cx-dgsp: retire the legacy bearer wire subprotocol by teamleaderleo · Pull Request #21671 · manaflow-ai/cmux

teamleaderleo · 2026-10-18T14:23:05Z

Summary

The cmux Cloud API's wire socket still accepted a token in the bearer.<token> subprotocol. Workers invocation logs record that header (cx-dgsp). Every client also fell back to it: the Swift feed and cmux-tui on any 401 without x-cmux-wire-auth, and the TS client and dashboard on a 404 from the ticket route. So a response from something other than the API could make a current client send its token in a logged header.

This retires the path:

API (backend/apps/api/src/wire-ticket.ts): no longer reads bearer.. It still strips it from the subprotocols forwarded to the owner object, and the 401 still names x-cmux-wire-auth.
cmux NEXT feed (CloudFeedSource.swift) and cmux-tui (cloud_conversations_backend.rs): send the token only in Authorization. A 401 is final.
TS cloud client and dashboard: use a single-use ticket or fail. They never send the token.
wrangler.jsonc: invocation logs stay off in staging and production, because clients built before this change still send bearer.<token>. The comment says to turn them on once those clients have aged out.

The API tests that opened sockets with bearer. now use the Authorization header.

Compatibility: a client built before cx-dgsp's header auth (2026-10-11) can no longer open a wire socket until it updates. That covers cmux NEXT, cmux-tui daemons and any dashboard tab served before that date.

Testing

Red first (32b6f49):

backend/apps/api: vitest run test/wire-ticket.test.ts gives 1 failed, 8 passed.
clients/ts/cloud: bun test test gives 1 fail, 4 pass.
cmux-tui on hosted Linux (run 39133002845): a_401_without_header_auth_is_final_and_sends_no_token_subprotocol fails.

Green (6565913):

wire-ticket.test.ts: 9 passed.
clients/ts/cloud: 5 pass.
The full backend/apps/api suite on Linux: 17 tests failed in one parallel run. 4 were socket tests in files my first rewrite missed; fixed in 90484ab. Every failing file passes when rerun alone.
cmux-tui (run 39134805604): the test and clippy pass on hosted Linux; the macOS job was still queued when this opened.
The Swift change has no unit test (the feed's socket loop has none). It's covered by CI compile only.

Bead: cx-dgsp.

Changelog

none

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Retires the legacy bearer.<token> wire subprotocol. The API no longer authenticates wire sockets with it, and all clients stop falling back to it when the Authorization header path fails — a fallback that any 401 from any server could trigger, sending the token in a header Workers invocation logs record. The API still strips bearer. subprotocols before forwarding to the owner object, and the 401 still names x-cmux-wire-auth.

Compatibility: clients built before header auth shipped (2026-10-11) can't open a wire socket until they update, and invocation logs stay off in staging and production until those clients age out.

^{Written for commit 6565913. Summary will update on new commits.}

The wire's `bearer.<token>` subprotocol put the token in a header that Workers invocation logs record. New expectations: - the API refuses a `bearer.` upgrade with 401 and x-cmux-wire-auth (backend/apps/api/test/wire-ticket.test.ts: 1 failed, 8 passed); - the TS client never sends `bearer.` when the ticket route answers 404 (clients/ts/cloud: 1 fail, 4 pass); - cmux-tui never retries a 401 with the token in a subprotocol (a_401_without_header_auth_is_final_and_sends_no_token_subprotocol). The other API tests now open sockets with the Authorization header. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Three test files sent `bearer.<token>, team.<id>`; they now send the token in the Authorization header like the rest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The API no longer reads `bearer.<token>` from Sec-WebSocket-Protocol; it still strips it from the subprotocols forwarded to the owner object. Clients stop falling back to it: - cmux NEXT feed (CloudFeedSource) and cmux-tui send the token only in Authorization and treat any 401 as final; - the TS cloud client and the dashboard use a ticket or nothing. Each fallback fired on any 401 without x-cmux-wire-auth (or a 404 from the ticket route), so a response from something other than the API could pull the token into a logged header. Invocation logs stay off in staging and production until clients built before this change age out. Green: wire-ticket.test.ts 9 passed; clients/ts/cloud 5 pass; the socket test files rerun alone pass. cmux-tui's test runs hosted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-18T14:23:15Z

