[teamleaderleo]

Summary

The risk-tier classifier now grades high the files that decide what an agent pane's web page may make the host do or read. Before this, they all graded normal.

#22646 added the page op chat.asks.pending to AgentPageOps. Its handler, AgentPanePendingAsks.swift, opens its own connection to the local acpmux daemon and reads another chat's permission asks. Until review caught it, the read reached a peer daemon. The fix named the chat local/<id> and refused replies that name a peer. The whole change graded normal by path, so the next such op would have been caught only by a reviewer's judgment, not by the path tiers.

New rule in scripts/ci/risk_tier.py, "agent pane host op or allowlist", placed right after the socket and relay rule:

• CmuxNextAgentPane/AgentPageProvider.swift: the AgentPageOps list and its call dispatch. Every new op edits this list.
• CmuxNextAgentPane/AcpmuxPaneMethods*.swift: the _acpmux/* methods a pane may relay and their knownParams.
• CmuxNextAgentPane/AgentPaneEnvironmentRequest.swift, AgentPaneReplyRequest.swift: the page-op param tables.
• CmuxNextAgentPane/AgentPaneTransport+Check.swift: the frame check.
• CmuxNextAgentPane/AcpmuxPathPolicy.swift: the folder policy.
• CmuxNextAgentPane/AgentPanePendingAsks.swift: a host op that opens its own daemon connection for a page.
• CmuxNextAgentPane/AgentPaneTransport+Frames.swift: decide(), the gesture rule that spends a click's ticket (and grants folder roots).
• CmuxNextAgentPane/AgentPaneGestureIntent.swift: which methods a click's ticket may redeem.
• CmuxNextAgentPane/AgentPaneUserGestures.swift: the click tickets themselves (reserve, consume, redeem).
• CmuxNextAgentPane/AgentPaneModel+Actions.swift: connectActions, the app actions a page may run through action.run.
• CmuxNextAgentPane/AgentPaneTransport+RelayedAllow.swift: the decision proof a relayed allow carries, signed with the person key.
• CmuxNextAgentPane/AgentPaneTransport+PickedFolder.swift: a folder the person picks becomes a root the page's requests pass.
• CmuxNextAgentPane/AgentPaneTransport+FullAccess.swift: the refusal of a switch into a mode that skips approvals.
• cmux-tui/crates/cmux-agent-pane-policy/*: the Rust mirror (policy.json, src and Cargo.toml).
• cmux-tui/crates/acpmux/src/server/remote_guard*: what acpmux allows from a non-local connection.

The rest of CmuxNextAgentPane stays normal (for example AgentPaneView.swift, AgentPageProvider+Scroll.swift, AgentPaneTransportPacer.swift). The policy tests stay low, because the test rule comes first. docs/ci/risk-tiers.md gets a new row under the socket and relay access policy kind, with #22646 as its evidence. There are still six kinds.

This touches risk_tier.py, so this PR is risk:high and needs a person's approval.

Review follow-up (c0695a2)

The independent review of c0b5b4e passed and named three gatekeepers outside the rule; they are added above, with test cases. Checked with risk_tier.py's classify_path on this head: all three grade high, and AgentPaneView.swift, AgentPaneModel+Composer.swift and AgentPaneTransportPacer.swift stay normal. git merge-tree with #23371 at 0b7d7fe still merges cleanly. Lines touched at f08aa0f: risk_tier.py new 95-111, tests/test_risk_tier.py new 201-238, docs/ci/risk-tiers.md line 30 (all new lines). A second review (of c0695a2) passed and named AgentPaneUserGestures.swift, added in f08aa0f. The test file was not run on this Mac (a hook refuses it); CI's risk tier tests job runs it.

Base merge and review follow-up (05ee5b8)

Merged feat-cmux-next afaf26d (13fdb5f; base hadn't touched risk_tier.py). The independent review of 13fdb5f passed (SHIP) and named three transport files that also decide what a page may make the host do: +RelayedAllow, +PickedFolder, +FullAccess. Added in 945913d (test) and 05ee5b8 (rule and docs row). python3 -I tests/test_risk_tier.py ran on this Mac this time: red at 945913d ('normal' != 'high' for exactly those three paths), green at 05ee5b8 (31 tests OK).

Changelog

none

Testing

New tests: test_agent_pane_host_ops_and_allowlists_are_high and test_ordinary_agent_pane_ui_and_policy_tests_stay_below_high in tests/test_risk_tier.py. The risk tier tests workflow runs them on this PR (python3 tests/test_risk_tier.py -v).

