Repository navigation
Composer: a started chat's folder picker lists folders and Choose folder… - #18715
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Not verified: macOS jobs did not run: compile and app tests were skipped on CI passes on Written by |
This comment has been minimized.
This comment has been minimized.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
teamleaderleo
changed the title
Contributor
Gallery4 states changed: agent-pane.subagents/open-many, agent-pane.edited-files/fourteen-files-expanded, agent-pane.subagents/open-done, agent-pane.composer/agent-home-path · 7 play checks failed Diff page and renders (the run's
Live preview (follows this branch; start it with
Play checks failed (0 px anchor movement, 0 layout shift, no frame over 33 ms unless the entry gives a reason):
16 nondeterministic states differed from a second render of the same head (a clock or fixture leak) and are not counted as changes. |
…nce (cx-009a) Review finding: a row that reached paused before retireVm existed never had its run budget spent. Retired rows now carry fenced, set by team_vm.retired_paused; the alarm retires every row that is pausing or paused without it (PATCH budget, then pause or already paused). The events use new idempotency keys (retired-fenced, retired-fence-failed) because a pre-fence row already spent retired-paused:<vm>, and a replayed key would not reduce again. The backfill test now models the pre-fence row exactly (old reducer state, no provider budget, no spent new key). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…goes through a GCD queue (Swift 6: no Thread.isMainThread in async code)
…lt-in rows (cx-odqn)
…-in rows (cx-odqn)
…ext-messageslab-cc52c46 # Conflicts: # scripts/cmux-next/crash-safety-baseline.json
Dogfood of Fork from Here on dog77fk-v1: the forked chat showed its last reply streaming with a caret and the Stop button, because hub fork copied user_message and agent chunks but not turn_started/turn_result.
… servers or skills (red) The reference runs its Claude Code turns with no user setting source and no slash commands. Failing tests: - acpmux accepts the preset args --setting-sources project and --disable-slash-commands; it refuses user/local sources, an empty list (it would drop the project denies) and = forms. - An isolated Claude turn preset and every Claude compactor slot preset pass --setting-sources project --disable-slash-commands; a subagent preset passes none (subagents keep the user's environment). - '[claude-code:unrecognized_model]' (Claude Code 2.1.287 on claude-haiku-5-5) counts as an unavailable model. host::subagent_preset is the subagent preset closure moved out, unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Behavior tests for cx-kxa2: the default icon set keeps today's plans, eight or more candidate sets draw every state and mark permission, question and auth apart, the OSC 7501 kind reaches the row, tab and plan, the Debug menu writes the tunable, and a contact sheet of every set x state x size x theme. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cx-kxa2. StatusIconSet (Debug Settings status.iconSet, Debug menu > Status Icons) restyles working, blocked, done and error marks in every indicator live through the shared StatusIndicatorConfig: sidebar rows, group headers, tab icon slots, tab badges and the OSC 7501 notification badge. Ten sets; the default current set keeps today's plans exactly. Marks are vector alpha masks (StatusMarkArt) tinted with theme roles; SF Symbol sets draw as templates. The OSC 7501 blocked kind (permission, question, auth) rides StatusIndicatorState.waiting(kind:) from ProgramStatusRecord through StatusMapping to the plan and the tab item. StatusIconSet.image draws a still mark from the same geometry; the notification badge uses it with the reason's kind. The candidate contact sheet (StatusIconSetSheetTests) renders every set x state x size x theme with CARenderer; both review sheets now host their sidebar strip in an offscreen window so the rows draw. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ext-status-icons-glyphs-land
…ext-messageslab-cc52c46
…MCP servers or skills As the reference's Claude Code path, Chief turns and compactor nodes now load none of the user's settings, MCP servers, plugins, skills or slash commands, and still sign in with the user's login (credentials are not a setting source). Subagents keep the user's environment. - acpmux: the preset args allowlist takes --setting-sources project and --disable-slash-commands (both take capabilities away). An empty source list stays refused: it would drop the project's denied tools. - optchat-chief: an isolated Claude turn preset passes both (the session directory's settings and .mcp.json still load: the Chief's MCP server, denied tools, hooks off); every Claude compactor slot preset adds them to its args. Checked on Claude Code 2.1.287 with a scratch HOME: a user-scope MCP server and a user skill leave the session's init, the project server and denied tools stay. - An older acpmux that refuses the new words gets the preset with the args it knows (--tools "" and the rest), logged, not with no args. - '[claude-code:unrecognized_model]' counts as an unavailable compactor model (Claude Code 2.1.287 does not list claude-haiku-5-5), so the compactor falls back to the turn model. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s (cx-rcby) Lawrence 2026-10-08: "new group is very ugly, the creation animation is very bad too. make groups like this", then "pixel match" the Chrome tab group sidebar "with our smaller height". - Header: one full-width rounded bar filled with the group's color (the active theme's ANSI palette, lightened; light gray for none), the name in dark regular type, a more (⋮) button on hover and the collapse chevron at the right edge. Radius, padding, type, glyphs, the member indent and the member bar scale with the sidebar row height (the density setting). No member counts. Members carry a thin bar in the group's color. - One editor bubble (name field focused and selected, color dots for none and the palette, New Workspace in Group, Move Group to New Window, Close Group, Ungroup, Delete Group, More Group Actions) opens from the name, the more button, a right-click, Return on a focused header, Rename, and every group a person makes. Rows run through the action registry. - Creation moves once: the new group is a pending edit until the store holds it (cx-odqn rows), the header view carries on under the daemon's id, the bar fades and scales in once (Reduce Motion: fade only). Name and color edits made while the daemon creates the group wait for its id. - A click on the open group's name or more button toggles the editor closed; a click in the list closes it; it follows only a group that just appeared and closes when its group goes or scrolls away. - Strings in en and ja (and the other catalog languages, needs review).
