cnx-ios: fix full-verify defects D1–D14 (Chief, teams, previews, Codex default, polish)

Packages/iOS/CmuxTabsKit/Sources/CmuxTabsKit/Logic/CloseAllConfirmation.swift

@@ -0,0 +1,11 @@
+/// What Close All Tabs asks before it closes every tab (as Safari's grid does).
+struct CloseAllConfirmation: Equatable {
+    /// The tabs shown when the person asked: exactly these close on confirm.
+    var ids: [String]
+
+    var count: Int { ids.count }
+    /// The destructive button.
+    var confirmTitle: String { count == 1 ? "Close 1 Tab" : "Close All \(count) Tabs" }
+    /// The line under the question.
+    var message: String { "This can’t be undone." }
+}

Packages/iOS/CmuxTabsKit/Sources/CmuxTabsKit/UI/TabsView.swift

@@ -51,6 +51,8 @@ struct TabsScreen<Source: TabsDataSource>: View {
     let keyboard: CGFloat
 
     @State private var chrome = ChromeState()
+    /// Close All Tabs is waiting for the person's answer.
+    @State private var confirmingCloseAll: CloseAllConfirmation?
     /// The page <-> grid transition (one interruptible progress value).
     @State private var zoomDriver = TabZoomDriver()
     /// Swipe-to-close offsets of the grid's cards.
@@ -154,14 +156,24 @@ struct TabsScreen<Source: TabsDataSource>: View {
                         onClose: { id in await closeFromGrid(id) },
                         onNewTab: newTabFromOverview,
                         onDone: { closeOverview(selecting: activeID) },
-                        onCloseAll: closeAll,
+                        onCloseAll: { confirmingCloseAll = CloseAllConfirmation(ids: tabs.map(\.id)) },
                         pending: newTabSlot?.showsPlaceholder(in: tabs.map(\.id)) == true ? pendingNewTab : nil,
                         onScrolling: { source.overviewScrollingChanged($0) },
                         onQueueSelect: { queuedOpen = $0 },
                         onPressChanged: { pressedCard = $0 })
                 .opacity(overviewVisible ? 1 : 0)
                 .allowsHitTesting(overviewVisible)
                 .accessibilityHidden(!zoomState.gridInteractive)
+                // Close All Tabs asks first, as Safari does: every tab closes with no way back.
+                .confirmationDialog(confirmingCloseAll?.confirmTitle ?? "", isPresented: Binding(
+                    get: { confirmingCloseAll != nil }, set: { if !$0 { confirmingCloseAll = nil } }
+                ), titleVisibility: .hidden, presenting: confirmingCloseAll) { confirmation in
+                    Button(confirmation.confirmTitle, role: .destructive) { closeAll(confirmation.ids) }
+                        .accessibilityIdentifier("tabs.closeAll.confirm")
+                    Button("Cancel", role: .cancel) {}
+                } message: { confirmation in
+                    Text(confirmation.message)
+                }
 
             if chrome.swiping {
                 swipeNeighbor
@@ -615,8 +627,7 @@ struct TabsScreen<Source: TabsDataSource>: View {
         zoomDriver.openNewTab(spring: newTabZoom.spring)
     }
 
-    private func closeAll() {
-        let ids = tabs.map(\.id)
+    private func closeAll(_ ids: [String]) {
         Task { for id in ids { _ = await source.close(id) } }
         if let option = source.newTabOptions.first { newTabFromOverview(option) }
     }

Packages/iOS/CmuxTabsKit/Tests/CmuxTabsKitTests/CloseAllConfirmationTests.swift

@@ -0,0 +1,17 @@
+@testable import CmuxTabsKit
+import Testing
+
+/// Close All Tabs asks first, as Safari does: one tap on the grid's More menu
+/// closed every tab of a workspace with no way back (cnx-ios live recheck, 2026-10-20).
+struct CloseAllConfirmationTests {
+    @Test func namesHowManyTabsClose() {
+        #expect(CloseAllConfirmation(ids: ["a", "b", "c", "d", "e"]).confirmTitle == "Close All 5 Tabs")
+        #expect(CloseAllConfirmation(ids: ["a"]).confirmTitle == "Close 1 Tab")
+        #expect(CloseAllConfirmation(ids: ["a", "b", "c", "d", "e"]).message == "This can’t be undone.")
+    }
+
+    /// The tabs asked about are the ones closed, even if the host lists another meanwhile.
+    @Test func closesTheTabsItAskedAbout() {
+        #expect(CloseAllConfirmation(ids: ["a", "b"]).ids == ["a", "b"])
+    }
+}

