[teamleaderleo]

SHOW LEO. risk:high (update path): Leo approves the final head before it merges. Adopted by dead-owner-adopt-cmux from orphan-sweep; the original work is the cx-1mbnu lane's. #20920, which it depends on, merged 10-15.

Update Everything (cx-1mbnu) is one palette and app-menu action. It updates the app, every connected machine's cmux daemon and each machine's agent CLIs, then restarts that machine's chats on the new CLIs. It asks once, with:

• a line per machine;
• how many running chats restart;
• "Continue threads after restarts" (on).

Machines update in parallel. The app's own Sparkle update goes last because it relaunches. The relaunched app finishes the run from a journal note in Application Support: once the named machines reconnect, it moves them to the newer bundled daemon.

What it updates, and where

Machine	cmux daemon	Agent CLIs	App
This Mac	never: the local daemons move to the bundled build on their own (#23199)	yes, through the local daemon's agent-update-apply	yes, Sparkle, last, only when an update is already staged
SSH machine	yes: SSHService.install of this app's pinned cmux-tui	yes	n/a
cmux Cloud machine	yes: cmux link machine update --to-bundled, refused like SSH when Cloud is turned off by the organization	yes	n/a
Paired server (Chief brain)	never: its installer owns it	only with updates.updateEverythingServers on (off by default)	n/a

Paired servers are skipped by default. A paired server (ServerMachineSession) runs a Chief brain whose binaries belong to its own installer, and other people may use it. Update Everything leaves it out unless Settings > General > Updates > Include Paired Servers in Update Everything (updates.updateEverythingServers) is on. Even then, only its agent CLIs update and its chats restart. daemonChange and updateDaemon never touch a server's cmux.

Overlap checked

• cmux-tui: Update Everything updates a machine's agent CLIs and continues its chats (cx-1mbnu) #20920 (merged 10-15): the daemon side, agent-update-plan / agent-update-apply and cmux link machine update --to-bundled. This PR is its client.
• cmux-next: local acpmux and cmux-tui move to the bundled build by themselves #23199 (daemon-autoupdate, open): moves This Mac's acpmux and cmux-tui to the bundled build on their own. Update Everything never updates the local daemon, so the two don't overlap.
• cmux-next: safe continuous nightly updates #20295 (release rings: idle install and relaunch gate, open): the app step calls UpdaterService.installAvailableUpdate(), so it goes through whatever relaunch gate cmux-next: safe continuous nightly updates #20295 adds. This PR has no second relaunch path.

What changed

• CmuxNextUpdateEverything is a new module, outside CmuxNextApp. It holds:
  • the action body (UpdateEverything.bind), the plan, the confirmation and result toasts, the runner and the relaunch journal;
  • machine discovery and the update steps (UpdateEverythingHostSteps);
  • each machine daemon's agent-update-plan / agent-update-apply and the wait for a replaced daemon (UpdateEverythingDaemon).
• App wiring. The App injects what only it has through UpdateEverythingHost, a struct of closures: its machines, SSHService.install, the Cloud update call and the active window. UpdateEverythingHost.app(_:) and one bind line are all of it. The app's existing update actions (UpdateHandlers) move into the module.
• Chats left on the old agent are named. When some chats couldn't restart, the result toast says "Threads on devbox still run the old agent: …". An older daemon without cmux-tui: Update Everything updates a machine's agent CLIs and continues its chats (cx-1mbnu) #20920's threads_failed / threads_error still decodes.
• New setting: updates.updateEverythingServers (toggle, off). Its source is schemas/settings/source/updates.json; the PR autofix regenerates the exports.
• Capture support: the DEBUG control debug.update_everything {action: confirm|progress} and the tour update-everything. They open the real confirmation for a fixed plan (This Mac, an SSH machine, a Cloud machine and a paired server) and the progress toast. Nothing updates.
• The action is updates.updateEverything. Its strings and the new setting's are in all 21 catalog locales.

