[teamleaderleo]

The default cmux NEXT agent tab uses the shared CEF cmux-page://cmux.agent/ host. This prerequisite adds the artifact document route cmux-page://cmux.agent/__artifact with the same one-shot render protocol as the native artifact endpoint, an opaque sandbox policy (default-src 'none', inline styles/scripts only, data/blob media), and refusal of artifact/srcdoc subframe, refresh and resource escapes.

Leo: "the /side thing i heard somebody really liked in codex... and i think html/html artifacts and that kinda good viewing and good support for it would be cool" / "like the claude.ai artifacts but imagien you didnt need to only have it on claude.ai...".

The CEF-only change is intentionally separate from the web capability/URL seam: the agent page descriptor must allow this exact frame source, and the web Run path will select /__artifact only on cmux-page://cmux.agent/; passive previews remain sandbox="" srcdoc. It does not alter ordinary page files, Chief, or performance behavior.

Red first / static evidence

• Test-first commit: b71fd15fede.
• Fix head: a47a65d01ca5b1a4e8168c520164ec37d15988d4; tree ce42ffd5aa6736d8f723dfb0acfed05cd3fc2fa6.
• Static verify-local checks, JavaScript syntax and diff check pass. Native C++ execution, CEF build and browser probe are pending on the managed fleet; the hosted recipe runs scripts/cmux-next/test-cmux-page-path-cpp.sh on both commits, then probes first load, refresh/self-navigation, nested frames, network/file access and bridge refusal.

Agent session: agent session

Astra xhigh SHIP at exact head a47a65d01ca5b1a4e8168c520164ec37d15988d4: exact bare artifact factory, opaque CSP, ancestor/resource denial and ordinary page preservation reviewed with no static findings. Native CEF build/browser/C++ execution and the web descriptor seam remain hosted integration evidence.

Performance

No perf numbers: this adds a CEF page route for artifact documents and changes no hot path; nothing here is a performance change.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review a47a65d: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26224 -f ref=nx-artifacts-cef-1027 -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: green on the base 8acb82a; do not merge until green; see lane-rules

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpjmibmbqw/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpjvecgdca/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-3npf9i created for this PR by the cmux coordinator.

[teamleaderleo]

cmux-next / cmux-next checks (god files, concurrency, crash safety, l10n) › No literal state roots (per-build isolation S7, cx-is1kf.8) is red on 13 of 21 fresh feat-cmux-next PR heads in the last 2:00:00, so it is most likely a base red, not this PR's. The base-reds lane has it; a base merge picks up the fix once it lands.

[teamleaderleo]

Review (codex gpt-6-astra xhigh, next-review): SHIP at a47a65d

No blocking findings.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Orphaned: no activity for 13 h, and no lane holds a lease on it. Adopted by the orphan sweep: merged feat-cmux-next in at 3fee9f8. A later pass queues it for the merge hub if it is reviewed, small and red only on base reds.

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): SHIP at 3fee9f8

No blocking findings. The route gating, CSP sandbox, ancestry checks, resource allowlist, and one-shot render flow are consistent with the stated behavior.

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): SHIP at c9911a6

No blocking findings.

[cmux-bot]

cmux-bot approves c9911a6: an independent review passed this exact head (next-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

A newer verdict blocks 5c7ebe0 (no independent SHIP at the head).

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): SHIP at 5c7ebe0

No blocking findings.

Static review only; native CEF execution and browser integration remain unverified.

[cmux-bot]

cmux-bot approves 5c7ebe0: an independent review passed this exact head (next-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4097664234401 (167472006a)