[teamleaderleo]

What broke

In the Mac app, answering a question (an AskUserQuestion-style prompt that has answers) for a chat whose agent runs on another machine (huge-blue) always failed with "approve this on the Mac app: … accepted only from the cmux app". Plain allows to the same chats worked.

Part of the cause is the transport. RemoteAcpmuxWire dropped the answers and sent a bare allow. cmux-tui's agent-session-permission also refused an answers field (deny_unknown_fields). So that machine's acpmux never received the answer at all, whatever proof the pane made.

The fix

This PR only fixes the transport. The decision proof that covers the answers, the pane signing them, and the page's ticket for a question are #23869 (a separate lane's PR). This PR does not touch hub/person.rs or the person-proof protocol. Both PRs are needed for the answer to count on huge-blue.

• RemoteAcpmuxWire forwards answers (an object; anything else is refused at the wire).
• AgentSessionRemoteClient / AgentTabRemoteClient / AgentSessionAttachClient carry answers. The attach client re-encodes them compact and puts them in the request.
• cmux-tui agent-session-permission takes answers (an object of at most 64 KiB) and passes it to acpmux unchanged beside the proof; acpmux still decides. New capability agent-session-permission-answers-v1, advertised with agent-session-attach-v1. If the remote daemon is older and lacks it, the app refuses the answer (agent_session.answers_unsupported) instead of sending a bare allow.
• Spec (cmux-tui/spec/commands.md) and plans/cmux-next/daemon-capabilities.json updated.
• Plain allows are byte-for-byte unchanged on every hop.

Tests

• Rust a_question_answer_carries_its_answers_to_acpmux_unchanged (cmux-tui-core agent_session_attach_tests.rs): the capability is advertised, non-object answers are a bad request, and an object goes to acpmux with the proof. Red on the test commit c242d6c, green at head (fleet results below).
• Swift RemoteAcpmuxWireAnswersTests: the wire refuses non-object answers and forwards an object with the nonce and proof.

Fleet evidence:

• Rust GREEN at 1772179 (cmux-tui-rust-check.sh test agent_session, step 1b84acceba92214740cde9ba): 94 passed, including a_question_answer_carries_its_answers_to_acpmux_unchanged. RED run on the test commit c242d6c: pending, reported in a comment.
• Swift GREEN at 1772179 (package-test-lane.sh suite RemoteAcpmuxWireAnswersTests, RemoteAcpmuxObserverTests, AgentPaneRelayedAllowTests, RemoteChildSessionsTests; step 712fcf758ed41d8b4d4c9ed4): all 4 suites passed. Re-run at the head 7b4c4e1 with DaemonCapabilityExportTests added (step ab63efb8018dee32f007b634): all 5 suites passed.
• cmux-ci compile-check --app fails the same way at the base 783c206 (job 0ba18ab3) and at this head: product 'CmuxSentryReporting' required by ... 'CmuxNextCrashReporting' not found in package 'CmuxSentryTelemetry'. That is a base red, not caused by this PR.

No capture: no UI changes. This only changes how a question's answers travel from the pane to another machine's daemon.

Observed / Not run

Observed: the fleet runs above. Not run: a live answer to a huge-blue chat (it needs #23869 too).

Changelog

Fixed: answering an agent's question in a chat on another machine no longer fails with "approve this on the Mac app" (with #23869).

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes answering a question for a chat on another machine, which always failed with "approve this on the Mac app" because answers never reached that machine's acpmux: the wire dropped them and sent a bare allow, and cmux-tui's agent-session-permission refused the field.

• answers (a JSON object, max 64 KiB) now flows through the wire, the attach client, and agent-session-permission to acpmux unchanged; non-object answers are refused at the wire.
• The new agent-session-permission-answers-v1 capability gates the field and is advertised with agent-session-attach-v1; against an older daemon the app refuses the answer (agent_session.answers_unsupported) instead of sending a bare allow.
• Plain allows are byte-for-byte unchanged on every hop.
• This PR only fixes the transport; the decision proof covering the answers is a separate PR (acpmux, agent pane: a question answered in the pane counts on another machine #23869), and both are needed for the answer to count.