Packages/macOS/CmuxNext/Sources/CmuxNextApp/Cloud/AppServices+Cloud.swift

@@ -1,6 +1,7 @@
 import CmuxNextActions
 import CmuxNextCompat
 import CmuxNextDaemon
+import CmuxNextHomeEngine
 import CmuxNextMobileHost
 import Observation
 
@@ -42,6 +43,11 @@ extension AppServices {
                     newChatPicks: { [weak self] in
                         NewChatPicks(lastAgent: self?.newTabChoices.agent, picks: self?.newTabChoices.picks)
                     },
+                    // hostd serves phones this build's own Chief (a DEV or tagged build's is not the default home).
+                    chief: { [weak self] in
+                        guard let owner = self?.home.chief else { return nil }
+                        return IPhoneHostService.ChiefPlacement(session: owner.home.session, socket: await owner.socketPath())
+                    },
                     settings: { [weak self] in self?.settings },
                     bundleID: environment.launch.bundleID, computerName: { await MacName.computerName() })
         iphone.pairWindow = { [weak self] in self?.windows.active?.window }

Packages/macOS/CmuxNext/Sources/CmuxNextMobile/CnxHost/CnxHostLaunch.swift

@@ -29,11 +29,17 @@ public struct CnxHostLaunch: Sendable, Equatable {
     /// acpmux and shows here as this Mac's own. Nil: phones cannot create agent tabs.
     public var agentTabHost: String?
     /// The Chief's conversation owner session (`ChiefHome.session`), served
-    /// to phones by hostd's scoped `chief` service; nil lets hostd derive it
-    /// from `~/.cmux/chief/default`, the home of every build that is not an
-    /// isolated launch. The app's wiring sets it with
-    /// `ChiefHome.resolve(tag:).session` (cnx-ios/verify/relay-security.md).
+    /// to phones by hostd's scoped `chief` service. The app always sets it from
+    /// its own Chief home (`IPhoneHostService.Dependencies.chief`): a DEV or
+    /// tagged build's Chief lives at `~/.cmux/chief/<bundle id>`, not the
+    /// `~/.cmux/chief/default` hostd derives when it is nil (only a hostd
+    /// started by hand relies on that).
     public var chiefSession: String?
+    /// The Chief owner's socket once the app is connected to it
+    /// (`ChiefConversationOwner.socketPath()`): hostd dials it as is
+    /// (`CNX_CHIEF_SOCKET`), so a socket outside the app daemon's folder
+    /// (cmux-tui's short-path fallback) is still found.
+    public var chiefSocket: String?
     /// This build streams the phone's browser tabs (a bundled remote browser host):
     /// hostd serves `browser` and says `browser-stream-v1` (`CNX_BROWSER_HOSTS=1`).
     /// Off, phones hide New Browser Tab for this Mac.
@@ -87,7 +93,8 @@ public struct CnxHostLaunch: Sendable, Equatable {
             "NO_COLOR": "1",
         ]) { $1 }
         if let agentTabHost, !agentTabHost.isEmpty { environment["CNX_AGENT_TAB_HOST"] = agentTabHost }
-        if let chiefSession { environment["CNX_CHIEF_SESSION"] = chiefSession }
+        if let chiefSession, !chiefSession.isEmpty { environment["CNX_CHIEF_SESSION"] = chiefSession }
+        if let chiefSocket, !chiefSocket.isEmpty { environment["CNX_CHIEF_SOCKET"] = chiefSocket }
         if browserHosts { environment["CNX_BROWSER_HOSTS"] = "1" }
         return environment
     }

Packages/macOS/CmuxNext/Sources/CmuxNextMobileHost/IPhoneHostService+Wiring.swift