hub fork copied prompts, replies and tools but not turn_started/turn_result, so a pane attached to the fork saw its last reply still streaming and the chat working (caret + Stop) until a new turn ended. Both kinds are now copied, so the fork's turns end and its latest turn can be forked again.
…ext-hq6d-compactor
* fix(cmux-next): restore baseline routing checks * style(webviews): format Chief inspector fixture * ci(cmux-next): repin app FFI to published source The f1a32f1 build passed the app FFI release checks. Pin its immutable release and checksum so the target push verifies the current sources. * fix(gallery): wait for page readiness instead of network idle (cherry picked from commit 8809625) * fix(gallery): recover from renderer target crashes (cherry picked from commit cf9444f) * cmux-agent-pane-policy: answers on _acpmux/permission_respond, only for a pending question and bounded Fixes the base-red AgentPanePolicyParityTests on feat-cmux-next (fleet step c670e2482c527e22bc5ee65a on 5173196): Test thePolicyFileListsAreThisHostsLists() recorded an issue at AgentPanePolicyParityTests.swift:79:13: Expectation failed: (Set(known[method]?["params"] ?? []) → ["permissionId", "optionId", "sessionId"]) == (entry.params → ["optionId", "sessionId", "answers", "permissionId"]) ↳ _acpmux/permission_respond params Cause: d2d1fe1 ("fix(cmux-next): the agent pane bridge passes question answers", ask-gallery lane) added "answers" to the Swift known params of _acpmux/permission_respond; policy.json did not have it. The coordinator's security decision (2026-10-07): mirror "answers", plus two crate limits the Swift host does not have yet (its half goes to the ask-gallery lane): - answers only when the pending permission is a question (request.toolCall._meta.acpmux.question an object, the acpmux hub's mark, plans/cmux-next/agent-questions.md section 3); a tool permission, or one the host never saw, is refused (transport.intent_invalid). PermissionOptions records it from the frames it already observes (is_question); a permission seen once without the mark is not a question. - answers an object of 1 to 64 item ids, each id and each value at most 4096 UTF-8 bytes, each value a string or a list of strings (a list counted together). policy.json question_answers holds the numbers. The frame limit, the gesture rule (an allow still needs a fresh gesture) and the refusal of other extra keys (updatedInput) do not change. Cases: check.json 13 new (41 now; the Swift and Rust count asserts follow), the refused ones with swift_gap / swift_expect, so the Swift suite stays green and fails, naming the gap, once Swift adds the rule; params.json (answers known, updatedInput still breaks); gestures.json (an answer with an allow needs a gesture); parity.rs question_permissions. Red check: with the rule off, full_check_order fails. * fix(cmux-next): keep new column before new row * test(cmux-next): close parity fixture gaps * style(gallery): format chief inspector fixture * style(gallery): match vp formatter output * fix(cmux-next): enforce aggregate answer bounds * test(cmux-next): match redacted compatibility detail * fix(cmux-next): admit macOS helper inputs and annotate reap * test(cmux-next): align answer parity bounds * docs(policy): refresh answer parity description * test(ci): track current cmux-tui trigger inputs * test(cmux-next): seed parity question items * ci(cmux-next): route resource binaries through workflow * test(cmux-next): model combined question permission state --------- Co-authored-by: lawrencecchen <54008264+lawrencecchen@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n starts (red) Dogfood at fb211f1: a node's line was stored only after end_node had started the slot's warm session (about 2.3 s of Claude Code start on cmux-lawrence-2: node 32+1's trace at +0 s, its host.log line and the waiting turn at +2.3 s). Every node and every turn waiting for one paid it. Adds AcpmuxCompactor::shared (seam) and a fake slow session start; the failing test: run_node returns within 2 s while the warm session takes 3 s to start. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…18749) 5afc9b2 added CmuxInstallAuthCore to Package.swift without regenerating ci-target-graph.json, so cmux-next generated files fails on feat-cmux-next and every PR. This is the graph scripts/cmux-next/ci-target-graph.py regenerated in base run 37879215803 (artifact cmux-next-generated-patch). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…call runs the answers together Dogfood 2026-10-08: a subagent report arrived while the Chief wrote its reply to the earlier reports. Steered, Claude Code ends that answer and answers the report as one more turn of the same prompt; the fold joins both answers' text into one paragraph. The post should hold both answers, the first one first. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: cover compact turn footer actions * fix: compact turn footer actions * fix: format turn footer regression test * style: format turn footer test * fix: keep compact fork glyph readable
