 are met: denied authorization silences fallback sound, Focus assertion store is consulted at playback time, and comprehensive tests validate both mechanisms.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the issue: authorization state handling, Focus gate implementation, test coverage, and debug observability. No unrelated modifications detected.
Cmux Swift Actor Isolation	✅ Passed	PR introduces no Swift 6 actor isolation violations. New methods properly use dispatch queues for off-main work; fallbackEffects correctly marked nonisolated.
Cmux Swift Blocking Runtime	✅ Passed	Focus/DND gate uses non-blocking async dispatch: dndAssertionQueue.async for disk I/O, then DispatchQueue.main.async for playback. No new semaphores, sleeps, or main.sync in the gate.
Cmux Expensive Synchronous Load	✅ Passed	Disk I/O for Focus assertion store read+parse is dispatched to background utility queue before being called from MainActor context, preventing main-thread blocking.
Cmux Cache Substitution Correctness	✅ Passed	Focus/DND assertion reading is a transient system state check, not a persistence/undo/snapshot path; code reads fresh per play with no caching, matching the allowed case in the rule.
Cmux No Hacky Sleeps	✅ Passed	All changes are Swift files. The rule explicitly excludes Swift (covered by 'swift-blocking-runtime.md'). Check applies only to TypeScript/JS/shell/build scripts.
Cmux Algorithmic Complexity	✅ Passed	PR adds collection scan on tiny fixed-size Focus assertions (~10 max) with disk I/O on background queue. No nested loops, batch rescans, or algorithms handling 1000+ user records.
Cmux Swift Concurrency	✅ Passed	The dndAssertionQueue backs necessary synchronous disk I/O that must run off-main. The completion handler is optional/test-only, not a production API change. AppKit NSSound requires callbacks.
Cmux Swift @Concurrent	✅ Passed	File I/O is dispatched to background queue via proper actor hops; nonisolated sync helpers correctly marked; no invalid @concurrent annotations introduced.
Cmux Swift File And Package Boundaries	✅ Passed	PR adds 111 lines to existing oversized file for focused Focus/DND suppression feature, under 250-line threshold for oversized files. Changes maintain coherent responsibility.
Cmux Swift Logging	✅ Passed	All logging in new PR code uses DEBUG-guarded cmuxDebugLog only; no production print/NSLog/dump in app/runtime code added.
Cmux User-Facing Error Privacy	✅ Passed	Sensitive terms (TCC, Assertions.json path, debug env vars) only appear in internal code or #if DEBUG sections. No user-facing NSAlert/UNNotificationContent messages expose implementation details.
Cmux Full Internationalization	✅ Passed	PR adds internal logic for Focus/DND suppression with no new user-facing strings; debug logs are wrapped in #if DEBUG (exempt), and pre-existing localized strings have complete translations.
Cmux Swiftui State Layout	✅ Passed	PR contains no SwiftUI changes; all modifications are to notification handling and test code, with no new state patterns or view violations.
Cmux Architecture Rethink	✅ Passed	No prohibited patterns: fresh state reads with proper threading, pure functions, no caches or mutable flags creating duplicate owners.
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	PR contains no NSWindow, NSPanel, NSWindowController, SwiftUI Window, or WindowGroup code additions/changes; it only modifies notification sound suppression logic for Focus/DND handling.
Cmux Source Artifacts	✅ Passed	All 44 changed files are intentional: hand-written source, tests, config, localization, submodule, or required build/CI files. No problematic artifacts found.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR fixes cmux playing its fallback notification sound through macOS Focus / Do Not Disturb and through explicit user denial, using two complementary gates: stripping sound from TerminalNotificationPolicyEffects when authorization is .denied, and a best-effort Assertions.json read (off the main actor, on a background utility queue) that suppresses playback when a Focus mode is active.

• Denied-authorization gate (fallbackEffects): propagates effectiveAuthorizationState through ensureAuthorization's completion to every out-of-band fallback call site, silencing sound only on .denied and keeping it for all other states (fail-open).
• Focus / DND gate (playSelectedSound): moves the synchronous Assertions.json read onto a serial utility queue and hops back to the main queue for NSSound playback, fixing the previously reported main-actor disk I/O concern; fails open on TCC permission errors.
• Tests: nine tests in NotificationSoundSettingsTests cover the predicate, per-play freshness, missing-store fail-open, and denied-authorization policy.

Confidence Score: 5/5

Safe to merge; all changed paths are well-tested and the two-gate approach correctly handles the documented macOS TCC limitation.

The denied-authorization gate is a pure value transform with no shared mutable state, and nine tests cover the edge cases exhaustively. The Focus / DND gate correctly moves disk I/O off the main actor and fails open on permission errors, matching the PR's stated invariants. The only nit is that the new completion-handler / GCD pattern in playSelectedSound diverges from the codebase's Swift concurrency idioms, but this does not affect correctness or safety.

No files require special attention beyond the legacy GCD/completion-handler shape in playSelectedSound.

