[teamleaderleo]

What (part a2 of #23322)

This is part a2 of #23322 (sessions.allowFullAccess under MDM), split out from that PR's restructure. It covers the app's push and the mode menu. #23322 (a1, landed) is the daemon's bound. #25538 (a3, approve-all), #25539 (b, agents already running in full access) and #25549 (a4, probes and the pool) follow a1. Each part lands on its own: this one only adds fields that an older daemon ignores, and reads a field an older daemon never sends.

It builds the decision on #23322, quoted word for word:

"#23322 (sessions.allowFullAccess under MDM), decided: an MDM-managed value is an upper bound the user can't override. If MDM sets allowFullAccess=false, Full access is unavailable and the mode menu says "Managed by your organization". If MDM is unset, nothing changes. This only narrows access, so it needs no call from Leo."

The app tells acpmux what MDM forces (CmuxNextSettings/ChatSettings.swift). The _acpmux/chat_settings push adds two fields:

• allowFullAccessManaged: whether MDM or the team policy forces the key.
• allowFullAccess: the forced value. Anything but true counts as false, and the field is null when nothing forces it.

settings-schema.sources.sha256 is regenerated for the changed source.

The pane (webviews/.../startMode.ts, ComposerPickers.tsx, direct.ts):

• It keeps one pane-wide flag from every _acpmux/start_mode answer: "fullAccess": "managed", which a1's daemon sends. An answer without the field (MDM unset, an older daemon) clears the flag.
• While the flag is set, each full-access row in the mode menu is disabled and captioned "Managed by your organization". This is the new key picker.fullAccessManaged, in all locales.
• A chat already shown learns the flag once per generation (a connect, start_mode_changed, a pick) through useFullAccessProbe. That is one ask per push, not a timer or a loop. Its microtask checks a live flag, which the effect's cleanup clears.
• Each ask takes a ticket, and only the newest ask's answer counts. An older answer changes nothing, even when the newer ask failed. This was finding 6 in the review rounds.
• The mark belongs to one connection (review 28): setStartModeSource (a reconnect, another daemon) takes a new ticket and clears the mark before it tells the pane, so a late answer from the old connection changes nothing. A daemon that predates _acpmux/start_mode answers method-not-found (-32601); direct.ts then clears the mark, instead of keeping what the previous daemon said. Any other refusal (invalid params, an unknown harness) comes from a daemon that may still manage full access, so the mark stays (review 34).
• An ask that failed (the host refused to relay it, the socket closed) said nothing about full access either: it gives its generation back, and a shown local chat's probe asks once more. A probe's own failure starts no retry, so it never loops (review 42). An ask acpmux answered with a refusal (an unavailable harness) is treated the same way: its answer carried no full-access field, so the probe asks once more (review 45).
• A harness that offers full access only as a config option (the Options chip, no declared modes) is covered too: a shown local chat probes for the mark, and the full-access choice in the Options menu is disabled and captioned the same way (review 48). A managed full-access row, the current one included, keeps the mode menu from collapsing into a plain label (review 48).
• The mark is this Mac's daemon's (review 37): it bounds only the chats that daemon runs. A peer's, a remote host's or a cloud chat shown in the same pane keeps its own full-access rows.
• Managed outranks an earlier refusal (review 34): a full-access row the agent refused before MDM turned it off is captioned "Managed by your organization", not the refusal. In a two-row menu (Manual and Bypass), a refused Bypass no longer collapses the chip into a plain label while managed: the row stays, disabled and captioned (review 37).

