cmux-next: size the composer plus menu to content

[teamleaderleo]

Problem

The composer + button opened its attachment menu as a narrow, tall capsule. Its percentage width limits resolved against the 32px picker, so menu rows wrapped into a full-height scrollbar.

Change

• Size composer picker menus to their intrinsic content width with a viewport max width.
• Keep the menu height capped and prevent horizontal overflow.
• Add the composer + case to the popover alignment harness with natural-size bounds.

Validation

• git diff --check
• Targeted Bun tests were attempted, but the checkout's test preload could not resolve @base-ui/utils/useIsoLayoutEffect; fleet and PR CI remain required.

Changelog

Fixed composer attachment menu sizing.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes popover and menu alignment so composer pickers and AppKit menus open against their triggers instead of drifting off the anchor.

• Sizes composer picker menus to their intrinsic content width, capped to the viewport, so the + menu no longer renders as a narrow, tall capsule with a full-height scrollbar; horizontal overflow is clipped.
• Adds shared positioning helpers — useUiAnchor on web and CmuxPopoverAnchor on macOS — that flip sides when space is tight, clamp to the viewport, and translate through zoomed or flipped containers.
• Migrates the composer pickers, changes/handoff/summary menus, and AppKit toolbar, bookmark, and browser anchors to the helpers with a shared 6px gap.
• Covers every anchored menu with a JSDOM harness plus AppKit unit tests, including a composer-plus natural-size check.
• Includes a formatting-only pass over webviews sources and the regenerated agent-pane stylesheet and bundle.

^{Written for commit aa8671b. Summary will update on new commits.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b6e64e7b-8fc5-49fc-8e2d-e3b60b4a93a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Unclear: web / react-apps-check failed: no known signature; failed step: Test webviews.

CI failed on aa8671b946 (run 37502256705 attempt 1): 1 unknown.
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped.

Job	Verdict	Why
web / react-apps-check	unknown	no known signature; failed step: Test webviews

Not re-run automatically: web / react-apps-check is not a machine failure.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way.

[github-actions]

CI fast guards failed on f8e40b2756 (https://github.com/manaflow-ai/cmux/actions/runs/37418140885). It does not block the merge; a red guard merged into main breaks it for every open PR.

Run canonical CMUX CI guard profile

these jobs use a bare GitHub-hosted runner; route them through vars.LINUX_RUNNER / vars.MACOS_RUNNER_IOS so Blacksmith<->overflow stays a repo-variable flip:

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Run canonical CMUX CI guard profile'

Validate local hook trust boundary

Test: python3 tests/test_preflight_trust.py

• PreflightTrustTests.test_hook_installation_has_no_candidate_code_runner

AssertionError: True is not false

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Validate local hook trust boundary'

Check that push and pull_request path filters agree

Test: python3 tests/test_ci_workflow_path_filter_parity.py

Traceback (most recent call last):
  File "/home/runner/work/cmux/cmux/tests/test_ci_workflow_path_filter_parity.py", line 247, in <module>
    test_every_push_only_pattern_is_still_needed()
  File "/home/runner/work/cmux/cmux/tests/test_ci_workflow_path_filter_parity.py", line 183, in test_every_push_only_pattern_is_still_needed
    assert not stale, (
           ^^^^^^^^^
AssertionError: cmux-next.yml: Packages/Shared/**, Packages/iOS/** is no longer push-only. Remove it from PUSH_ONLY_PATTERNS.

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Check that push and pull_request path filters agree'

Validate package test selection

Test: python3 tests/test_ci_select_package_tests.py

    result, count = run_package_step("CmuxUpdater", [(startup, 1), (passed, 0)])
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/cmux/cmux/tests/test_ci_select_package_tests.py", line 102, in run_package_step
    count = int((root / "calls").read_text())
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/pathlib.py", line 1029, in read_text
    with self.open(mode='r', encoding=encoding, errors=errors) as f:
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/pathlib.py", line 1015, in open
    return io.open(self, mode, buffering, encoding, errors, newline)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/tmp_djqq_kp/calls'

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Validate package test selection'

Validate the package test lane's single-suite phase

no build of the package: 'swift build --build-tests -c debug --package-path Packages/macOS/Pkg\nswift test -c debug --package-path Packages/macOS/Pkg --skip-build --filter FooTests\n'

no filtered test run: 'swift build --build-tests -c debug --package-path Packages/macOS/Pkg\nswift test -c debug --package-path Packages/macOS/Pkg --skip-build --filter FooTests\n'

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Validate the package test lane'"'"'s single-suite phase'

Validate side-lane placement onto idle owned runners

• CmuxNextWiring.test_every_mac_job_reads_the_placement

AssertionError: Items in the first set but not the second:
'generated-files'
'daemon-test'

• CmuxNextWiring.test_placement_starts_only_where_attempt_1_may_take_the_side_label

AssertionError: False is not true

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Validate side-lane placement onto idle owned runners'

Validate runner label policy

Test: python3 tests/test_runner_label_policy.py

• TheReportSeesEveryRunnerVariable.test_every_runner_variable_a_workflow_reads_is_reported

