Skip to content

ci(cmux-tui): owned minis skip the Go and branch Rust caches that never restore - #27840

Merged
teamleaderleo merged 2 commits into
feat-cmux-nextfrom
ci/cmux-tui-owned-mini-caches
Oct 30, 2026
Merged

teamleaderleo merged 2 commits into
feat-cmux-nextfrom
ci/cmux-tui-owned-mini-caches

Conversation

@teamleaderleo

@teamleaderleo teamleaderleo commented Oct 30, 2026 •

Copy link
Copy Markdown
Collaborator

On owned Mac minis, the cmux-tui macOS job (macOS lint and tests) now runs setup-go without the Actions cache. It also saves the cargo cache only from feat-cmux-next. Blacksmith VMs start empty, so they keep both caches as before.

Why (measured)

I sampled the 8 macOS lint and tests jobs on owned minis from 2026-10-29 14:30Z to 22:30Z, after setup-go landed in 5889445. The raw step timings and log excerpts are saved in the lane's scratch dir.

  • setup-go restored 0 of 8 times. In 6 jobs it downloaded the ~590 MB entry (about 63 s mean, up to 128 s) and then failed to untar it. The mini keeps its own ~/go/pkg/mod, which Go makes read-only, so tar fails with Can't unlink already-existing object: Permission denied and then Failed to restore. Each job then tried to save the entry again: 48 s mean, ending in Unable to reserve cache ... another job may be creating this cache.
  • rust-cache restored 0 of 8 times (No cache found.). Its key carries a hash of each mini's Rust environment, so minis produce different keys (ae76135b, b2523b1e, baf93c3c, ...). A branch dispatch can only read that branch's entries and the default branch's. Each branch save still took about 155 s (median 175 s).
  • These saves fill the repository's GitHub cache store. At 2026-10-30 01:30Z it held 9.79 GB of its 10 GB: 6.80 GB under v0-rust-cmux-tui-macos-* and 2.87 GB under setup-go-macOS-*. 7.69 GB of that was on branch refs that no other run reads. The store evicts by least-recent use, so these entries push out the shared ones, such as ghostty-zig-packages. Only runners outside Blacksmith write this store; Blacksmith runners use Blacksmith's own store.

Changes

  • .github/workflows/cmux-tui.yml (macos job):
    • setup-go sets cache: ${{ !contains(runner.name, '-glaeda') }}.
    • rust-cache sets save-if: ${{ !contains(runner.name, '-glaeda') || github.ref == 'refs/heads/feat-cmux-next' }}.
    • contains(runner.name, '-glaeda') is the repo's existing test for an owned mini; 12 other steps use it.
  • tests/test_cmux_tui_owned_mini_caches.py pins both conditions. It is registered in tests/test-execution.toml (linux-guard) and run from ci-guards.yml.

Performance

Per owned-mini macOS lint and tests job. "Before" is the 8-job sample from 2026-10-29, at base 5889445 and later. "After" is a dispatch of this head on this branch.

metric before after delta harness or run link
setup-go step 62.5 s mean (0/8 restored) AFTER_GO AFTER_GO_DELTA before: jobs 123671398605, 123684093131, 123664698315, 123684118038, 123732090143, 123772035002, 123660185485, 123653593592; after: AFTER_RUN
post setup-go (save attempt) 47.8 s mean AFTER_POSTGO AFTER_POSTGO_DELTA same
post rust-cache on a branch (save) 155.5 s mean (0/8 restored) AFTER_POSTRUST AFTER_POSTRUST_DELTA same
GitHub cache store written per branch dispatch 0.6-0.9 GB rust + 0.6 GB go 0 GB -1.2 to -1.5 GB /actions/caches listing, 2026-10-30 01:30Z

Restore hit rate on owned minis is 0% before and after. The change removes time and store space spent on restores that never succeed; it does not add hits. feat-cmux-next still saves the cargo cache that branches read.

Risk

This is CI only, and touches only the macOS job of cmux-tui.yml. If an owned mini lacks Go's module cache, go build downloads the modules, as the fleet step cmux-tui-rust-check.sh already does. Blacksmith macOS runs keep both caches unchanged.