@@ -30,12 +30,13 @@ extension IPhoneHostService {
     ///   - computerName: How phones list this Mac.
     ///   - processEnvironment: Read for the Debug-only overrides.
     ///   - acpmuxEnvironment: The app's acpmux, for the phones' approval keys (nil: none).
-    ///   - agentTabHost: This Mac's agent tab host (`install:<id>`), for agent tabs a phone creates.
+    ///   - chief: This app's Chief owner (session, and socket once connected), which hostd serves to phones.
     public func wire(auth: CloudAuth, daemon: DaemonService,
                      acpmuxHost: @escaping @MainActor @Sendable () -> (any AgentPaneHostProviding)?,
                      acpmuxEnvironment: AcpmuxEnvironment? = nil,
                      agentTabHost: @escaping @MainActor () -> String? = { nil },
                      newChatPicks: @escaping @MainActor @Sendable () -> NewChatPicks = { NewChatPicks() },
+                     chief: @escaping @MainActor () async -> ChiefPlacement? = { nil },
                      settings: @escaping @MainActor @Sendable () -> SettingsController?,
                      bundleID: String?, computerName: @escaping @Sendable () async -> String,
                      processEnvironment: [String: String] = ProcessInfo.processInfo.environment) {
@@ -106,7 +107,8 @@ extension IPhoneHostService {
             computerName: computerName,
             acpmuxEnvironment: acpmuxEnvironment,
             browserHosts: browserHosts,
-            pairingSeed: IPhonePairingSeed.fromEnvironment(processEnvironment)
+            pairingSeed: IPhonePairingSeed.fromEnvironment(processEnvironment),
+            chief: chief
         )
     }
 

Packages/macOS/CmuxNext/Sources/CmuxNextMobileHost/IPhoneHostService.swift

@@ -64,6 +64,37 @@ public final class IPhoneHostService {
         var browserHosts: (any CnxBrowserHosting)? = nil
         /// Test-only (DEBUG): phones this tagged test instance trusts without the prompt.
         var pairingSeed: IPhonePairingSeed? = nil
+        /// This app's own Chief owner: its session (from the app's `ChiefHome`, always known)
+        /// and its socket once connected. hostd's `chief` service dials it; without it hostd
+        /// guesses `~/.cmux/chief/default`, which is not a DEV or tagged build's Chief.
+        var chief: @MainActor () async -> ChiefPlacement? = { nil }
+    }
+
+    /// Where this app's Chief owner listens (``Dependencies/chief``).
+    public struct ChiefPlacement: Equatable, Sendable {
+        /// `ChiefHome.session` of the app's Chief home.
+        public var session: String
+        /// The owner's socket, once the app is connected to it.
+        public var socket: String?
+
+        public init(session: String, socket: String?) {
+            self.session = session
+            self.socket = socket
+        }
+    }
+
+    /// hostd's launch for `account`: the app's daemon, chat roots, agent tab host and its own Chief.
+    static func launch(_ dependencies: Dependencies, executable: URL, account: Account, deviceID: String,
+                       deviceName: String, daemonSocket: String, chief: ChiefPlacement?) -> CnxHostLaunch {
+        var launch = CnxHostLaunch(
+            executable: executable, baseURL: dependencies.baseURL, teamID: account.teamID, userID: account.userID,
+            deviceID: deviceID, deviceName: deviceName, daemonSocket: daemonSocket,
+            stateDirectory: dependencies.stateDirectory, fileRoots: dependencies.fileRoots(),
+            stackProjectID: dependencies.stackProjectID, agentTabHost: dependencies.agentTabHost())
+        launch.browserHosts = dependencies.browserHosts != nil
+        launch.chiefSession = chief?.session
+        launch.chiefSocket = chief?.socket
+        return launch
     }
 
     /// `mobile.allowIPhoneConnections`, as the settings file has it.
@@ -351,13 +382,10 @@ public final class IPhoneHostService {
                 // task-owner: one Keychain read per hostd start; awaited here
                 let identity = try await Task.detached { try store.loadOrCreate() }.value
                 let name = await dependencies.computerName()
+                let chief = await dependencies.chief()
                 guard !Task.isCancelled, self?.running == key else { return }
-                var launch = CnxHostLaunch(
-                    executable: executable, baseURL: dependencies.baseURL, teamID: want.teamID, userID: want.userID,
-                    deviceID: deviceID, deviceName: name, daemonSocket: socket,
-                    stateDirectory: dependencies.stateDirectory, fileRoots: dependencies.fileRoots(),
-                    stackProjectID: dependencies.stackProjectID, agentTabHost: dependencies.agentTabHost())
-                launch.browserHosts = dependencies.browserHosts != nil
+                let launch = Self.launch(dependencies, executable: executable, account: want, deviceID: deviceID,
+                                         deviceName: name, daemonSocket: socket, chief: chief)
                 await supervisor.start(.init(
                     launch: launch, accessToken: dependencies.accessToken, acpmux: dependencies.acpmux,
                     log: dependencies.stateDirectory.appendingPathComponent("cnx-hostd.log", isDirectory: false),

