fix(cmux-next): validate replies from immutable question inputs by teamleaderleo · Pull Request #26837 · manaflow-ai/cmux

teamleaderleo · 2026-10-28T10:39:14Z

Question-card Other answers need validation against the exact immutable native request before the trusted renderer proof can be spent. This prerequisite validates and canonicalizes a captured reply; it creates no person authority.

The standalone immutable Input contains sessionId, permissionId, requestJSON, and requestDigest. Validation checks the exact digest, current unique allow-once option, complete harness-specific answers, choice-only labels, duplicate JSON keys, original Claude AskUserQuestion previews, notes, and annotation absence/null semantics. Session and permission identity are never taken from the renderer reply. Omitted/null allowsOther defaults to true, matching AgentQuestion.Item and the web decoder; explicit false remains choice-only and malformed flags are refused. Both allowsOther and multiSelect require a JSON Boolean when present; numeric zero/one cannot coerce into flags. Omitted/null multiSelect defaults to false.

This pure helper has no ledger, connection, generation, nonce, person-proof, gesture-ticket, or renderer-binding APIs. The later integration must construct Input only from a captured native live Question and recheck that Question after renderer redemption and at ticket consumption. It does not repair Other Enter by itself.

Lawrence, via Leo:

leo i think this ui can be better / also needs to be keyboard navigable (i didnt check yet) / leo this needs to work with keyboard shortcuts like up arrow ctrl n/p etc / clicking enter doesnt work

Base: feat-cmux-next 8424d05bf9324f6f60a8f0c7c40b01f8a3e085b9.
Head: 0812231ec3dae1b370726bbd530fb4a5b0f73b8a.
Diff: 355 added lines in two files.

Validation:

git diff --check and python3 scripts/cmux-next/prepush-gate.py pass at this exact head.
Omission/null regressions were committed first as 028cb98a0cfead717bd2fb180cdc6a3581f286b8 and cover Claude/Chief/Codex with options present and exact answer preservation.
Numeric Other-flag and strict multiSelect regression sources were committed before their fixes as 54859174875 and 6669d37407b.
Original regression source was committed first as 0c7a29e9891; native compilation and tests are UNVERIFIED under the coordinator's Swift HOLD26809. No executed red/green result is claimed.
Intended fleet command after release: swift test --package-path Packages/macOS/CmuxNext --filter AgentPaneQuestionReplyTests.

The question_other_answer lane owns final verification with the root coordinator. This remains draft pending independent exact-head review and required native verification. No merge is requested.

Changelog

none

No capture: no UI change; this PR adds a pure Swift validator and its tests, with no rendered surface.

Agent session: agent session

Source regressions precede the helper; native compilation and execution remain unverified under Swift HOLD26809. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

Pure validation and canonical intent only: no ledger, person proof, gesture ticket, or renderer binding authority. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

teamleaderleo · 2026-10-28T10:43:52Z

Bead cx-nvytmu created for this PR by the cmux coordinator.

blacksmith-sh · 2026-10-28T10:49:04Z

Found 12 test failures on Blacksmith runners:

Failures

Test	View Logs
`/tmp/tmpk4l8qu23/summary-fail.json (live):/summary-fail.json (live):`	View Logs
`/tmp/tmpynqfidft/summary-missing.json (live):/summary-missing.json (live):`	View Logs
`[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/` `[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows`	View Logs
`[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames`	View Logs
`[tabs] debug.tab_switch timed 0 of 40 switches/` `[tabs] debug.tab_switch timed 0 of 40 switches`	View Logs
`[tabs] the window draws no frames/[tabs] the window draws no frames`	View Logs
`main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/` `test_download_prints_the_active_profile_only`	View Logs
`stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/` `Security has no stub`	View Logs
`stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/` `CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/` `CoreFoundation, missing 1: ['_CFRetain']`	View Logs
`stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/` `CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/` `CoreFoundation, missing 1: ['_log2']`	View Logs

...and 2 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Source-only regression under native Swift HOLD; execution is pending fleet verification. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

Match shared and web decoders for absent/null allowsOther while retaining explicit false restrictions and malformed flag refusal. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

Source-only native regression under Swift HOLD; JSON numeric zero/one must not decode as Bool. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

Validate the Foundation JSON type before reading boolValue to match strict shared/web decoding. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