Verification

  • python3 tests/test_cmux_tui_owned_mini_caches.py: OK.
  • python3 tests/test_ci_rust_cache_keeps_runner_bin.py: ok (25 steps).
  • bash scripts/ci/tests/cmux-tui-rust-check.test.sh: ok.
  • actionlint on both changed workflows: clean.
  • tests/test_ci_test_execution_registry.py has 2 failures that fail the same way on base: test_verify_local_jobs_option_keeps_recipe_tests_live and test_cli_product_lane_selects_the_hook_spool_regression.

Part of cmuxterm-hq#5230 row "Blacksmith Actions cache ... cache inspection". The report half of that row is a separate PR into main, which adds an Actions cache section to the CI health report.

risk: normal (CI only)

🤖 Generated with Claude Code

Agent session: agent session


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.


Summary by cubic

Owned Mac minis in the cmux-tui macOS job now skip caches that never restore on them, saving job time and space in the repository's GitHub cache store.

  • On an owned mini, setup-go's cache failed to restore in 8 of 8 sampled jobs: the mini keeps its own read-only ~/go/pkg/mod, which tar can't overwrite, so each job still downloaded the ~590 MB entry (~63 s) and re-saved it (~48 s).
  • The cargo cache key hashes each mini's Rust environment, so branch dispatches never read those entries; each save took ~155 s and filled ~70% of the 10 GB store, evicting shared caches.
  • setup-go now sets cache: ${{ !contains(runner.name, '-glaeda') }}; rust-cache saves only from feat-cmux-next. Blacksmith VMs start empty and keep both caches.
  • Adds tests/test_cmux_tui_owned_mini_caches.py, registered in tests/test-execution.toml under the linux-guard lane, to pin both conditions.

Written for commit 9d9e4d6. Summary will update on new commits.

View guided diff Turn on auto-fix

@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

cmux status (one comment, edited in place; each line is updated by the job that owns it)

Review 9d9e4d6: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr27840 -f ref=ci/cmux-tui-owned-mini-caches -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: 3 commit(s) change the sidebar's drawing code without a Sidebar-Look: trailer or an entry in plans/cmux-next/sidebar-owner.md is not red on the base 1d98fce; do not merge until green; see lane-rules

@github-actions github-actions Bot added the risk:normal Risk tier (docs/ci/risk-tiers.md) label Oct 30, 2026
@blacksmith-sh

blacksmith-sh Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Found 9 test failures on Blacksmith runners:

Failures

Test View Logs
1 runner guard check(s) failed:/1 runner guard check(s) failed: View Logs
1 runner guard check(s) failed:/1 runner guard check(s) failed: View Logs
test_big_red (main.FleetRuleLints.test_big_red)/
test_big_red (main.FleetRuleLints.test_big_red)
View Logs
test_every_upload_is_short_lived_and_small_or_allowlisted (main.WorkflowTests.test_
every_upload_is_short_lived_and_small_or_allowlisted)/
test_every_upload_is_short_lived_and_small_or_allowlisted (main.WorkflowTests.test_
every_upload_is_short_lived_and_small_or_allowlisted)
View Logs
test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runner_label (main.Fo
rkRunnerRoutingTests.test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runn
er_label)/
test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runner_label (main.Fo
rkRunnerRoutingTests.test_fork_pull_requests_into_manaflow_ai_never_reach_an_owned_runn
er_label)
View Logs
test_nightly_keeps_a_margin_under_the_limit (main.WorkflowFileSizeTest.test_nightly
_keeps_a_margin_under_the_limit)/
test_nightly_keeps_a_margin_under_the_limit (main.WorkflowFileSizeTest.test_nightly
_keeps_a_margin_under_the_limit)
View Logs
test_the_allowlist_has_reasons_and_no_stale_entries (main.WorkflowTests.test_the_al
lowlist_has_reasons_and_no_stale_entries)/
test_the_allowlist_has_reasons_and_no_stale_entries (main.WorkflowTests.test_the_al
lowlist_has_reasons_and_no_stale_entries)
View Logs
workflow references a self-hosted mac fleet label or bare self-hosted runner in a runne
r-selection position./
workflow references a self-hosted mac fleet label or bare self-hosted runner in a runne
r-selection position.
View Logs
workflow references a self-hosted mac fleet label or bare self-hosted runner in a runne
r-selection position./
workflow references a self-hosted mac fleet label or bare self-hosted runner in a runne
r-selection position.
View Logs