…e posts every answer When a steered message arrives after the turn's last tool call, Claude Code ends its answer (result) and answers the message as one more turn of the same prompt. The fold now closes the reply segment at each Claude Code result and keeps the finished answers; the posted reply is those answers then the last one, separated by a blank line. A prompt with one result posts as before (the compactor's single answer is unchanged). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The publish job must create cmux-app-ffi-* tags with a token of the dedicated FFI release App (manaflow-cmux-ffi-release, a bypass actor of ruleset 24624526), minted in the ffi-release environment for this repository only, also when workflow files changed. The signing guard lets only app-ffi-release.yml's publish job read CMUX_FFI_RELEASE_APP_*, only in ffi-release, and keeps CMUX_RELEASE_APP_* in release and release-next. This commit adds the failing guards only. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
GITHUB_TOKEN gets HTTP 403 on cmux-app-ffi-* tags (run 37272232472): ruleset 24624526 admits only admins. The publish job now runs in the ffi-release environment (feat-cmux-next only), mints a token of the dedicated FFI release App (manaflow-cmux-ffi-release) for this repository with contents:write, and workflows:write only when workflow files changed since the last FFI tag. Only the release create uses it; GITHUB_TOKEN is read-only. The workflow-files-changed skip is gone. Ruleset 24624527 still makes the tags immutable for everyone. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
end_node started the slot's warm session before returning, so a node's line (and a turn waiting for it) waited for a Claude Code start: about 2.3 s on cmux-lawrence-2 (the 2.3-3.4 s settle waits after subagent reports in the fb211f1 dogfood run were this; the node itself was done). The host's compactor is now shared (AcpmuxCompactor::shared) and starts the warm session on its own thread after the node returns; an unshared compactor (tests) still warms up in line. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ext-hq6d-compactor
…ext-hq6d-compactor
…red) Two runs of one commit must give byte-identical zips, two commits must give different header mtimes, so a warm tree rebuilds the Clang module after a pin change. Fails until stamp-app-ffi-mtimes.sh exists.
…e Chief's owner (red) Live proof subp3 on cmux-lawrence-2: every subagent's done mark failed with rename-workspace: unknown workspace key.
…ript/React and refactors Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The xcframework files and directories got a fixed 1980 mtime, so every release had the same header mtimes and a warm tree reused a stale Clang .pcm after a pin change (cx-4ncv). stamp-app-ffi-mtimes.sh stamps them with the UTC commit time of the FFI source: a rerun of one commit still gives the same zip bytes, and a new pin gives new header mtimes.
…e row's edge Lawrence 2026-10-08: "too much space on right of star, need hover effect on each entry". A row carried bg-transparent and bg-hover together; Tailwind's output order let bg-transparent win, so no row ever filled. The fill is now one class per state (rowFill). The empty check slot that every row reserved is gone: the check renders only on the current model, the star sits 6px from the edge, and the label's right padding fits one icon (two on the current model). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
force_unwrap CmuxNextSettings 5 -> 0 (no path that trapped is reachable from a caller): - JSONC private setting(_:at:in:...): `guard let key = path.first` (the public entry already refuses an empty path). - JSONValue render, ManagedStatusReport.body: iterate sorted key/value pairs instead of re-reading the dictionary by key. - ShortcutBinding.functionKey: function-key codes are valid private-use scalars; NUL stands in rather than a trap. - SurfaceTabBarParser: `case let type? where ...` binds the form instead of `forms.first!`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…p's daemon AppWorkspaces took the host's --daemon-socket, which under the app is the Chief's conversation owner; the app makes subagent workspaces in its own daemon (CMUX_APP_DAEMON_SOCKET, cmux_env::app_daemon_socket). Every done mark (and the close setting) failed with unknown workspace key.