Source-only regression under native Swift HOLD; malformed numeric and object flags cannot change answer shape. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

Absent/null flags use the shared defaults; explicit flags require JSON booleans for both answer permissions and multi-select shape. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

github-actions · 2026-10-29T22:29:08Z

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review df7c8bf: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26837 -f ref=lane/nx-question-validator-1028 -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: No literal state roots (per-build isolation S7, cx-is1kf.8) is not red on the base 4eab936; do not merge until green; see lane-rules

teamleaderleo · 2026-10-30T03:41:21Z

Owned by an agent session · took over from an earlier session · session

…stion-validator-1028

…ption Read the option as AcpmuxPermissionPrompt.onceOption does: a request that offers two allow_once options is ambiguous and takes no reply. Note where the validator deliberately matches acpmux check_answers/check_annotations (", " multi-select split, any of the question's previews). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

…nd the question card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

…acpmux does acpmux check_annotations reads annotations only for Claude Code's AskUserQuestion and drops them for any other question, so the pane check passes them too instead of refusing a reply acpmux takes. Name what the validator covers: question cards, not plain permission cards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

…he relay take Its byte caps are a parse bound above the relay's own per-field limits, it reads only the allow-once option out of the request's options, and a Codex choice may repeat a label two options share (acpmux checks no Codex labels). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

Skip non-object entries in the request's options and in rawInput's questions and their options, as acpmux does, instead of refusing the reply or skipping the preview check. Take the first allow_once option, the one the question card answers with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

…x do Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

…nds, and empty Claude prompts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

…lized items Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

teamleaderleo · 2026-10-30T13:12:36Z

Review (codex gpt-6-astra high, next-review): SHIP at df7c8bf

No blocking findings.

Review limited to the supplied diff and files; dependency reads were unavailable, and native compilation/tests were not run.

cmux-bot

cmux-bot approves df7c8bf: an independent review passed this exact head (next-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

teamleaderleo · 2026-10-30T13:55:12Z

Review (Codex gpt-6-astra high, fast; independent, via review-router): SHIP at df7c8bf

No blocking findings. Answer shapes, option resolution (the question card's answerOption and acpmux check_reply), multi-select splitting, size bounds, annotations and the immutable request checks match acpmux and the relay for well-formed question cards. Three nits only affect malformed requests. cmux-next/compile is green at this head. The reds fail the same way on base: cmux-next checks literal state roots (da4aa9b) and the Sidebar-Look trailer lint, which counts base commits (this PR adds two Swift files under CmuxNextAgentPane), plus release-notary test_digest.py (941b7a4).

github-actions · 2026-10-30T16:58:50Z

Shipped in:

cmux NEXT nightly 1.0.0-nightly.4108762076801 (8e3aaa2401)
cmux NEXT nightly 1.0.0-nightly.4108980870001 (d9f2f7af55)
cmux NEXT nightly 1.0.0-nightly.4109063053901 (bf70709747)
cmux NEXT nightly 1.0.0-nightly.4109296117601 (72882288da)
cmux NEXT nightly 1.0.0-nightly.4109410702301 (aead767cca)

teamleaderleo added 2 commits October 28, 2026 10:40

test: specify immutable question reply validation

0c7a29e

Source regressions precede the helper; native compilation and execution remain unverified under Swift HOLD26809. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

fix: validate question replies from immutable request inputs

74a1dfa

Pure validation and canonical intent only: no ledger, person proof, gesture ticket, or renderer binding authority. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

teamleaderleo force-pushed the lane/nx-question-validator-1028 branch from c7f297b to 74a1dfa Compare October 28, 2026 10:41

teamleaderleo temporarily deployed to ci-routing-agent October 28, 2026 10:41 — with GitHub Actions Inactive

github-actions Bot added the risk:normal Risk tier (docs/ci/risk-tiers.md) label Oct 28, 2026

teamleaderleo temporarily deployed to ci-routing-agent October 28, 2026 10:41 — with GitHub Actions Inactive

teamleaderleo mentioned this pull request Oct 28, 2026

fix(cmux-next): track live questions and fence stale recovery #26820

Closed

teamleaderleo added 2 commits October 28, 2026 10:56

test(cmux-next): specify omitted Other flag defaults

028cb98

Source-only regression under native Swift HOLD; execution is pending fleet verification. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