Fix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

@teamleaderleo

Copy link
Copy Markdown
Collaborator Author

Review (codex gpt-6-astra high, next-review): SHIP at 6a03b09

No blocking findings.

cmux-bot[bot]
cmux-bot Bot previously approved these changes Oct 30, 2026

@cmux-bot cmux-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cmux-bot approves 6a03b09: an independent review passed this exact head (next-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

@teamleaderleo

Copy link
Copy Markdown
Collaborator Author

Owned by an agent session · session

…er restore

On owned Mac minis, the macOS job's setup-go cache never restored: untarring
it over the mini's own read-only ~/go/pkg/mod failed with Permission denied
(8 of 8 sampled jobs), after a ~63 s download and before another save attempt.
The rust-cache restored 0 of 8; its branch saves cost ~155 s each and filled
most of the 10 GB GitHub cache store, evicting other entries.

Owned minis now run setup-go without the Actions cache, and save the cargo
cache only from feat-cmux-next. Blacksmith VMs keep both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-a7306ef145c005ad24ab
@teamleaderleo
teamleaderleo force-pushed the ci/cmux-tui-owned-mini-caches branch from 6a03b09 to a386692 Compare October 30, 2026 10:12
@cmux-bot
cmux-bot Bot dismissed their stale review October 30, 2026 10:15

A newer verdict blocks a386692 (no independent SHIP at the head).

@teamleaderleo
teamleaderleo merged commit c142713 into feat-cmux-next Oct 30, 2026
144 of 153 checks passed
@teamleaderleo
teamleaderleo deleted the ci/cmux-tui-owned-mini-caches branch October 30, 2026 10:31
@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

teamleaderleo added a commit that referenced this pull request Oct 30, 2026
…y lane names

#27840 registered tests/test_cmux_tui_owned_mini_caches.py as lane
"linux-guard" but no ci-guards.yml step ran it, so the execution registry
validator fails every pull request into feat-cmux-next ("linux-guard lane is
not run by any workflow"). The release-notary group of ci-guards now runs it,
beside the other cmux-tui artifact guards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 43312b4)
teamleaderleo added a commit that referenced this pull request Oct 30, 2026
Review: this branch's base predates #27840, so tests/test_cmux_tui_owned_mini_caches.py
is not in the branch and the step only passed on the merge commit with the
base. The registry error it fixed is a base red (feat-cmux-next fails the same
way); its fix goes in its own PR from a branch that has the file.

This reverts commit c0c10bc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
teamleaderleo added a commit that referenced this pull request Oct 30, 2026
…#28426)

tooling-tests failed on feat-cmux-next with "tests/test_cmux_tui_owned_mini_caches.py:
linux-guard lane is not run by any workflow". #27840 registered the test as
linux-guard, then its second commit removed the ci-guards.yml step on purpose
(no new CI tests, Lawrence 2026-10-23), leaving the registry entry pointing at a
lane that never runs it. Register it as manual with a reason, like the other
no-new-CI-tests entries.


Agent-Session: https://cmux.com/deeplink/agent?id=aid-a4efd6c1314eb5a4fc3e

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
teamleaderleo added a commit that referenced this pull request Oct 30, 2026
…y lane names (#28434)

#27840 registered tests/test_cmux_tui_owned_mini_caches.py as lane
"linux-guard" but no ci-guards.yml step ran it, so the execution registry
validator fails every pull request into feat-cmux-next ("linux-guard lane is
not run by any workflow"). The release-notary group of ci-guards now runs it,
beside the other cmux-tui artifact guards.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
teamleaderleo added a commit that referenced this pull request Oct 30, 2026
…8283)

* ci(next): a tip daemon suite gives the base a daemon-test verdict

A feat-cmux-next push never runs daemon-test: its same-tree run has origin
push, and a dispatch's tree wait marker is superseded the moment the tip moves,
which in a landing burst is always before the tree publishes. So the base had
no "cmux-next daemon tests" verdict for hours, and base_red_excuse.py could
not compare any pull request's daemon red with it (#27692, #27868).