Tests

CmuxNextAppTests/UpdateEverythingRunTests drives the runner through the steps protocol the App implements:

• aRunUpdatesEveryMachineThenTheAppLastAndTheRelaunchFinishesIt:
  • an SSH machine updates its daemon, then the agent CLIs its new daemon lists;
  • This Mac updates its agent CLIs;
  • the app installs last;
  • the relaunched app finishes the SSH machine once;
  • a third launch does nothing.
• aPairedServerUpdatesOnlyItsAgentCLIsNeverItsDaemon (new): a server never gets a daemon change or a daemon step; its agent CLIs update.
• chatsThatCouldNotRestartAreNamedInTheResult, aFailedDaemonUpdateStopsThatMachinesAgentUpdate, aDaemonThatDoesNotNameItsBuildIsNotCalledOutdated, and the launch-check and no-window cases.

Earlier fleet runs at older heads (before this base merge): red-then-green for the threads reason (steps 0976f7f19630585ef88a43d1, 6de1aa6a8db4bc9afac14dc5), all 347 suites green at 4178ae9 (step 8638da2362de71a6e1d25295) except a display-only sidebar test that also fails on unrelated branches, and a Release compile (step 0193f5f31738075eed4df6d3). This head's compile and tests run in this PR's CI.

Observed / Not run

• Observed: gen-settings-sources.py --check, prepush-gate.py (no new violations) and generated_outputs.py drift locally on the head.
• Known red: the defaults guard needs an approving review from lawrencecchen or austinywang for the new default updates.updateEverythingServers: false.
• Not run: no local Swift build (none on this host). The compile, tests and settings exports come from CI and the PR autofix. Not tested live against a real SSH, Cloud or server machine at this head.

Known limits (review findings, not fixed here)

• agent-update-apply gets a fixed 30 minutes. The daemon allows 15 minutes per CLI plus restart time, so with several slow CLIs the app can report a timeout while the daemon is still updating.
• daemonChange treats any build other than the bundled one as outdated. A Mac on an older build than a shared SSH machine's daemon would move that daemon back.
• A failed agent CLI update on This Mac skips the app update. If Sparkle accepts the install but doesn't relaunch, the waiting SSH and Cloud machines aren't updated.
• The run after the relaunch shows no progress toast.
• Fixed in this PR: the relaunched app now updates only the machines the person confirmed, not one that connected meanwhile (59ae151d).

Captures

Capture tour-update-everything at 7a2dbd6e5154 (fleet build, capture mini, text checked for private data)

Light	Dark

The tour opens the real confirmation for the fixed DEBUG plan, with the progress toast below it. The dark still reads cleanly. In the light still the dialog's text has low contrast: that is the shared CmuxDialog styling (or the light-appearance switch mid-dialog), not this PR's code. Captured at 7a2dbd6e; the final head c242dc8e differs from it only by a base merge that doesn't touch Update Everything.

Changelog

• Added: Update Everything updates the app, every connected machine's cmux daemon and agent CLIs, and continues their chats, with one confirmation. Paired servers are included only through a setting, and only for their agent CLIs.

🤖 Generated with Claude Code

Agent session: huge-blue

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 17f6e547-7834-42fe-bf02-9fbe24d63a57

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 15a20a7: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr20940 -f ref=codex/cx-1mbnu-update-everything -f platform=macos -f backend_mode=local

Passes: CI passes on 15a20a792f.