Packages/macOS/CmuxNext/Tests/CmuxNextMobileHostTests/IPhoneHostChiefTests.swift

@@ -0,0 +1,44 @@
+import Foundation
+@testable import CmuxNextMobileHost
+import Testing
+
+/// hostd serves phones the app's own Chief (cnx-ios full verify D2): a DEV or tagged build keeps its
+/// Chief at `~/.cmux/chief/<bundle id>`, so the launch must name that owner instead of letting hostd
+/// guess `~/.cmux/chief/default`.
+@MainActor
+struct IPhoneHostChiefTests {
+    static func dependencies(chief: IPhoneHostService.ChiefPlacement?) -> IPhoneHostService.Dependencies {
+        IPhoneHostService.Dependencies(
+            executable: URL(fileURLWithPath: "/bin/cnx-hostd"), baseURL: URL(fileURLWithPath: "/dev/null"),
+            stackProjectID: "p", stateDirectory: URL(fileURLWithPath: "/tmp/cnx-state"),
+            accessToken: { _ in "t" }, daemonSocket: { "/tmp/cmux-tui-501/cmux-app-tag.sock" }, acpmux: { nil },
+            fileRoots: { ["/a"] }, computerName: { "Mac" }, chief: { chief })
+    }
+
+    static let account = IPhoneHostService.Account(userID: "u", teamID: "personal-u", teamName: nil, email: nil)
+
+    @Test func theLaunchNamesTheAppsOwnChief() async throws {
+        let placement = IPhoneHostService.ChiefPlacement(session: "cmux-chief-1a2b3c4d",
+                                                         socket: "/tmp/cmux-tui-501/cmux-chief-1a2b3c4d.sock")
+        let dependencies = Self.dependencies(chief: placement)
+        let launch = IPhoneHostService.launch(dependencies, executable: URL(fileURLWithPath: "/bin/cnx-hostd"),
+                                              account: Self.account, deviceID: "d", deviceName: "Mac",
+                                              daemonSocket: "/tmp/cmux-tui-501/cmux-app-tag.sock",
+                                              chief: await dependencies.chief())
+        let environment = launch.environment(inherited: [:])
+        #expect(environment["CNX_CHIEF_SESSION"] == "cmux-chief-1a2b3c4d")
+        #expect(environment["CNX_CHIEF_SOCKET"] == "/tmp/cmux-tui-501/cmux-chief-1a2b3c4d.sock")
+        #expect(environment["CNX_TEAM_ID"] == "personal-u")
+    }
+
+    @Test func aChiefNotConnectedYetStillNamesItsSession() async throws {
+        let dependencies = Self.dependencies(chief: .init(session: "cmux-chief-1a2b3c4d", socket: nil))
+        let launch = IPhoneHostService.launch(dependencies, executable: URL(fileURLWithPath: "/bin/cnx-hostd"),
+                                              account: Self.account, deviceID: "d", deviceName: "Mac",
+                                              daemonSocket: "/tmp/cmux-tui-501/cmux-app-tag.sock",
+                                              chief: await dependencies.chief())
+        let environment = launch.environment(inherited: [:])
+        #expect(environment["CNX_CHIEF_SESSION"] == "cmux-chief-1a2b3c4d")
+        #expect(environment["CNX_CHIEF_SOCKET"] == nil)
+    }
+}