^{Written for commit 379a990. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 379a990: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr23999 -f ref=leo/person-proof-covers-answers -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on a62351d to compare; do not merge until green; see lane-rules

[blacksmith-sh]

Found 8 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp15hb9gxc/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpdc__tdei/summary-missing.json (live):/summary-missing.json (live):	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_base_passes (main.NoticesPairTests.test_base_passes)/ test_base_passes (main.NoticesPairTests.test_base_passes)	View Logs
test_targets_outside_the_app_go_to_the_mac_canary (main.SwiftCanaryFleetCoverage.te st_targets_outside_the_app_go_to_the_mac_canary)/ test_targets_outside_the_app_go_to_the_mac_canary (main.SwiftCanaryFleetCoverage.te st_targets_outside_the_app_go_to_the_mac_canary)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Owned by nx-chat on big-red · took over from session 01a15d41

[teamleaderleo]

cmux-next crash-class rules / cmux-next crash-class rules is red on 11 of 11 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

Bead cx-x20lc created for this PR by the cmux coordinator.

[teamleaderleo]

Review (codex xhigh via acpmux, correctness first): SHIP at 7b4c4e1

Codex (gpt-6.1-sol, xhigh) on the full diff 783c206..7b4c4e1: no correctness findings. The JSON splice is well formed and can't inject fields. The capability is listed everywhere it's needed. Plain allows are unchanged. The remote relay still refuses agent-session verbs. Every client conformer is updated. A Claude subagent review also returned SHIP at this head, after its two findings were fixed: the capability export file, and compact re-encoding of the answers.

Fleet evidence:

• Rust RED at the test commit c242d6c (step 0de8d3c93841f56b7a14c360): a_question_answer_carries_its_answers_to_acpmux_unchanged fails at the capability assert.
• Rust GREEN at 1772179 (step 1b84acceba92214740cde9ba): 94/94 agent_session tests pass. The only change after that commit is in Swift and the JSON export.
• Swift GREEN at 7b4c4e1 (step ab63efb8018dee32f007b634): RemoteAcpmuxWireAnswersTests, RemoteAcpmuxObserverTests, AgentPaneRelayedAllowTests, RemoteChildSessionsTests and DaemonCapabilityExportTests all pass.
• cmux-ci compile-check --app fails the same way at base 783c206 (job 0ba18ab3) and at the head: CmuxSentryReporting is missing from package resolution. That's a base red.
• Remaining CI reds are base findings, in files this PR doesn't touch: release-notary and cmux-next checks fail the same way on cmux NEXT: remove the Needs your input pill over the transcript #24108, fleet test-compile: its own gateway label, so the advisory check never starves the required app compile #24217 and cmux NEXT: Inter, bundled, is the UI font everywhere, with its calculated tracking #24100. crash-class rules is CEFFileDragRelay.swift, and the protocol contract is SDK publish conformance.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex xhigh via acpmux, correctness first): SHIP at de2b69a

Codex (gpt-6.1-sol, xhigh, on cmux16) reviewed this head against the newer base aca5900 that was brought in: no correctness findings in any of the six areas it checked (the splice, where the capability is listed, plain allows unchanged, the relay deny, the tests and conformers, and how the change combines with the base).

Evidence at this head:

• cmux-ci compile-check --app passed (job 87ab1af8557b4f95e11b067c). The earlier failure was the base's CmuxSentryReporting resolution red, fixed on base by ci: fleet app compile keeps CmuxSentryReporting (base red since #23714) #23910.
• The tests (Rust red at c242d6c, green at 1772179; Swift green at 7b4c4e1) are in the previous receipt. The only change since is the base merge, which came in clean.
• The remaining reds are base findings, in files this PR doesn't touch. release-notary and cmux-next checks (the namespace lint in AttentionHighlightLook.swift and ChiefWorkspaceName.swift) also fail on cmux NEXT: remove the Needs your input pill over the transcript #24108, fleet test-compile: its own gateway label, so the advisory check never starves the required app compile #24217 and cmux NEXT: Inter, bundled, is the UI font everywhere, with its calculated tracking #24100. rails (the backend Rails tests) also fails on cmux NEXT: Inter, bundled, is the UI font everywhere, with its calculated tracking #24100.

[teamleaderleo]

cmux-next guards / nightly-guards / workflow-guard-tests / release-notary is red on 18 of 18 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › Checks job structure is red on 16 of 18 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › No fleet host names in gallery fixtures is red on 16 of 18 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › No new SwiftUI (macOS UI is AppKit) is red on 16 of 18 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

Orphaned: no activity for 14 h, and no lane holds a lease on it. Adopted by the orphan sweep: merged feat-cmux-next in at 379a990. A later pass queues it for the merge hub if it is reviewed, small and red only on base reds.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › Script tests (pin-cmux-tui, embed-cef, ensure-cef store) is red on 14 of 15 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

cmux-next / cmux-next swift test is red on 10 of 14 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

Stale (13d, conflicts); rebuild fresh from feat-cmux-next if still wanted