- cmux-next.yml takes tip_daemon_suite (main's tip suite dispatcher asks for
  it): path routing routes only the daemon tier, and the run is named
  `cmux-next tip daemon suite · <tested sha>` (same_tree_sha in same-tree mode).
- Its tree wait marker carries tip_suite=daemon. cmux_next_tree_notify.py
  starts it on the recorded sha after the tip moves (like the DEV daily) and
  passes tip_daemon_suite on, so the same-tree run keeps the name. Only a
  daemon-only dispatch on feat-cmux-next heads may carry it.
- base_red_excuse.py: when its window of the newest 100 base runs holds no
  verdict for swift test or daemon tests, it reads the base's newest tip suite
  runs of that job by name (at most 6 job lists).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci(guards): run test_cmux_tui_owned_mini_caches.py, which its registry lane names

#27840 registered tests/test_cmux_tui_owned_mini_caches.py as lane
"linux-guard" but no ci-guards.yml step ran it, so the execution registry
validator fails every pull request into feat-cmux-next ("linux-guard lane is
not run by any workflow"). The release-notary group of ci-guards now runs it,
beside the other cmux-tui artifact guards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 43312b4)

* fix(ci): the tree wait marker step reads TIP_DAEMON_SUITE with a default

test_a_dispatch_whose_tree_was_building_gets_its_daemon_tests_later runs the
marker step's script with its own env, which has no TIP_DAEMON_SUITE, and the
KeyError failed "Checks job structure" on #28283. The script reads it with
.get(), and the test now covers the tip daemon suite marker: tip_suite=daemon
only for a tip_daemon_suite dispatch on feat-cmux-next.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci(guards): drop the owned-mini-caches step from this PR

Review: this branch's base predates #27840, so tests/test_cmux_tui_owned_mini_caches.py
is not in the branch and the step only passed on the merge commit with the
base. The registry error it fixed is a base red (feat-cmux-next fails the same
way); its fix goes in its own PR from a branch that has the file.

This reverts commit c0c10bc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ci): the base dispatch fallback takes the newest verdict, green included

Review of #28283: the fallback read only tip suite runs, so a newer ordinary
dispatch that ran daemon-test (or swift-test) green was skipped and an older
red tip suite run excused the head. It now reads the base's completed
dispatches newest first and the first with a verdict for the job decides, a
green one included. DEV daily runs and the other job's tip suite never run the
job and are skipped unread; at most 6 job lists. Test: a newer green ordinary
dispatch over an older red tip suite refuses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
teamleaderleo added a commit that referenced this pull request Oct 31, 2026
…up (#28214)

* ci(cmux-tui): skip docs-only artifact publishes

Agent-Session: https://cmux.com/deeplink/agent?id=aid-55ad21df065d5bc316b2

* ios: New Message to one agent sends its images (#27877)

* test(ios): New Message to one agent forwards its images

Red first: routing a New Message / Forward to one agent sends only
the text, so images are dropped and an image-only message sends nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-e06379967aeecbaaded3

* fix(ios): New Message to one agent sends its images

New Message and Forward addressed to one agent sent only the text as
the agent's prompt: attached images were dropped, and an image-only
message sent nothing after the sheet closed. The images now go as the
prompt's image attachments, bytes and order kept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-e06379967aeecbaaded3

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* carry of #26682: fix(setup): report actionable harness authentication checks (#28187)

* test(setup): cover actionable harness auth reports

Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1

* fix(setup): expose actionable harness auth recovery

Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1

* docs(setup): clarify actionable verification failures

Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1

* fix(setup): preserve disabled profile check uncertainty

Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1

* test(setup): select custom profile among discovered harnesses

Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1

* fix(setup): an expired credential reports signed_out with the login recovery

Base added acpmux::harness_health::Auth::Expired; setup already routes it to
the login action, so its auth_status is signed_out (the match was
non-exhaustive and cmux-tui did not compile).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: leave superseded tool output out of a chat's open page (#27614)

* acpmux: leave superseded tool output out of open pages and sealed segments

codex-acp re-sends a running command's whole output as the content of
every tool_call_update, so a Codex chat's log grows with the square of
its output and its open page holds a few snapshots of one command.