cmux-tui/crates/acpmux/src/hub/lifecycle.rs

@@ -61,6 +61,9 @@ impl Hub {
         } else {
             (None, None)
         };
+        // A catalog default (not a saved pick) is skipped when the harness doesn't offer it.
+        let model_from_catalog = !model_pinned
+            && start_model.as_ref().is_some_and(|s| s.source == super::start_defaults::StartSource::Catalog);
         let (model, model_soft) = match (model_pinned, start_model) {
             (true, _) | (false, None) => (pinned_model, false),
             (false, Some(start)) => (Some(start.value), true),
@@ -214,7 +217,12 @@ impl Hub {
                     let catalog = self.catalog_ids(agent).await;
                     let full = format!("{head}/{m}");
                     let m = if !catalog.is_empty() && !catalog.iter().any(|id| id == m) && catalog.contains(&full) { full } else { m.clone() };
-                    if let Err(e) = self.set_model(&session, &m).await {
+                    // A start value this session's harness does not list (its account
+                    // lacks it): the harness accepts set_model, then fails every prompt.
+                    if model_from_catalog && !self.harness_offers(agent, &profile, &m) {
+                        tracing::warn!(harness = agent, model = %m, "start model skipped: not offered by the harness");
+                        self.append(&session, "mux", "start_default_skipped", json!({"modelId": m, "error": "the harness does not offer this model"}));
+                    } else if let Err(e) = self.set_model(&session, &m).await {
                         // A start value the harness refuses (start_defaults.rs): the
                         // chat runs the harness's own default instead.
                         if model_soft {

cmux-tui/crates/acpmux/src/hub/start_defaults.rs

@@ -223,6 +223,10 @@ impl Hub {
         model: Option<&str>,
     ) -> (Option<StartValue>, Option<StartValue>) {
         let curated = super::models_view::curated_for(&self.catalog, agent, profile);
+        // The catalog default only when the harness offers it: an account that
+        // lacks it (Codex refusing GPT-6.1 Sol at the first prompt) starts on the
+        // harness's own default, its config's model, instead (cnx-ios full verify D4).
+        let reported = self.reported_model_ids(agent);
         let start_model = match model {
             Some(_) => None,
             None => saved
@@ -233,6 +237,10 @@ impl Hub {
                     curated
                         .as_ref()
                         .and_then(|c| c.default_model.clone())
+                        .filter(|m| {
+                            let ids: Vec<String> = c_ids(curated.as_ref());
+                            offers(&reported, &ids, m)
+                        })
                         .map(|value| StartValue { value, source: StartSource::Catalog })
                 }),
         };
@@ -257,6 +265,23 @@ impl Hub {
         (start_model, start_effort)
     }
 
+    /// The model ids `agent` itself reported (its last session or probe);
+    /// empty when it reported none (Claude Code, a harness not probed yet).
+    pub(super) fn reported_model_ids(&self, agent: &str) -> Vec<String> {
+        self.known_models
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(agent)
+            .map(|list| list.iter().map(|(id, _)| id.clone()).collect())
+            .unwrap_or_default()
+    }
+
+    /// Whether the catalog start model `model` is one `agent`'s harness offers ([`offers`]).
+    pub(super) fn harness_offers(&self, agent: &str, profile: &HarnessProfile, model: &str) -> bool {
+        let curated = super::models_view::curated_for(&self.catalog, agent, profile);
+        offers(&self.reported_model_ids(agent), &c_ids(curated.as_ref()), model)
+    }
+
     /// `start` for one `_acpmux/harnesses` row: `{model?, effort?,
     /// modelSource?, effortSource?}`, what a new chat there starts on.
     pub(super) fn start_view(
@@ -294,3 +319,29 @@ impl Hub {
         Some(v)
     }
 }
+
+/// The curated model ids of a catalog entry.
+fn c_ids(curated: Option<&CatalogHarness>) -> Vec<String> {
+    curated.map(|c| c.models.iter().map(|m| m.id.clone()).collect()).unwrap_or_default()
+}
+
+/// Whether reported id `id` names `model`: the same id, or a DSH route
+/// (`["provider","model"]`) for `model` or `provider/model`, as
+/// `model_catalog::resolve` accepts them.
+fn names(id: &str, model: &str) -> bool {
+    id == model
+        || serde_json::from_str::<Vec<String>>(id)
+            .is_ok_and(|p| p.len() == 2 && (p[1] == model || format!("{}/{}", p[0], p[1]) == model))
+}
+
+/// Whether a harness that reported `reported` offers the catalog's `model`.
+/// Any model when it reported none, or when its ids are not the catalog's
+/// (Claude Code's aliases `default`/`opus`/`sonnet`): then the harness decides,
+/// as before. Otherwise only a model it lists, so an account that lacks the
+/// catalog default (Codex without GPT-6.1 Sol) starts on its own default.
+pub(super) fn offers(reported: &[String], curated: &[String], model: &str) -> bool {
+    if reported.is_empty() || !reported.iter().any(|r| curated.iter().any(|c| names(r, c))) {
+        return true;
+    }
+    reported.iter().any(|r| names(r, model))
+}