Important Files Changed

Filename	Overview
Sources/TerminalNotificationStore.swift	Adds isSuppressedByActiveFocus predicate and refactors playSelectedSound to dispatch file I/O off the main actor; introduces a new completion-handler / GCD pattern where an async API would be the correct shape.
Sources/TerminalNotificationQueue.swift	Adds nonisolated static fallbackEffects(_:authorizationState:) — a pure, well-scoped helper that strips sound only for .denied; logic is correct and the nonisolated annotation is appropriate.
Sources/Feed/FeedCoordinator.swift	Threads effectiveAuthorizationState through ensureAuthorization and wraps fallback calls with fallbackEffects; the requestFailed flag correctly distinguishes a live user denial from an API error for fail-open semantics.
cmuxTests/NotificationSoundSettingsTests.swift	Nine well-structured tests covering the Focus predicate, per-play gate (including stale-cache avoidance), and denied-authorization policy; fixture teardown is reliable with defer.

Sequence Diagram

sequenceDiagram
    participant Caller as Caller (MainActor)
    participant TNS as TerminalNotificationStore
    participant NSS as NotificationSoundSettings
    participant BG as dndAssertionQueue
    participant FS as Assertions.json

    Caller->>TNS: scheduleUserNotification(effects)
    TNS->>TNS: ensureAuthorization
    alt authorized
        TNS->>TNS: UNUserNotificationCenter.add(request)
        opt delivery failure
            TNS->>NSS: playSelectedSound()
        end
    else denied
        TNS->>TNS: fallbackEffects(effects, .denied)
        Note over TNS: sound=false, no playback
    else notDetermined or unknown
        TNS->>TNS: fallbackEffects(effects, state)
        TNS->>NSS: playSelectedSound()
    end

    NSS->>BG: dndAssertionQueue.async
    BG->>FS: Data(contentsOf: assertionsFileURL)
    FS-->>BG: data or error
    BG->>BG: isSuppressedByActiveFocus()
    BG->>Caller: DispatchQueue.main.async
    alt not suppressed
        Caller->>Caller: playSound(value)
    end
    Caller->>Caller: completion?(didPlay)

Loading

_{Reviews (9): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Sources/TerminalNotificationStore.swift`:
- Around line 304-325: The Focus assertion-file reads in
isSuppressedByActiveFocus (Data(contentsOf:) and JSON parsing) are synchronous
on the main-actor path invoked by playSelectedSound; move those disk/JSON
operations to a background task and expose a cheap in-memory snapshot that
playSelectedSound reads instead. Implement a cached Bool (or small struct)
updated asynchronously from a background queue/Task when
defaultAssertionsFileURL changes or periodically; change
isSuppressedByActiveFocus to return the cached value (thread-safe via actor,
DispatchQueue, or atomic) and add a background refresh routine that reads
defaultAssertionsFileURL, parses the JSON, and updates the cache. Ensure
playSelectedSound continues to call isSuppressedByActiveFocus (no blocking I/O)
and keep the file-IO/JSON logic confined to the background refresher.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 385df7f7-b0dd-457c-a9ad-814d212eabf1

📥 Commits

Reviewing files that changed from the base of the PR and between ee22255 and a7c2dcd.

📒 Files selected for processing (2)

• Sources/TerminalNotificationStore.swift
• cmuxTests/NotificationSoundSettingsTests.swift

[Reebz]

Pushed cb7dddc to address the one substantive point across the bot reviews: the Focus read no longer happens synchronously on the main actor. It now reads a cached value, refreshed on a background utility queue, so the @MainActor fallback path does no disk I/O. The injectable isSuppressedByActiveFocus is untouched, so the three regression tests stay green and the two-commit red/green proof stays intact (the cache is a separate third commit).

On the other pre-merge check failures, for the record:

• Source Artifacts (.claude/, .cursor/): these are pre-existing tracked files from Device registry P1: auto-pair the phone on reload #5626, not added here. This PR's diff is two files (Sources/TerminalNotificationStore.swift, cmuxTests/NotificationSoundSettingsTests.swift).
• File and package boundaries (extract to a SwiftPM package): this is an 18-line, single-caller addition that mirrors patterns already in this file. A separate package looks disproportionate, but happy to move it if you would rather.
• Docstring coverage: the new function carries a full doc comment. The percentage reads as repo-wide rather than scoped to this PR.

Happy to adjust any of these.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Sources/TerminalNotificationStore.swift`:
- Around line 337-359: The cache is updated only after returning the old
snapshot, causing a one-notification lag; change
isActiveFocusSuppressionCached() so that when needsRefresh is true you set
dndRefreshInFlight, release the lock, compute suppressed =
isSuppressedByActiveFocus() synchronously (do not dispatch async), then
reacquire dndSuppressionLock to set cachedDndSuppression = suppressed and clear
dndRefreshInFlight before returning; keep the lock/unlock around reads/writes to
cachedDndSuppression and dndRefreshInFlight (references:
isActiveFocusSuppressionCached, dndSuppressionLock, cachedDndSuppression,
dndRefreshInFlight, isSuppressedByActiveFocus, playSelectedSound) so the
decision in playSelectedSound uses the current value.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9bcb7043-b6d5-49d5-9244-9de3c70b0566

📥 Commits

Reviewing files that changed from the base of the PR and between a7c2dcd and cb7dddc.