Tests

• webviews/test/access-chip-refused-mode.test.tsx, four new tests:
  • a managed answer disables the full-access row, shows the caption, and the row can't be picked;
  • an answer without the field leaves full access as it was;
  • an older answer that arrives after a newer ask failed changes nothing;
  • an older answer that arrives after a newer one changes nothing.
  • Red at be3e1eb (run 40362509713 on f69e8c7, the same tree: 3 of 6 fail). Green at 2476da5 (run 40362509661 on e8c7ff2, the same tree: 6 of 6 pass, tsc clean).
• Review 28, two more tests in the same file: "a daemon that predates start_mode clears what the previous daemon said" and "a new connection forgets the managed mark, and a late answer from the old one changes nothing". Red at 4301010 (run 40375707624: both fail). Green at d348850 (run 40379261183: access-chip-refused-mode and start-mode-host-refusal 10/10, typecheck clean with no warnings).
• Review 34, two more tests in the same file: "a refusal other than method-not-found keeps the managed mark" and "a full-access pick the agent refused says managed once full access is managed off". Red at 9b59831 (run 40385874180: both fail, 10 pass). Green at ac88294 (run 40385969757: 12/12; typecheck run 40385969747: no type errors).
• Review 37: "the managed mark is this Mac's: a peer's or another host's chat keeps its full access" is new, and the review 34 refusal test now uses the original two-row menu. Red at b6dc588 (run 40387546785: both fail, 11 pass). Green at 9e04ba0 (run 40387606734: 13/13; typecheck run 40387607022: no type errors).
• Review 42: "an ask the host refused does not stop a shown chat from learning the managed mark". Red at ee40632 (run 40397254097: the shown chat never asked again, 13 pass). Green at eb196fd (run 40397428630: 14/14; typecheck run 40397428407 clean; run 40397428561: ten nearby suites, from agent-pane-start-mode-chip to composer-row-layout, all pass).
• Review 45: the review 42 test now runs twice, for a host's refusal and for a daemon's own -32602 refusal. Red at 985fee5 (run 40402638690: the daemon-refusal case fails, the chat never asked again; 14 pass). Green at 213d6e0 (run 40402736097: 15/15; typecheck run 40402736434 clean; run 40402736204: the same ten nearby suites all pass).
• Review 48: "a full-access choice a chat offers only as a config option is managed too" and "a chat in full access whose narrower mode was refused keeps its menu once managed". Red at c340aa7 (run 40404615455: both fail, 22 pass). Green at b59f236 (run 40404705034: access-chip-refused-mode, agent-options-menu and start-mode-host-refusal 24/24; typecheck run 40404705142 clean; twelve nearby suites pass).
• Review 110: a peer's chat comes over this Mac's own connection, and the attach's detail names no peer, so the managed mark could disable a peer's full-access rows. onThisMac now also needs no peer on the chat's summary or its listed row. The review 37 test gains two cases (local origin with a summary's peer, and with only a listed row's peer). Red at 53a2592 (run 40459751233: that test fails, 14 pass). Green at d73eee5 (run 40459962162: 24/24; typecheck run 40459962521 clean; vp fmt --check run 40459962140 clean). e7266e5 before it only formats the test file (vp fmt), which the fast gates' web lint asked for.
• CmuxNextAppTests ChatSettingsPushFullAccessTests:
  • an MDM off goes out managed over the file;
  • the team policy's enforced off goes out managed;
  • a forced value that is not true goes out off;
  • with MDM unset nothing is forced.
  • Fleet runs (cmux-ci run ... package-test-lane.sh suite Packages/macOS/CmuxNext ChatSettingsPushFullAccessTests): red at be3e1eb (step 3365633fa314f4f4795353cc: 4 tests, 12 issues, the push carries neither key), green at 2476da5 (step 429ae48431421ed127d44396: 4/4).

Visual evidence

The changed state is the mode menu's full-access row, disabled and captioned "Managed by your organization". It is the new gallery variant permission-managed; the base menu is the unchanged permission variant. The gallery visual evidence run on this PR shows both states before and after.

Gallery: agent-pane.composer-pickers/permission-managed, agent-pane.composer-pickers/permission

Review: a fresh Codex gpt-6-astra xhigh review said SHIP at d73eee5.

No capture: the only native file is ChatSettings.swift, which adds two fields to the settings push and draws nothing.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Bead cx-3b2kf created for this PR by the cmux coordinator.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d73eee5: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr25540 -f ref=lane/hb-stale-trust-23322-a2 -f platform=macos -f backend_mode=local

Unclear: web / react-apps-check failed: no known signature; failed step: Check webview test shards.

CI failed on d73eee5d47 (run 40460239245 attempt 1): 4 code, 1 unknown.

Job	Verdict	Why
web / react-apps-base-check (2)	code	a web test failed
web / react-apps-base-check (1)	code	a web test failed
web / react-apps-base-check (3)	code	a web test failed
web / react-apps-base-check (4)	code	a web test failed
web / react-apps-check	unknown	no known signature; failed step: Check webview test shards

Failures:

• seen on other PRs agent-pane-peer-chat.test.ts a chat on an SSH machine > counts its running turn from the prompt and offers no machine switch mid-...: failed (job)
• seen on other PRs agent-pane-queue-row-click.test.ts queued row with a chip's menu open (chromium) > one press on more closes the model menu and does wha...: failed (job)
• seen on other PRs agent-pane-queue-row-click.test.ts queued row with a chip's menu open (webkit) > one press on more closes the model menu and does what ...: failed (job)
• seen on other PRs agent-pane-stream-jitter.test.ts chromium: settling short, long, and tool-ending replies does not move the message or composer: failed (job)
• seen on other PRs agent-pane-stream-jitter.test.ts chromium: a queued prompt deleted while the turn runs a tool leaves no gap for long: failed (job)
• seen on other PRs agent-pane-stream-jitter.test.ts webkit: a queued prompt deleted while the turn runs a tool leaves no gap for long: failed (job)
• seen on other PRs agent-pane-stream-jitter.test.ts chromium event first: a deleted queued prompt leaves no gap under the last row: failed (job)
• seen on other PRs chat-inspector-overlay-toggle.test.ts chromium, header: the toggle is above the open overlay and a click on it closes the Inspector: failed (job)
• seen on other PRs agent-pane-background-tasks.test.ts the summary card lists the chat's background tasks: running ones first, the finished folded: failed (job)
• seen on other PRs agent-pane-hairline-focus.test.ts composer at 1x: focus is the resting hairline a step brighter, no ring: failed (job)
• ... 22 more in the job logs

Matched log lines

web / react-apps-base-check (2): (fail) a chat on an SSH machine > counts its running turn from the prompt and offers no machine switch mid-chat [30919.25ms]
web / react-apps-base-check (1): (fail) the summary card lists the chat's background tasks: running ones first, the finished folded [937.89ms]
web / react-apps-base-check (3): (fail) no orange or system accent and no opaque glass on 2262 gallery stages [461862.91ms]
web / react-apps-base-check (4): (fail) 2 .mp4 500 MB paste remote [12303.76ms]

Not re-run automatically: web / react-apps-base-check (2), web / react-apps-base-check (1), web / react-apps-base-check (3), web / react-apps-base-check (4), web / react-apps-check are not machine failures.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

red: web / Web status; NEW: green on the base a147567; do not merge until green; see lane-rules
red: web / react-apps-base-check (1); no finished base run on a147567 to compare; do not merge until green; see lane-rules
red: web / react-apps-base-check (2); no finished base run on a147567 to compare; do not merge until green; see lane-rules
red: web / react-apps-base-check (3); no finished base run on a147567 to compare; do not merge until green; see lane-rules
red: web / react-apps-base-check (4); no finished base run on a147567 to compare; do not merge until green; see lane-rules
red: web / react-apps-check; no finished base run on a147567 to compare; do not merge until green; see lane-rules

Gallery before/after for d73eee5: the capture produced no images (run).

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[blacksmith-sh]

Found 165 test failures on Blacksmith runners:

Failures

Test	View Logs
test/accent-glass-invariants.test.ts/accent-glass-invariants.test	View Logs
test/accent-glass-invariants.test.ts/accent-glass-invariants.test	View Logs
test/agent-pane-agents-pill.test.ts/agent-pane-agents-pill.test	View Logs
test/agent-pane-agents-pill.test.ts/agent-pane-agents-pill.test	View Logs
test/agent-pane-attach-huge-files.test.ts/agent-pane-attach-huge-files.test	View Logs
test/agent-pane-attach-huge-files.test.ts/agent-pane-attach-huge-files.test	View Logs
test/agent-pane-background-tasks.test.ts/agent-pane-background-tasks.test	View Logs
test/agent-pane-background-tasks.test.ts/agent-pane-background-tasks.test	View Logs
test/agent-pane-bottom-stack.test.ts/agent-pane-bottom-stack.test	View Logs
test/agent-pane-bottom-stack.test.ts/agent-pane-bottom-stack.test	View Logs

...and 155 more test failures. View all on Blacksmith: run 40460239245, run 40460239302

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

cmux-next fast gates / post cmux-next/fast-gates is red on 15 of 20 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

Review (codex gpt-6-astra xhigh, next-review): SHIP at 927f794

No blocking findings. Static review only; tests were not run.

[teamleaderleo]

Review (codex gpt-6-astra xhigh, next-review): BLOCK at 6099fd0

• webviews/src/agent-session/acpmux/ComposerPickers.tsx:749: onThisMac ignores summary.peer. Peer chats are relayed over a local-origin connection with summary.peer set, so this code probes the local daemon and applies its managed-full-access mark to the peer chat, incorrectly disabling that chat’s full-access modes. This violates the PR’s stated peer/remote isolation.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4048747891701 (2c7dda4036)
• cmux NEXT nightly 1.0.0-nightly.4048857346401 (fe6c4fe01a)
• cmux NEXT nightly 1.0.0-nightly.4048947256901 (273534101b)
• cmux NEXT nightly 1.0.0-nightly.4049353932801 (e7cbb89fab)