Observed / Not run

Observed:

• A hook on this Mac refuses python3 tests/test_risk_tier.py (heavy work on an interactive Mac). So I got red and green from the same classify function the tests call, one path at a time: risk_tier.py classify --files <one path> --json.
  • On base (red): every new path returned normal (AgentPageProvider.swift, AcpmuxPaneMethods.swift, AcpmuxPaneMethods+Params.swift, AgentPaneEnvironmentRequest.swift, AgentPaneReplyRequest.swift, AgentPaneTransport+Check.swift, AcpmuxPathPolicy.swift, AgentPanePendingAsks.swift, policy.json, params.rs, remote_guard.rs).
  • On head (green): each of those returned high. AgentPaneView.swift, AgentPageProvider+Scroll.swift and AgentPaneTransportPacer.swift returned normal. cmux-agent-pane-policy/tests/swift.rs and acpmux/tests/remote_guard.rs returned low.
• python3 scripts/cmux-next/prepush-gate.py: no new violations.
• python3 scripts/verify-local.py: 10 of 11 checks passed. localization failed on parity in catalogs this PR doesn't touch (base debt).
• git merge-tree --write-tree against ci(risk): an update channel setting is normal; the update path stays high #23371's head (0b7d7fe) merges cleanly. The two PRs change different lines of the same three files.

Not run before 05ee5b8: the full tests/test_risk_tier.py suite locally (the hook refused it then). At 05ee5b8 it ran locally: 31 tests OK (see the follow-up section above).

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

The risk-tier classifier now grades high the files that decide what an agent pane's web page may make the host do or read, so a security slip like #22646's chat.asks.pending (which reached a peer daemon until review caught it) gets caught by path instead of by reviewer judgment.

• Adds a high-risk rule in scripts/ci/risk_tier.py covering the page ops list, the relayable _acpmux methods and params, the page-op param tables, the frame check, the gesture rule (the click-minted tickets and decide spending one), the app actions a page may run, the folder policy and the picked-folder roots, the relayed-allow proof, the full-access refusal, the Rust mirror, and acpmux's remote guard.
• Ordinary pane UI files stay normal and the policy tests stay low.
• Adds matching tests and a docs row; this PR touches risk_tier.py itself, so it grades high and needs a person's approval.

^{Written for commit 05ee5b8. Summary will update on new commits.}

[teamleaderleo]

Owned by priority-view on cosmic-gray · session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 05ee5b8: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr23476 -f ref=leo/risk-tier-pane-host-ops -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on afaf26d to compare; do not merge until green; see lane-rules

[teamleaderleo]

Bead cx-opdfj created for this PR by the cmux coordinator.

[teamleaderleo]

cmux-next guards / defaults-snapshot is red on 18 of 20 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[blacksmith-sh]

Found 9 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpbhncbubp/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpelj651xf/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
convention violations found (ERROR lines above)./ convention violations found (ERROR lines above).	View Logs
test_a_file_a_test_reads_selects_that_test (main.PullRequestTiers.test_a_file_a_tes t_reads_selects_that_test)/ test_a_file_a_test_reads_selects_that_test (main.PullRequestTiers.test_a_file_a_tes t_reads_selects_that_test)	View Logs
test_a_shared_module_selects_its_dependents (main.PullRequestTiers.test_a_shared_mo dule_selects_its_dependents)/ test_a_shared_module_selects_its_dependents (main.PullRequestTiers.test_a_shared_mo dule_selects_its_dependents)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (independent subagent, scripts/ci/risk_tier.py rule, tests and docs row): SHIP at 05ee5b8

• Ready for risk:human-ok at this head. I'll push nothing more unless asked.
• Base merge: feat-cmux-next afaf26d (13fdb5f). Review follow-up: 945913d (failing test) and 05ee5b8 (rule): AgentPaneTransport+RelayedAllow, +PickedFolder, +FullAccess grade high. Locally, python3 -I tests/test_risk_tier.py failed at 945913d for exactly those three paths and passed at 05ee5b8 (31 tests).
• CI at 05ee5b8: risk tier tests passed. Fleet compile-check --app passed (job feecb5f6c6bc00b08932be40).
• The only red is base: cmux-next checks / Tier routing (test_cmux_next_route expects no CmuxNextChiefViewsTests, from cmux NEXT: Chief view gallery, five experimental views beside the Chief #22683). The convention ERROR in ChiefWorkspaceName.swift is in a base file this PR doesn't touch.
• Landing order: after ci-speed's ci: run the feat-cmux-next risk tier gate from main, enforced now #22974 and ci(risk): an update channel setting is normal; the update path stays high #23371 (both still open).

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.3973389583201 (48a69e9f66)