[teamleaderleo]

Leo: “you gotta re-authenticate. You gotta log in again on the modal picker before the user even sends a prompt.”

This is the third of four PRs for _acpmux/session/auth. It builds on #26699, which has merged. It adds two things: the bound route's probe as evidence, and the target form for a chat that hasn't started. The fourth PR, #26845 (stacked on this one), asks peers and lists the sessionAuth feature, so initialize doesn't list it yet. Together with the next PR, this was one PR. That PR got a SHIP from the reviewer and was split here to stay under 800 lines.

Evidence, in order:

1. Peer link. As in acpmux: _acpmux/session/auth answers a chat's sign-in from its own turns #26699, a peer's chat is answered from its link. A down link gives peerUnreachable; otherwise the answer is unknown. A target on a peer (target.host) is invalid params ("not answered yet"). The next PR asks the peer.
2. Bound route probe. The route is the one a spawn would pick (routes::spawn_route, from acpmux: _acpmux/session/auth answers a chat's sign-in from its own turns #26699).
   • A probe is evidence only for the harness family whose endpoint and key it tests (route_probe::probes_for).
     • A relay route (local-coderouter, or cmux-router with no secret) mints a key per family, so its probe speaks only for the exact family it probed as.
     • Any other route sends its own secret to every family. Its health URL speaks for all families, and its base URL for the families on that endpoint (the Anthropic one for Claude, the OpenAI one for the rest).
   • With refresh, a fresh probe runs. Otherwise the last answer is used if it is no more than 5 minutes old and came from the route as it is now.
   • route_probe.rs keeps each route's last answer with the route file it probed. Every read and every probe drops answers older than 5 minutes, and the oldest once more than 64 routes are kept.
   • A probe never runs for a route whose secret or a header is a keychain: reference.
   • auth_needed gives routeAuthNeeded, with login {kind: "route", routeId}. unreachable gives routeUnreachable.
   • rate_limited and unknown fall through and are never treated as a sign-in state.
3. Newest turn. A chat uses its own newest turn, as in acpmux: _acpmux/session/auth answers a chat's sign-in from its own turns #26699. A target {harness, routeId?} uses the newest turn of any chat on this daemon with the same harness, the same route and the same account home, and sets fromSessionId to that chat. Another account home never leaks in.
   • Home and env are resolved as spawn resolves them: the family's and the profile's defaults env under the profile's env (Hub::spawn_profile). A home those pin beats a family or global route's home, but not the home of a route picked for the chat or the profile.
   • A missing routeId means the default route, as at spawn.
   • A routeId that is gone, or that doesn't serve the harness, is invalid params, as a spawn would refuse it. A sibling chat whose own route a spawn would refuse is skipped.
   • An unknown harness is invalid params.
4. Harness check. With refresh, the harness's own check that reads no keychain, as in acpmux: _acpmux/session/auth answers a chat's sign-in from its own turns #26699, run over the defaults' env.
5. Otherwise unknown.

Tests. After is this head, on cmux-ci run 40669532019: fmt and clippy -D warnings are clean; acpmux lib (1630), session_auth (7), hub_integration (514; prompt_supersede::a_prompt_queued_before_a_restart_is_still_replaced is flaky, see below), the route suites, typed_errors, harness_health, claude_auth_env and no_keychain pass.

Before, each new test failed on the tree without its fix:

• Base 18af98c with only the tests added (run 40634054284):
  • session_auth_for_a_target_reads_only_its_own_account: a target with no chats gives unknown. A chat in another account home that is signed out doesn't leak into the target. A sibling's signedOut is picked up, with fromSessionId. An unknown harness is invalid params.
  • session_auth_reads_the_routes_probe_and_a_rate_limit_falls_through (local HTTP 401, 429 and 200 endpoints):
    • With no probe yet, the answer is unknown.
    • With refresh, the answer is routeAuthNeeded with a route login, and that answer is reused without refresh.
    • Once the endpoint answers 200, a refresh probes again.
    • A 429 falls through.
    • A profile's own route beats the global default.
    • A route for another family is refused.
• Run 40667053893: session_auth_reads_the_home_the_defaults_pin, where a home the defaults env pins is named for both a chat and a target.
• Run 40665976369: route_probe::tests::a_probe_speaks_for_the_family_whose_endpoint_it_tests, for relay routes and for OpenCode and Pi.
• Unit tests, after ok:
  • route_probe::tests::{kept_answers_are_recent_and_bounded, a_kept_answer_is_for_the_route_as_probed}
  • hub::session_auth::tests::{a_rate_limited_probe_falls_through, a_target_keeps_the_home_its_profile_pins, a_route_is_taken_as_a_spawn_takes_it}

Risk: medium-low. Everything is read-only. A fresh probe runs only with refresh, never on a keychain route, and never for a Web connection.

No capture: no UI changes; this is a daemon method no view calls yet.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Bead cx-w3qmus created for this PR by the cmux coordinator.

[blacksmith-sh]

Found 4 test failures on Blacksmith runners:

Failures

Test	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)/ test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 2a139fc: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26700 -f ref=lane/hb-session-auth-peers -f platform=macos -f backend_mode=local

Passes: CI passes on 2a139fc768.

CI passes on 2a139fc768 (run 40669560334 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40693729434 at 3df9106 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at b02480c. This pull request is one of 2 merged since: #26816, #26700.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4070477034801 (04673a0583)
• cmux NEXT nightly 1.0.0-nightly.4070842501701 (cbf6ae2e55)