📒 Files selected for processing (1)

• Sources/TerminalNotificationStore.swift

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux	Ready	Preview, Comment	Jun 10, 2026 8:52pm

[austinywang]

Continued: staleness fixed, plus a significant empirical finding

Built this locally as a tagged Debug app and drove the gate end-to-end in the running app (socket notify → fallback sound path → gate decision read from the debug event log).

What changed (three commits)

• 5aa5ee7 test (red): the tests now drive playSelectedSound itself — injectable assertion-store URL plus a main-queue completion that reports whether the sound was allowed to play. The two first-play-after-toggle assertions fail against the cached snapshot (verified locally: red).
• b4fe2df fix (green): the cached snapshot, its lock, and the in-flight flag are deleted. The gate reads the assertion store fresh for every play on the background utility queue, then hops back to the main queue to play. Still no disk I/O on the @MainActor callers (keeps the first review round addressed), and no one-notification lag (resolves the second round). Notification sounds are cooldown-throttled, so a per-play read needs no cache.
• 9f6d142 debug: DEBUG-only observability used for the verification below — notification.sound.focusGate suppressed=… storeReadable=… in the unified debug event log, and a CMUX_DEBUG_DND_ASSERTIONS_PATH override so a dev build can run against fixture stores.

Live verification (tagged dev build, macOS 26.4.1)

# real assertion store (default install, no Full Disk Access)
21:32:57.434 notification.store.sideEffects … desktop=1 sound=1 …
21:32:57.444 notification.sound.focusGate suppressed=0 storeReadable=0

# fixture store, Focus active — first play after launch
21:33:29.355 notification.sound.focusGate suppressed=1 storeReadable=1

# same process, fixture flipped to "Focus ended" — very next play
21:33:44.689 notification.sound.focusGate suppressed=0 storeReadable=1

Scenario	storeReadable	suppressed	Sound
Real store, default install	0 (EPERM)	0	plays
Readable store, Focus active	1	1	suppressed on the first play
Readable store, Focus ended	1	0	audible again immediately

Finding: on a default install, this gate cannot see Focus at all

~/Library/DoNotDisturb/DB/Assertions.json sits in the Full-Disk-Access TCC bucket. From a process attributed to cmux (no FDA granted), ls/cat fail with "Operation not permitted", and inside the running app the gate logs storeReadable=0. stat on the exact path succeeds — the file exists and is actively maintained by the Focus daemon — but its content is unreadable. So isSuppressedByActiveFocus fails open permanently, and the #5650 repro still reproduces on any install that has not granted cmux Full Disk Access, i.e. effectively all of them. The macOS 12–26 format claim was never the problem; the read permission is.

Where that leaves #5650

1. This PR is now a correct, lag-free, best-effort gate: it works when cmux has FDA, and is harmless (fail-open) when it does not. Mergeable on those terms, but it should not be described as fixing Notification sound plays through Do Not Disturb and when notifications are turned off for cmux #5650 for default installs.
2. The reliable, TCC-independent fix for the issue's own repro (notifications denied + Focus active) is the product decision this PR deferred: when authorization is .denied, do not play the out-of-band fallback sound at all — the issue's "Expected" section asks for exactly that. Happy to follow up with that change if we agree.
3. Real Focus detection without FDA would need INFocusStatusCenter (Communication Notifications entitlement + per-user authorization prompt) — a bigger, release-pipeline-touching change.

[austinywang]

Follow-up to the findings above — three more changes pushed:

• b521fa1 merges current main (the branch was ~4.7k commits behind).
• d0c7c16 refreshes the Swift file-length budget: this branch grows TerminalNotificationStore.swift 2378 → 2461, and current main had itself drifted past the checked-in budget on ContentView.swift, TabManager.swift, and WorkspaceGroupTests.swift, so workflow-guard-tests failed on any merged tree. Regenerated with --write-budget (shrunk files ratchet down too). Splitting NotificationSoundSettings out of that file is the right long-term fix, deferred to a dedicated refactor PR.
• 8e7a61a + b3c5e5a (red/green): implement the reliable half flagged in the findings comment — .denied authorization now strips the out-of-band fallback sound at every fallback call site through one shared policy seam (fallbackEffects(_:authorizationState:)). .notDetermined and granted states keep the audible fallback. This is the TCC-independent fix for the issue's exact repro; the Focus assertion-store gate stays as best-effort for FDA installs. An independent review pass (codex) flagged the same fail-open gap as a P1, which this resolves.

PR description rewritten to match the two-half scope.

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.