Receipt for 6565913 (this PR's head; a new push replaces it)

Visual review: HQ feed card · gallery before/after runs
Checks: this head
App of this head (app.zip, kept 1 day): gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr21671 -f ref=security/retire-legacy-wire-bearer -f platform=macos -f backend_mode=local

coderabbitai · 2026-10-18T14:23:16Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 601a74a3-fe5d-433e-ab8f-994be29e29b7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-18T14:24:37Z

Not verified: macOS jobs did not run: compile and app tests were skipped on 6565913900; ci-status is green without them.

CI passes on 6565913900 (run 39135745789 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

github-actions · 2026-10-18T15:09:38Z

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/39138985914 at 09711a4 failed: cmux-next Release compile (Xcode 26).
Those jobs last passed at 0e781a6. This pull request is one of 1 merged since: #21671.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

github-actions · 2026-10-18T15:15:29Z

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/39139053832 at 4b68fdc failed: cmux-next Release compile (Xcode 26).
Those jobs last passed at 0e781a6. This pull request is one of 2 merged since: #21671, #21657.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

github-actions · 2026-10-18T15:37:28Z

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/39139500989 at 6e7ec42 failed: cmux-next Release compile (Xcode 26).
Those jobs last passed at 0e781a6. This pull request is one of 3 merged since: #21671, #21657, #21707.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

github-actions · 2026-10-18T15:44:18Z

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/39141168383 at e30d059 failed: cmux-next Release compile (Xcode 26).
Those jobs last passed at 0e781a6. This pull request is one of 4 merged since: #21671, #21657, #21707, #21679.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

teamleaderleo and others added 3 commits October 18, 2026 13:46

test(cx-dgsp): team-scoped sockets in tests use the Authorization header

90484ab

Three test files sent `bearer.<token>, team.<id>`; they now send the token in the Authorization header like the rest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

teamleaderleo temporarily deployed to cmux-tui-merge-tree October 18, 2026 14:23 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to cmux-next-development October 18, 2026 14:28 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to artifacts October 18, 2026 14:30 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to artifacts October 18, 2026 14:33 — with GitHub Actions Inactive

teamleaderleo merged commit 09711a4 into feat-cmux-next Oct 18, 2026
261 of 281 checks passed

teamleaderleo deleted the security/retire-legacy-wire-bearer branch October 18, 2026 15:06

teamleaderleo mentioned this pull request Oct 18, 2026

cx-dgsp follow-ups: scope-bound wire tickets, hold a refused feed token #21725

Merged

github-actions Bot mentioned this pull request Oct 18, 2026

webviews: Static status indicators and Reduce Motion stop every web loop (cx-sya4n) #21657

Merged

github-actions Bot mentioned this pull request Oct 18, 2026

test(acpmux): run three test binaries hermetically before the base-red skip expires (cx-5j26a) #21707

Merged

github-actions Bot mentioned this pull request Oct 18, 2026

cmux NEXT: no focus ring on the daemon recovery status label #21679

Merged

Navigation Menu

Repository navigation

cx-dgsp: retire the legacy bearer wire subprotocol - #21671

cx-dgsp: retire the legacy bearer wire subprotocol#21671
teamleaderleo merged 3 commits into
feat-cmux-nextfrom
security/retire-legacy-wire-bearer

teamleaderleo commented Oct 18, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

coderabbitai Bot commented Oct 18, 2026

Review skipped

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

teamleaderleo commented Oct 18, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Changelog

Summary by cubic

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

coderabbitai Bot commented Oct 18, 2026

Review skipped

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

teamleaderleo commented Oct 18, 2026 •

edited by cubic-dev-ai Bot

Loading