[teamleaderleo]

HOLD: sidebar change under Lawrence's sidebar hold; open for dogfooding, never ready-to-land.

Split out of #22871, part 1 of 4 (the adopt verb). #22871's intent: "Open a chat that already runs on another machine (cmux16, huge-blue; for example one cmux agent open huge-blue/NAME started) as a sidebar workspace bound to that machine's daemon." Stack: this PR, then #24559 (mode reads), then #24555 (bypass badge), then #24556 (the app's adopt workspace).

Summary

• agent-session-adopt {surface, session} binds a session of this machine's own acpmux to an unbound agent tab of this store.
  • Same gates as agent-session-start: a trusted local non-remote client, the host gate that refuses team VMs and unverified Cloud VMs, and a tab of this store with no session yet.
  • It refuses with agent_session.unknown_session any id that this machine's _acpmux/sessions does not list as its own: a peer's mirrored chat, the Home Chief's, or an unknown id. It never starts acpmux.
  • It answers {surface, session, conversation, family, mode, asking}.
• Policy (b): a chat in a mode that does not ask (bypass) is adopted, but only on enrolled or trusted hosts (the start's host gate), and the answer says asking: false so the app can warn.
• is_chief moves to agent_session_start and is shared with agent_update, using base's panic-free JsonFields::field.
• The capability is not advertised yet. agent-session-adopt-v1 goes into identify in cmux-tui: agent-session-mode and the attach mode reads for adopted chats #24559, together with the mode reads. An app that sees the capability sends mode_events and agent-session-mode, which this PR does not serve, so this PR alone is dark.
• Review round 1 at fcd4f27 found three issues in the mode reads. They are fixed with CLI tests in cmux-tui: agent-session-mode and the attach mode reads for adopted chats #24559, which now holds that code, so each PR stays under about 800 lines.
• Size: 413 changed lines.

Risk: high. This adds a socket verb that binds sessions and lets a non-asking session open on a trusted host.

Changelog

none (the app half, #24556, carries the user-visible line)

Observed / Not run

Fleet runs at this head are listed in the comments below with their job ids.

Base red, not this PR's: cmux-tui::cli agent_session_start::* (for example a_peer_session_makes_the_keyed_restart_unsafe) fails under load with "acpmux did not answer in time" (agent_session.timeout). Base e1429af1bbc4 with the same --arg test --arg agent_session step is red the same way (step 38542d4ae54759f6fd6129a0). The narrower agent_session_start run is green on #22871's head (step a4dcf8dcc08856d309bd0f8b, 34/34).

Not run: no live adopt of a real remote chat end to end.

🤖 Generated with Claude Code

Agent session: cosmic-gray

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d07af2f: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr24554 -f ref=cmux/agent-session-adopt-daemon -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: Checks job structure (+4 more) is not red on the base e6048d7; do not merge until green; see lane-rules

[teamleaderleo]

Owned by p0-machines on air-blue · session

[blacksmith-sh]

Found 11 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmprddsac9j/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpuuq64x92/summary-fail.json (live):/summary-fail.json (live):	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
convention violations found (ERROR lines above)./ convention violations found (ERROR lines above).	View Logs
test_base_passes (main.NoticesPairTests.test_base_passes)/ test_base_passes (main.NoticesPairTests.test_base_passes)	View Logs
test_targets_outside_the_app_go_to_the_mac_canary (main.SwiftCanaryFleetCoverage.te st_targets_outside_the_app_go_to_the_mac_canary)/ test_targets_outside_the_app_go_to_the_mac_canary (main.SwiftCanaryFleetCoverage.te st_targets_outside_the_app_go_to_the_mac_canary)	View Logs
test_wrong_event_stream_is_rejected (main.LiveSchemaTests.test_wrong_event_stream_i s_rejected)/ test_wrong_event_stream_is_rejected (main.LiveSchemaTests.test_wrong_event_stream_i s_rejected)	View Logs

...and 1 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Fleet at head fcd4f270b133ba661d9fce16fed42e89ce9537e6:

• cmux-tui-rust-check.sh test agent_session, step b836f0378032b93ec56e74b8: green, 5 crates, 0 red, 0 flaky.
• cmux-tui-rust-check.sh clippy, step d9bd3ab55ecee9482fa45769: green.
• cmux-tui-rust-check.sh fmt, step 29a51367f0de6d26e31635d5: green.

[teamleaderleo]

Bead cx-7wt10 created for this PR by the cmux coordinator.

[teamleaderleo]

Review (codex xhigh, correctness first): SHIP at d07af2f

No blocking findings.

Checked:

• Exact parent-to-head diff and pinned source files.
• Adopt routing, Unix/non-remote trust gate, host gate, tab ownership, and shared concurrency limits.
• Own-session filtering for peer and Chief sessions; no acpmux startup path.
• Capability references and identify non-advertisement.
• is_chief sharing, conversation-tab restrictions, spec, and CLI coverage.
• Read-only review; no builds or tests run.

Reviewer: Codex xhigh (acpmux session sr-rev-split-a-d07af2f), read-only, pinned to parent 949df892e507 and this head.

Fleet at this head d07af2f19224e9a0587bf34e6e09566529cd1f1c:

• cmux-tui-rust-check.sh test agent_session, step e1622772763d28994173e3ff: green, 5 crates, 0 red, 0 flaky.
• cmux-tui-rust-check.sh clippy, step 442e18207ec31958cc808149: green.
• cmux-tui-rust-check.sh fmt, step ea5bd8237d9c87898c5a8b02: green.

[teamleaderleo]

Closing: feat-cmux-next now reaches this PR's goal another way, so this verb would land with nothing to call it.

#22871's goal was to show a chat running on another machine (cmux16, huge-blue) in this Mac's sidebar and open it. Base does that through acpmux peer mirroring, with the tab bound on this Mac:

• cmux NEXT: agent.openSessionTab --host <peer> opens that machine's chat (as this Mac's acpmux mirrors it) #25027 (d62504b): agent.openSessionTab --host <peer> resolves the peer's chat to the session this Mac's acpmux mirrors, by id, qualified id or name, and binds the tab here. Its stated rule (AgentPeerSession.swift) is "A tab never binds to another machine's daemon (cx-k21v); it binds to the mirrored session on this Mac's acpmux, which forwards to the peer".
• db98601 (Lawrence): every reachable machine's live chats are plain sidebar rows with a machine caption (RemoteMachinesSidebar.mergedRows). A click opens the mirrored lane (host?.open(lane)).

agent-session-adopt does the opposite: it binds the chat into a tab of the remote machine's own daemon. Its only consumer is the app half, #24556, and that path overlaps --host, which #25027 now gives to the mirror. Nothing on base and no other open PR sends agent-session-adopt. This PR alone does not advertise the capability. Landing it would add a risk:high socket verb with no consumer.

The is_chief share and the asks extraction were only refactors serving adopt, so nothing here needs to be kept. The stacked #24559 closes for the same reason.

Agent session: Air-Blue