…ext-subagent-parity
Base re-indented the composer props; the folder move's canMove, projectChoices and onBrowseFolder are reapplied on base's block. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5b7981c. Configure here.
| value["env"]["DISABLE_PROMPT_CACHING"] = json!("1"); | ||
| } else if let Some(env) = value["env"].as_object_mut() { | ||
| env.remove("DISABLE_PROMPT_CACHING"); | ||
| } |
There was a problem hiding this comment.
Cache rewrite exposes private settings
Medium Severity
set_session_cache rewrites the session settings.json files with write_if_changed after those files now hold copied user settings env, including API tokens. The initial write uses write_private (0600), but the first TTL or DISABLE_PROMPT_CACHING change replaces them via std::fs::write and rename, which creates a world-readable file under a typical umask.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5b7981c. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dogfood 2026-10-08, item C5 (screenshot 09). In a started chat, the composer's folder control opened a filter field over one row, the chat's own folder, so choosing "went nowhere". It listed only folders that chats had already used.
A started local chat's folder popover now offers real choices:
project.browse).Choosing a different folder moves the chat there through the existing move path, so the move line and
cdchip appear as before. Typing a path still works. A Cloud chat's folder stays a label.A first version used the new chat's folder menu instead. It lost the popover's close-on-repress under WebKit (
quickComposer.test.tsx), so the popover stays and gains the rows.Testing
web / react-apps-check(job): the new test fails at Choose folder… (no such row); it is the only failing testrole="separator"on a div); ccb8f5c makes it anhrweb / react-apps-check(job): lint, types and all 329 web test files passweb / react-apps-check(job):Choose folder… pressed as WebKit delivers the press still opens the folder dialogfails (the field's blur closed the picker first); it is the only failing testweb / react-apps-check(job): lint, types and all web test files passquickComposer.test.tsxpopover tests (job)Tests in
projectChooser.test.tsx:a started chat's folder picker lists the folders and Choose folder…, and a choice moves the chat,Choose folder… pressed as WebKit delivers the press still opens the folder dialog.Not run: a review sub-agent (lane rule: no sub-agents). No local bun; hosted CI only.
Changelog
Fixed: In a started chat, the folder picker lists your project folders and Choose folder…, and choosing one moves the chat.
Proof
Gallery render: #18715 (comment)
🤖 Generated with Claude Code
Note
High Risk
Changes production/staging deploy gates, rollback behavior, and GitHub App release credentials, plus broad OptChat harness/session behavior that affects live agent turns.
Overview
This PR is a large cmux-next infrastructure and OptChat batch, not the composer folder-picker work described in the existing PR text.
Release rails and deploy safety add
scripts/cmux-next/releasetooling and wire it through CI: migration lint (expand-only rules, numbering, hash lock) on backend and cmux-vm, a newrelease-railsworkflow with Postgres-backed tests, and staging/production deploy paths that refuse deploys when the target DB lacks migrations, record the previous Worker version, runrelease-smoke.json, andwrangler rollbackon failure. cmux-vm staging deploy timeout increases to 25 minutes to fit the new steps.App FFI publishing moves tag/release creation off read-only
GITHUB_TOKENto a dedicated GitHub App in theffi-releaseenvironment (contents:write, optionalworkflows:writewhen workflow files changed). Archive assembly now runsstamp-app-ffi-mtimes.sh(commit-time mtimes) instead of a fixedtouchepoch for stable zips and correct Clang module rebuilds after pin changes.OptChat Chief overhauls Claude prompt caching for the API’s 4-mark limit: turns/compactors that carry the view mark set
DISABLE_PROMPT_CACHING=1;last_markpersists across restarts; subagents no longer use shared-view marks or single-flight warm-wait—they start in parallel with Claude Code’s own step caching. Turns gain isolation preset args (--setting-sources project, tool allowlist, etc.) with fallback when older acpmux rejects them; compactor slots can copy the user’ssettings.jsonenv** (macOS-gated, **0600** private writes). Steering can concatenate multiple **result** answers; workspace renames target **CMUX_APP_DAEMON_SOCKET` when set.Mobile adds
invalidSizecaps on render-grid frames andMobileProtocolFuzzTests(mutation fuzz on network decoders). CI adds herdr upstream drift (scheduled issue) and herdr-sync checks in cmux-next. Nightly notary wait is 40m for all tracks. Agent brands gain several CLI alias mappings.Reviewed by Cursor Bugbot for commit 5b7981c. Bugbot is set up for automated code reviews on this repo. Configure here.