A page a client bounds by bytes (maxBytes) now leaves out updates a
newer update of the same call in the scan makes moot, and drops moot
content from the rest. Each sealed segment of a live chat's log loses
the content a later update of the same call in it supersedes, on a
thread of its own; seq, deltas and each call's last content stay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: supersede only within a prompt; fence the sealed rename

Review findings on #27614:
- A call id names a call within one prompt: a user_message or
  turn_started between two updates keeps both, in pages and on disk.
  A read cut at a prompt (a fork through a turn) sees every call as logged.
- The copy goes in under the writers' lock a retention commit holds, and
  only over the very file it was read from (device, inode, length): a
  retention rewrite, a delete or a replacement is never overwritten.
- A segment that changed stops the pass without moving the marker.
- The copy is removed on any error, and a crash's copy by the next pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: keep this PR to the open page; sealed-segment compaction moves to a follow-up

Review found that rewriting sealed segments changes what a fork or export
pinned mid-prompt reads, so this PR now changes only pages read newest first
with a byte bound. A page of some kinds still resets at every prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: touch only output-only updates, and keep the oldest of each call a page reads

Review: dropping any covered update changed the fold where an update carries
more than output (input keys merge, subagent _meta, a diff a hidden call shows),
and the start time a page takes from the first update it reads. Now only an
update of status and text content is touched, and the oldest of each call a
page reads stays until an older record of the call makes it moot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: scope superseded calls by subagent owner, keep content:null, honour stubs

Review: a native subagent numbers its calls apart from its chat; an explicit
content null clears output; a record a page stubs carries no output. Each now
supersedes nothing it should not.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: fix superseded tests (clippy useless_vec, the clear test)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: a params _meta of any other shape is never plain

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* cmux NEXT: one machine link state for the sidebar and the agent pane; a down machine reconnects on use (#26786)

* feat(machines): one machine link state for the sidebar and the agent pane, reconnecting on use

The sidebar machine header draws a spinner while a machine connects or
reconnects and red when it is down; the agent pane gets the same word
(machineLink) for its composer strip; opening or sending to a chat on a
down machine reconnects it and goes on once its handshake finished.

Sidebar-Look: Leo 2026-10-28 "you just get a little green dot ... as if you were working on your own computer, but now it's remote"
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* test(sidebar): a still of the machine headers in each link state

Sidebar-Look: Leo 2026-10-28 "you just get a little green dot ... as if you were working on your own computer, but now it's remote"

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(machines): an optional update draws the connected dot; a cancelled send is not retried

Sidebar-Look: Leo 2026-10-28 "you just get a little green dot ... as if you were working on your own computer, but now it's remote"

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(agent-pane): a send cancelled while its machine reconnects stops waiting at once

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(agent-pane): a cancelled send reconnects nothing

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(agent-pane): a send cancelled during its machine's reconnect is not retried

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(agent-pane): the strip's machine and its Reconnect are the machine the tab's chat runs on

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(agent-pane): a released tab's page leaves the machine link; the last one ends its observation

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(agent-pane): name the settings JSONValue the page event carries

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6
(cherry picked from commit f354c6952a5a6f9521264472294d9f0880db35f1)

* test(agent-pane): the Observable fake machine is not private (its macro's extension needs it)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* feat(sidebar): remote machines follow acpmux's peer state pushes from the app's own daemon

The app's own acpmux watch now reads `_acpmux/peer_state_changed` and hands it to the remote
machines' sidebar: a listed peer's header goes up or down at once, a repeat changes nothing, and
an unknown or removed peer, or a reopened watch, reads `_acpmux/peers` again. A mirrored acpmux's
(the Chief home's) pushes are ignored, so only this Mac's own links show.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(sidebar): a peer list read that a push overtook is read again

A push that lands while `_acpmux/peers` is in flight (a separate socket, so its answer may be from
before the push) drops that answer and reads the list once more; pushes come only on a state
change, so a burst ends in one more read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* fix(sidebar): any peer push drops the list read it overtook, one that changes nothing shown too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6