CI passes on 15a20a792f (run 39706172992 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 47ae435 to compare; do not merge until green; see lane-rules

CI fast guards passes on 395a5e1989 (run). This covers only the fast guards, not CI: CI's result is ci-status.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Recut onto feat-cmux-next cd2e0cd46bd0 as one commit (613caed1dc12), now that #20920 has landed. All 29 files and the module's catalog match the old head; nothing new in the code. The base conflicts: CmuxNextAppTests gained CmuxNextFocus meanwhile, so the module sits next to it, and actions.md keeps the base's counts for the export autofix to recount. No Swift build here; CI compiles it. Not merging on green: this PR asks to be shown to Leo first.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › Tier routing is red on 5 of 8 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

Review (subagent, correctness first): SHIP at 395a5e1

Re-review since the last SHIP at 9dd5810:

• The PR's own non-generated changes, diffed against its merge base, are line-for-line the same as at 9dd5810 (42 files, same +/- lines per file). The only new files in the diff are the three generated ones.
• The generated files describe base f432685 plus this PR and nothing else. action-surfaces.json gains only updates.updateEverything. actions.md counts match the JSON: 1149 actions, palette 1100, guiOnly 205, noObject 267, settings 120. All 272 lines of settings-schema.sources.sha256 match sha256sum of their files at this head.
• New base commits up to 7259065 merge cleanly. Package.swift picks up the new AgentIntegrations target, and AppControl gains one DEBUG registration; neither touches the targets or symbols this PR uses. Base removed no declaration this PR uses, and base left the exemption lists alone.
• cmux_next_fast_gates.py run --base 7259065 on a local merge passes every gate. The crash ratchet is red on base, and this PR does not make it worse.
• Reds at this head: cmux-next checks fails on the ChiefWorkspaceName namespace violation (cmux-next: fix the two Chief title reds from #23391 #23636) and on Tier routing (Chief views test targets, cmux NEXT: Chief view gallery, five experimental views beside the Chief #22683/ci(cmux-next): a target the manifest declares passes graph coverage until the base autofix adds it #23364). Both come from base, and this PR touches neither. defaults guard holds the PR for an approving review, because it adds a new default, setting.updates.updateEverythingServers (false). That is the expected risk:high human gate, not a defect.

[teamleaderleo]

Handoff for orphan-sweep: lane projects-07 (huge-blue, session 01a15db7) is folding because of the huge-blue disk P0, so this PR is orphaned. Run pr-owner claim 20940 before you push.

• Branch: codex/cx-1mbnu-update-everything, base feat-cmux-next.
• Head: 15a20a792f034997e9caab107b24069513461f8f. This head is a merge of base 47ae435, which includes the fix for inspector/ContextSection.css being missing from build-agent-pane-web.sh. That miss made the autofix's Mac export job fail. Commit 78eaf08 added the agent policy updates.updateEverythingServers: .userOnly.
• Blockers:
  1. The generated settings exports are stale: docs/mdm/com.manaflow.cmux.json, plans/cmux-next/actions.md, schemas/defaults/cmux-next.json, schemas/settings-export/settings-schema.sources.sha256, schemas/settings/settings-schema.json. The "cmux-next PR autofix" workflow should regenerate and push them; if it hasn't, rerun it. Its Mac job was once refused for low disk on the mini. The stale exports are probably why the fast-gates and cmux-next-checks jobs are red. Verify that.
  2. These checks are red at 15a20a7 and I haven't triaged them: crash-class rules (unrecognized-selector super calls), CI guard group, fast gates, and cmux-next checks. An earlier triage found crash-class (CEFFileDragRelay) and the CI guard group (app-compile-fleet classification) not caused by this PR. release-notary and Guard status are also red on base.
  3. risk:high hold. It needs an independent, different-model Review (subagent, correctness first): SHIP at <full head> and a green cmux-ci compile-check --ref <full head> --app at that same head. Neither has run yet.
  4. Recheck the defaults guard against cmux#23761.
• Landing: gh pr merge 20940 --squash. Never use --admin; if the hook refuses, add ready-to-land. The PR is about 4.5k lines, so decide whether it needs splitting under the ~800-line rule.

[teamleaderleo]

Partially superseded by #20920, #21447, #21469, #21480, #20295, #25245, and #25386. The stale aggregate branch is not reusable: current base still lacks the cross-machine confirmation, app-last/relaunch journal, server opt-in, and chat-continuation result barrier. Closing this stale PR; those remaining contracts need a new owner and fresh cut.