fix(cmux-next): honor default Other allowance

120509e

Match shared and web decoders for absent/null allowsOther while retaining explicit false restrictions and malformed flag refusal. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

teamleaderleo temporarily deployed to ci-routing-agent October 28, 2026 10:57 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to ci-routing-agent October 28, 2026 10:58 — with GitHub Actions Inactive

teamleaderleo added 4 commits October 28, 2026 10:59

test(cmux-next): refuse numeric Other flag coercion

5485917

Source-only native regression under Swift HOLD; JSON numeric zero/one must not decode as Bool. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

fix(cmux-next): distinguish boolean Other flags from numbers

9510305

Validate the Foundation JSON type before reading boolValue to match strict shared/web decoding. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

test(cmux-next): specify strict multi-select flag decoding

6669d37

Source-only regression under native Swift HOLD; malformed numeric and object flags cannot change answer shape. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

fix(cmux-next): decode question flags with shared strict defaults

0812231

Absent/null flags use the shared defaults; explicit flags require JSON booleans for both answer permissions and multi-select shape. Agent-Session: https://cmux.com/deeplink/agent?id=aid-eb13e936fc1b3752c7c7

teamleaderleo temporarily deployed to ci-routing-agent October 28, 2026 11:00 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to ci-routing-agent October 28, 2026 11:01 — with GitHub Actions Inactive

Merge branch 'feat-cmux-next' into lane/nx-question-validator-1028

31d65cd

teamleaderleo temporarily deployed to ci-routing-agent October 29, 2026 22:23 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to ci-routing-agent October 29, 2026 22:24 — with GitHub Actions Inactive

teamleaderleo and others added 2 commits October 30, 2026 04:08

Merge remote-tracking branch 'origin/feat-cmux-next' into lane/nx-que…

a03cada

…stion-validator-1028

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 04:11 — with GitHub Actions Inactive

teamleaderleo mentioned this pull request Oct 30, 2026

Agent pane: answered question and checklist as Claude desktop cards #27938

Merged

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 04:13 — with GitHub Actions Inactive

docs(cmux-next): say how the question reply check relates to acpmux a…

599d813

…nd the question card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

teamleaderleo and others added 2 commits October 30, 2026 05:48

docs(cmux-next): name where the question reply check's limits come from

705f16f

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 06:11 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 06:36 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 09:12 — with GitHub Actions Inactive

fix(cmux-next): resolve the reply's option as both the card and acpmu…

5cc57c5

…x do Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 10:26 — with GitHub Actions Inactive

teamleaderleo marked this pull request as ready for review October 30, 2026 10:28

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 10:28 — with GitHub Actions Inactive

fix(cmux-next): match the card's trimmed option id, acpmux's allow ki…

adad8c2

…nds, and empty Claude prompts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 10:59 — with GitHub Actions Inactive

fix(cmux-next): match acpmux on trimmed Codex ids and malformed norma…

df7c8bf

…lized items Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 11:38 — with GitHub Actions Inactive

cmux-bot Bot approved these changes Oct 30, 2026

View reviewed changes

teamleaderleo merged commit ff7b8d3 into feat-cmux-next Oct 30, 2026
140 of 147 checks passed

teamleaderleo deleted the lane/nx-question-validator-1028 branch October 30, 2026 16:03

Navigation Menu

Repository navigation

fix(cmux-next): validate replies from immutable question inputs - #26837

fix(cmux-next): validate replies from immutable question inputs#26837
teamleaderleo merged 19 commits into
feat-cmux-nextfrom
lane/nx-question-validator-1028

teamleaderleo commented Oct 28, 2026 •

edited

Loading

Uh oh!

teamleaderleo commented Oct 28, 2026

Uh oh!

blacksmith-sh Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

cmux-bot Bot left a comment

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

teamleaderleo commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

Uh oh!

teamleaderleo commented Oct 28, 2026

Uh oh!

blacksmith-sh Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Failures

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

cmux-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

teamleaderleo commented Oct 28, 2026 •

edited

Loading

blacksmith-sh Bot commented Oct 28, 2026 •

edited

Loading

github-actions Bot commented Oct 29, 2026 •

edited

Loading

github-actions Bot commented Oct 30, 2026 •

edited

Loading