Repository navigation
fix(acpmux): preserve peer ownership for session lifecycle commands - #27018
Conversation
|
Bead |
0d3bf06 to
341ce4a
Compare
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Review App of this head (app.zip, kept 1 day)
red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 9d8337e to compare; do not merge until green; see lane-rules |
|
Found 9 test failures on Blacksmith runners: Failures
|
cf7386d to
97fe72c
Compare
|
Review (subagent, correctness first): SHIP at 97fe72c. No actionable correctness or security findings; both earlier fixes hold. |
|
Shipped in:
|
…s no peer #27018 made Hub::resolve answer a key under a configured peer's name with "no local session with the id …", which a peer connection could tell apart from the answer for a name that is no peer ("no session matches …"), so it learned this host's peers (peer_state_origin a_peer_connection_hears_nothing_of_a_down_peer_in_a_refusal). It also stopped cmux-tui-core's prompt withdraw from reading the answer as no session here. The refusal is not_found with the resolver's usual wording again; the route rule of #27018 is unchanged.
…s no peer #27018 made Hub::resolve answer a key under a configured peer's name with "no local session with the id …", which a peer connection could tell apart from the answer for a name that is no peer ("no session matches …"), so it learned this host's peers (peer_state_origin a_peer_connection_hears_nothing_of_a_down_peer_in_a_refusal). It also stopped cmux-tui-core's prompt withdraw from reading the answer as no session here. The refusal is not_found with the resolver's usual wording again; the route rule of #27018 is unchanged.
…s no peer #27018 made Hub::resolve answer a key under a configured peer's name with "no local session with the id …", which a peer connection could tell apart from the answer for a name that is no peer ("no session matches …"), so it learned this host's peers (peer_state_origin a_peer_connection_hears_nothing_of_a_down_peer_in_a_refusal). It also stopped cmux-tui-core's prompt withdraw from reading the answer as no session here. The refusal is not_found with the resolver's usual wording again; the route rule of #27018 is unchanged.
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light-3x.png)
Session lifecycle commands could discard the owning peer after resolving a target or select a local session when a peer shared its name. Resume, retry, cancel and stop now resolve one stable session ID, retain its peer route, and refuse ambiguous names with qualified candidates. Remote starts retain that route for initial prompts, follow-up reads, cleanup and group opening.
Requested behavior: "if we don't have good enough tooling in order to have things communicate, in order to start things, to resume things, to keep track of things, then we need to improve that."
TUI selection, incoming events, sorting and refreshes use the same peer-qualified identity. CLI send, quiet collection, plain attach, matching waits and live tail also preserve peer ownership when raw IDs collide. Target authorization and start-policy rules remain unchanged. RPC not-found codes preserve mesh-send fallback without treating ambiguity or internal failures as missing sessions.
Head:
97fe72c9ec3734e4f39183796bda53967d4e3092, rebased onto9d8337eb4f9d93e9c061be1a208ca9bd5e288d3cafter #27284. The phone-table regeneration is removed from this diff. The eight-line API compatibility surface update is official generator output for the base schema's optionalnew-pane-right.sideenum. No schema or authorization implementation changes are included.No capture: this is a CLI/TUI routing correction and compatibility snapshot update, with no native/web UI layout or styling change. Headless TUI tests exercise peer identity collisions.
Validation at this head:
123327754439failed duringBuild package and tests, before tests and generated-output checks ran. Dependent generated-files job123330548821consequently has no verdict. Its exact compiler error isBrowserEntryRetirementTests.swift:43:57: returning main actor-isolated '$0.some.chrome.some' as a 'sending' result risks causing data raceson Xcode 26.6. The file is unchanged by this PR and came from base PR fix(next): retire browser pages before chrome teardown #27166. The same package/test build at base9d8337eb4f9d93e9c061be1a208ca9bd5e288d3creproduced the identical diagnostic 25 times on Xcode 26.6: fleetcmux-cistepac19bf2e04980ab5cd83a81e, exit 1. This matches the PR job line for line. The repair is tracked in test(next): BrowserEntryRetirementTests compiles again (base red from #27166) #27301. This PR changes no Swift orPackages/files, so the base compile failure hides no signal for its acpmux surface; the focused acpmux checks and Release compile pass independently. The dependent generated-files failure is solely a consequence of this base compile failure.1218d5af5a814f10819725d7cefe7aa2, proves identical head/base failure inDigestTests.test_the_repository_highlights_validateattest_digest.py:89(invalid repository highlight entries). This explains the release-notary and dependent Guard status failures.123327658683. Generated-files guard job123327435937, generated-drift job123327832713, and API compatibility job123327434882also pass.0cf6aaaf1ffb46a1b526c7f3de2c8857. The receipt confirms this exact head and treedfa52bb8506dfcc9009ffa15e4c802ed9f54c7c0, exit 0. It ran API compatibility, Clippy with--all-targets -- -D warnings, and focused TUI, resolver, RPC fallback, peer lifecycle, remote groups/start policy, resume/retry, steering, CLI ergonomics and relay CLI tests.cc303897f12f43f0aa486f7129abab57, passes. It reverses the full PR diff and verifies base tree8be7a87f293d1bd7a69ca35bac52e2d24609a174before running the same checks. Identical diagnostics and exit codes are asserted for each failure:test_ir.IrTests.test_live_raw_v12_layout_and_history_contracts_are_exact, subtestcommand='new-pane-right', attest_ir.py:384; the stale phone-field table; and the existing SwiftUI imports inHomeChatColorsPanel.swiftandHomeChatColorsView.swift.97fe72c9ec3734e4f39183796bda53967d4e3092; no actionable correctness or security findings. Both earlier review fixes hold.Regression evidence (tests added before the corresponding fixes):
49f75cf5556e4d718c75270ef5d0d39f67d49d0150934dedbf0506824fce2a4769beb03c1a834d48a73757bfc8ffee993db7d4e1e9bd408cbf51eb003bef69028cade2657d55473aaf221bb886599a4abae75089ce694ee0bd592f4814ed15d7All corresponding regressions passed at the pre-rebase head in run 40835689741, job
32efb93f0c0c4bc19d75737e23f7f4ee. The final-head validation above repeats them after rebase.Risk: duplicate names require a qualified target. Live peer routing requires the updated daemon's owner metadata. The approximately 1,160 changed lines stay together as one routing change with end-to-end coverage for starts, prompts, held queues, cancel/stop/retry, ambiguity, ID collisions, groups and TUI/CLI consumers.
The overlap tool could not read open PRs because its GraphQL invocation is unsupported by the broker. Earlier manual searches found no matching fix; related remote-start #26998 and policy-change #26987 touched different files. Relay control remains separate work using the shared relay client now on base.
Agent session: agent session