AssertionError: Items in the first set but not the second:
'CI_NIGHTLY_DECIDE_RUNNER' : add to CMUX_CI_RUNNER_VARIABLES in ci-health-report.yml and ci-repo-variables.yml when it is a runs-on label, or to NON_LABEL_RUNNER_VARIABLES here when it holds runner names

Fix: CI_NIGHTLY_DECIDE_RUNNER picks a runs-on: label: add CI_NIGHTLY_DECIDE_RUNNER=${{ vars.CI_NIGHTLY_DECIDE_RUNNER }} to CMUX_CI_RUNNER_VARIABLES in both ci-health-report.yml and ci-repo-variables.yml (the two lists must stay equal).
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Validate runner label policy'

Validate reusable guard workflow structure

• Wiring.test_main_full_suite_admission_compiles_on_the_seed_pool_and_xcode

AssertionError: 'blacksmith-6vcpu-macos-15' != 'pool-pr'
- blacksmith-6vcpu-macos-15
+ pool-pr

Fix: the assertion above names what the guard expects; change the tree to match it.
Reproduce in seconds, no build: scripts/ci/guards-local.sh --step 'Validate reusable guard workflow structure'

Agents: python3 scripts/ci/guard_attribution.py fix applies the mechanical fixes locally. This comment is updated in place on each push.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[teamleaderleo]

The remaining red checks are inherited from feat-cmux-next and are outside this two-file change:

• Fast static checks reports the same 94-catalog localization parity failure on base run 37414989645, including the existing AccountsActions.xcstrings needs_review rows.
• web / react-apps-check fails the same existing acpmux turn diff test on base run 37414989645.
• The workflow guard reds are repository-level runner and fixture guard failures, with no changed-file attribution.

The follow-up source diff is limited to composer menu sizing and the anchor harness, and the generated agent-pane index is current via the pinned Bun regeneration check.

[teamleaderleo]

Fleet dogfood is currently blocked by a controller outage, not by the source change. The durable exact-head build job fc5d750a8b8fede44a424739 is retained for the prior app-equivalent head f8e40b2756e; cmux-ci wait and status both time out. The final test-only head submission returned an unknown outcome with a pending receipt, so I did not duplicate it. I will attach the fleet receipt and capture once the controller recovers.

[teamleaderleo]

The final head 24b6339336 now has green scoped PR checks: 10 passed, 0 failed. The fleet build remains queued as job fc5d750a8b8fede44a424739 for the app-equivalent head f8e40b2756e, currently behind saturated native capacity. The final test-only head submission returned an unknown outcome, so it was not duplicated.

[teamleaderleo]

Batch queue: dropped from batch next-batch/20261006 (feat-cmux-next 7cf558be8de1), conflict with feat-cmux-next.

• webviews/src/agent-session/acpmux/styles.css: both sides changed it
• webviews/test/anchor.test.ts: added on both sides

Next: merge feat-cmux-next, resolve, push.

[teamleaderleo]

Batch queue: pushed bun run check:fix output (web formatting and lint autofix) to this branch; landing once its checks rerun.

[teamleaderleo]

Batch queue: green. Batch stack c03ab5ca52f8 on feat-cmux-next 3892c6ce7b55 with #17520 #17527 #17534 #17537 #17541 #17542 #17551 #17552 #17553. Fleet production build: job d1e25b8a9144e8ef3ef2287e (cmux-ci artifact d1e25b8a9144e8ef3ef2287e (job d1e25b8a9144e8ef3ef2287e, tag nb-local-20261006-160146-1)). heavy tier did not run on this branch (run); your PR's own checks are the tests. Validated this PR at 86519577bf6d.

Next: land it yourself with gh-merge-green on this receipt.

[teamleaderleo]

Batch queue: green. Batch stack 585c7c73df5a on feat-cmux-next b7cd157736d2 with #17534 #17537 #17551 #17552 #17556 #17582 #17583 #17588 #17590. Fleet production build: job 4a08261515853623d652f844 (cmux-ci artifact 4a08261515853623d652f844 (job 4a08261515853623d652f844, tag nb-local-20261006-162817-1)). heavy tier did not run on this branch (run); your PR's own checks are the tests. Validated this PR at 581e9693eccd.

Next: land it yourself with gh-merge-green on this receipt.

[teamleaderleo]

Exact-head validation for aa8671b946664b27d2c83f31fdbaaf84e3576321:

• cmux-next Release compile (Xcode 26): passed
• cmux-next swift test: passed
• cmux-next generated files: passed
• Fleet DEV build: job 89ab799b4c82d02cfebeeb46, artifact sha256:4aa242e2ed398a9823ba545ba3f4a2baf61b4cdf07794759beb882a6840da0c9
• The only source red is web / react-apps-check, failing the existing acpmux turn diff test. This is the same failure documented on base run 37414989645, and the PR diff remains limited to composer menu sizing, its anchor test, and the regenerated agent-pane bundle.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37504816847 at 022dce4 failed: cmux-next swift test.
Those jobs last passed at f297f96. This pull request is one of 1 merged since: #17534.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37508043338 at d405637 failed: cmux-next swift test.
Those jobs last passed at f297f96. This pull request is one of 1 merged since: #17534.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37505518483 at 220b743 failed: cmux-next swift test.
Those jobs last passed at f297f96. This pull request is one of 1 merged since: #17534.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.