[teamleaderleo]

Peer-route approvals, part 2 of 4: enroll this Mac's app key on a peer. Part 1 (#26131) has landed; this PR is on feat-cmux-next.

Part 1 lets a peer count an Allow signed by a Mac listed in its mac-approvers.json. This PR adds the commands that put the Mac in that file, plus the name a refusal needs for the card's hint.

• acpmux host approvals lists the Macs that may allow this machine's prompts, and this machine's own app key (thisMac).
  • host approvals add --id ID --key HEX --name NAME and host approvals rm ID change the file under a lock. The file is rewritten whole with 0600 permissions.
  • After each change the command makes the daemon reload (part 1's reload), so a removal stops that Mac's Allows at once. The file's lock is held until that reload returns, so a concurrent add cannot land between rm's write and its reload. A running daemon that does not reload fails the command (and so a remote enroll/unenroll).
• host approvals enroll PEER / unenroll PEER, run on the Mac:
  • reads this Mac's app key from the local daemon (_acpmux/mac_approvers thisMac, which the app sets in part 3);
  • runs host approvals add / rm on that peer over ssh, with the same ssh route host enroll uses.
• acpmux host enroll and host doctor gain an approvals step. It is the same check:
  • ok when the Mac is enrolled with the same key fingerprint;
  • warn with "fix: acpmux host doctor NAME --fix" when it is not;
  • fixed after --fix or enroll;
  • skip when no cmux app has given a key ("open cmux on this Mac");
  • warn "too old" with acpmux host update NAME when the remote acpmux has no host approvals.
  • The Swift HostStep already tolerates unknown steps.
• permission_respond refused by a peer now carries data.peer, the local daemon's name for that peer, unless the error names one already. The app uses it for the "enroll this Mac on HOST" hint (parts 3 and 4).

Conditions

• (4) Unenrolling stops Allows at once: host approvals rm, and unenroll from the Mac, rewrite the file and then reload under the set's lock (part 1), holding the file's lock until the reload returns; a reload that fails fails the command.
• (5) No private key moves: only the public key and its id cross ssh. No RPC adds a key; add writes the peer's file as the ssh user.

Tests (they fail before the fix and pass after)

They ran remotely through cmux-ci test.

Before: the enroll step taken out, and no peer name on a refusal.

test server::peer_forward::tests::a_refused_answer_names_the_peer ... FAILED
test cli::host_approvals::tests::enroll_adds_this_macs_app_key_once_and_doctor_finds_it ... FAILED

Before (review round): the lock let go before the reload, and a reload failure ignored.

test cli::host_approvals::tests::a_daemon_that_does_not_reload_fails_the_change ... FAILED
test cli::host_approvals::tests::a_change_holds_its_lock_until_the_reload_returns ... FAILED

After:

test cli::host_approvals::tests::no_app_key_skips_and_an_old_remote_warns_with_the_update ... ok
test cli::host_approvals::tests::enroll_adds_this_macs_app_key_once_and_doctor_finds_it ... ok
test server::peer_forward::tests::a_refused_answer_names_the_peer ... ok
test cli::host_approvals::tests::a_change_rewrites_the_file_whole_and_keeps_each_mac_once ... ok
test cli::host_approvals::tests::a_change_holds_its_lock_until_the_reload_returns ... ok
test cli::host_approvals::tests::a_daemon_that_does_not_reload_fails_the_change ... ok
lib (filtered, review round): 46 passed; clippy -D warnings and fmt --check clean
lib (filtered): 56 passed; peer_integration: 49 passed; person_allow: 25 passed; clippy -D warnings clean

No capture: CLI and daemon only, with no app or webview change. Part 3 carries the card captures.

Overlap: #25822 (an update step in host enroll) changes the same step list. Whichever lands second rebases.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpjm607jdk/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpzg8_b5zu/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
convention violations found (ERROR lines above)./ convention violations found (ERROR lines above).	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-n44zc0 created for this PR by the cmux coordinator.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 0bee346: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26133 -f ref=lane/hb-peer-approvals-cli -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 5c79c71 to compare; do not merge until green; see lane-rules

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4051466928001 (57dd76e81c)
• cmux NEXT nightly 1.0.0-nightly.4051568197101 (5d261477be)
• cmux NEXT nightly 1.0.0-nightly.4052516359101 (86ebb89edf)
• cmux NEXT nightly 1.0.0-nightly.4055612617201 (f83ddd6b20)