cmux-next agent pane: cap crash reloads; a closed pane is not held by its handshake

[teamleaderleo]

Summary

Two agent pane lifecycle fixes from the Swift lifecycle batch.

• Crash reload cap. When the pane's web content process crashed, AgentPaneNavigation reloaded the page every time. A page that crashes as it loads looped forever. AgentPaneCrashReloads now allows 3 reloads per 10 minutes. After that the pane shows a native notice with a Reload button, which resets the count.
• A closed pane held by its handshake. AgentPaneBridge held a strong reference to the view across model.respond(to: .ready). That call can wait up to 20 seconds while acpmux starts, so a closed tab kept its AgentPaneView and WKWebView alive until then. The bridge now checks trust and replays customization synchronously, then awaits only the model.

Testing

Red first (commit 15bc3f73529), then the fix. Both run in the cmux-next swift test lane:

• AgentPaneCrashReloadsTests.aPageThatKeepsCrashingStopsReloading
• AgentPaneBridgeTests.aClosedPaneIsFreedWhileItsHandshakeIsPending

Red and green results are in the comments below. The lane's known failures (RemoteMachineCompat, DaemonStartupState, ColumnCloseScroll) are unrelated and owned elsewhere.

Changelog

none

🤖 Generated with Claude Code

https://claude.ai/code/session_01RYQHfug1ZVQDp4eWgwVUtD

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e1fc98bc-7bd6-4617-8ddd-55ecdfa5c03f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

Red at d33888d03af (cmux-next swift test, attempt 1, job 110545802920):

• aPageThatKeepsCrashingStopsReloading: decisions were [true, true, true, true, true], expected [true, true, true, false, false].
• aClosedPaneIsFreedWhileItsHandshakeIsPending: weak.view was still an AgentPaneView after close, while the handshake was pending.

The first bridge test (15bc3f7) didn't hold the pane, so it hung until the lane's 20-minute cap; d33888d fixed the test. The fix is pushed; the green result will follow.

[teamleaderleo]

Subagent review at ef89546: LGTM.

• First pass at c57ecf8: LGTM. It confirmed the trust check is still synchronous with no await before use, nothing else retains the view during the handshake, and GatedHost can't miss its wakeup.
• Addressed in ef89546: the reload window is 10 min (a 20 s+ load-to-crash loop never hit a 60 s cap); the notice follows the pane's theme; the inset constraint yields in narrow panes; the bridge test has a time limit.
• Optional, left as is: the notice has no background of its own and relies on the crashed web view showing underPageBackgroundColor.

[cubic-dev-ai]

3 issues found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneNavigation.swift">

<violation number="1" location="Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneNavigation.swift:27">
P3: This comment still describes an unconditional reload, but `webContentProcessDidTerminate()` shows a notice after the crash cap instead. Document the capped behavior so this delegate does not promise a handshake when the pane is waiting for the user.</violation>
</file>

<file name="Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneCrashReloads.swift">

<violation number="1" location="Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneCrashReloads.swift:16">
P2: This elapsed-time cap uses wall-clock `Date`, so system-clock corrections can suppress reloads for too long or allow them too soon. Track crashes with `ContinuousClock.Instant` (or uptime) instead.</violation>
</file>

<file name="Packages/macOS/CmuxNext/Tests/CmuxNextAgentPaneTests/AgentPaneBridgeTests.swift">

<violation number="1" location="Packages/macOS/CmuxNext/Tests/CmuxNextAgentPaneTests/AgentPaneBridgeTests.swift:43">
P3: The test computes a temp path `agent-pane-bridge-test.html` and passes it as `AgentPaneSource.bundled(page)`, but never writes the file. `AgentPaneView.init` calls `source.load(into: webView)` → `loadFileURL(page, ...)` on a nonexistent file, so the pane tries to load a page that does not exist. The assertions pass only because the test drives `reply(to:)` directly and nothing reads the file, but the fixture is misleading and load behavior on a missing file is left to WebKit. Create the file (or load the real `AgentPaneView.bundledPage`).</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This elapsed-time cap uses wall-clock Date, so system-clock corrections can suppress reloads for too long or allow them too soon. Track crashes with ContinuousClock.Instant (or uptime) instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneCrashReloads.swift, line 16:

<comment>This elapsed-time cap uses wall-clock `Date`, so system-clock corrections can suppress reloads for too long or allow them too soon. Track crashes with `ContinuousClock.Instant` (or uptime) instead.</comment>

<file context>
@@ -0,0 +1,20 @@
+
+    /// Records a crash at `now`; true when the page should reload.
+    mutating func shouldReload(at now: Date) -> Bool {
+        crashes.removeAll { now.timeIntervalSince($0) >= Self.window }
+        crashes.append(now)
+        return crashes.count <= Self.limit
</file context>

[cubic-dev-ai]

P3: This comment still describes an unconditional reload, but webContentProcessDidTerminate() shows a notice after the crash cap instead. Document the capped behavior so this delegate does not promise a handshake when the pane is waiting for the user.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneNavigation.swift, line 27:

<comment>This comment still describes an unconditional reload, but `webContentProcessDidTerminate()` shows a notice after the crash cap instead. Document the capped behavior so this delegate does not promise a handshake when the pane is waiting for the user.</comment>

<file context>
@@ -24,10 +24,10 @@ final class AgentPaneNavigation: NSObject, WKNavigationDelegate {
 
-    /// A crashed web content process leaves a blank pane; reload the page,
-    /// which asks for a fresh handshake and reattaches the session.
+    /// A crashed web content process leaves a blank pane; the view reloads
+    /// the page, which asks for a fresh handshake and reattaches the session.
     func webViewWebContentProcessDidTerminate(_ webView: WKWebView) {
</file context>

Suggested change

	/// A crashed web content process leaves a blank pane; the view reloads
	/// the page, which asks for a fresh handshake and reattaches the session.
	/// A crashed web content process leaves a blank pane; the view reloads
	/// within the cap, then shows a Reload notice instead.

[cubic-dev-ai]

P3: The test computes a temp path agent-pane-bridge-test.html and passes it as AgentPaneSource.bundled(page), but never writes the file. AgentPaneView.init calls source.load(into: webView) → loadFileURL(page, ...) on a nonexistent file, so the pane tries to load a page that does not exist. The assertions pass only because the test drives reply(to:) directly and nothing reads the file, but the fixture is misleading and load behavior on a missing file is left to WebKit. Create the file (or load the real AgentPaneView.bundledPage).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At Packages/macOS/CmuxNext/Tests/CmuxNextAgentPaneTests/AgentPaneBridgeTests.swift, line 43:

<comment>The test computes a temp path `agent-pane-bridge-test.html` and passes it as `AgentPaneSource.bundled(page)`, but never writes the file. `AgentPaneView.init` calls `source.load(into: webView)` → `loadFileURL(page, ...)` on a nonexistent file, so the pane tries to load a page that does not exist. The assertions pass only because the test drives `reply(to:)` directly and nothing reads the file, but the fixture is misleading and load behavior on a missing file is left to WebKit. Create the file (or load the real `AgentPaneView.bundledPage`).</comment>

<file context>
@@ -0,0 +1,60 @@
+    /// its trust check (a test cannot make a WKScriptMessage).
+    @Test(.timeLimit(.minutes(1))) func aClosedPaneIsFreedWhileItsHandshakeIsPending() async throws {
+        let host = GatedHost()
+        let page = FileManager.default.temporaryDirectory.appendingPathComponent("agent-pane-bridge-test.html")
+        let weak = Weak()
+        var view: AgentPaneView? = try autoreleasepool {
</file context>