* cmux NEXT machine link: a send stops waiting on a link that needs a person, and a failed socket or handshake reconnects too

Review findings at fbdd271: awaitLink waited the whole 45 s budget when the reconnect ended
stuck (a refused sign-in, a required update); it now ends at once. The retry wrapped only the
endpoint, so a socket or daemon handshake failing after the endpoint came back bypassed the
reconnect; the attach client now asks the machine link (AgentSessionAttachClient.Reconnect)
when any part of its connection fails, and tries once more.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-5b0be570f0b96d2d4c7b

* cmux NEXT machine link: the reconnect retry runs in the caller's task, and a failed first try ends no attachment

Review findings at 703d820: a first try whose handshake failed closed its transport, whose
onClose ended the page's attachment before the retry; and the reconnect wait ran in the shared
unstructured connect task, so a cancelled call kept waiting. The retry now wraps the shared
connection in the caller's task; a quiet first try tells its loss only when no retry follows
or the retry fails too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-5b0be570f0b96d2d4c7b

* Fix machine link event delivery and reconnect endpoint

Agent-Session: aid-b12e655d1a89af187c5a

* Pass empty scripts for machine link delivery

Agent-Session: https://cmux.com/deeplink/agent?id=aid-16e16f9e7a55152abe76

* Report quiet attach loss after endpoint failure

Agent-Session: https://cmux.com/deeplink/agent?id=aid-16e16f9e7a55152abe76

* Fix machine-link guard and lint findings

Agent-Session: https://cmux.com/deeplink/agent?id=aid-16e16f9e7a55152abe76

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: cmux-bot[bot] <348531757+cmux-bot[bot]@users.noreply.github.com>

* ci(cmux-tui): owned minis skip the Go and branch Rust caches that never restore (#27840)

* ci(cmux-tui): owned minis skip the Go and branch Rust caches that never restore

On owned Mac minis, the macOS job's setup-go cache never restored: untarring
it over the mini's own read-only ~/go/pkg/mod failed with Permission denied
(8 of 8 sampled jobs), after a ~63 s download and before another save attempt.
The rust-cache restored 0 of 8; its branch saves cost ~155 s each and filled
most of the 10 GB GitHub cache store, evicting other entries.

Owned minis now run setup-go without the Actions cache, and save the cargo
cache only from feat-cmux-next. Blacksmith VMs keep both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-a7306ef145c005ad24ab

* ci: keep cache regression out of guard workflow

Agent-Session: https://cmux.com/deeplink/agent?id=aid-4777d4f75452817a742b

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next tests: the test process's children start without SWIFT_BACKTRACE (#28122)

#25857 made the swift test wrapper export SWIFT_BACKTRACE=enable=yes,...
so a crash of the test process prints its stack. Every child inherited it:

- An exit test's child traps on purpose. With the variable set, it spawned
  the backtracer to symbolicate the whole test binary, and the parent sat in
  wait4 until the stuck-test watchdog ended the run (BlockingCheckTests
  .aCheckedFileManagerCallOnTheMainThreadTraps, #26809 run 40999753339
  shard 6, exit 143).
- A privileged tool writes "swift runtime: backtrace-on-crash is not
  supported for privileged executables." to stderr first. A test reading
  the child's stderr took that line for the answer: ChromiumRuntimeInstaller
  failed with unsafeEntry and then stalled 303 s (same run, shard 5), as the
  python bridges #27981 fixed one by one did.

The test bundle's load-time constructor now unsets the variable. The Swift
runtime read it when libswiftCore loaded, before the bundle, so the test
process keeps its own backtracer and no child gets one.


Agent-Session: https://cmux.com/deeplink/agent?id=aid-1288bbb2b5d2f5c6b66a

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* chore(next): base autofix at e0f33500c849

- cargo fmt in cmux-tui

Made again on e0f33500c849: it moved the inputs of a repair made at 941b7a4b133a.

scripts/cmux-next/base-autofix.sh: https://github.com/manaflow-ai/cmux/actions/runs/41038166183

Re-applied on 91e0204e3ada, which feat-cmux-next moved to after e0f33500c849.

* ci(cmux-tui artifacts): short Linux jobs take the shared 32/16 vCPU set (#28240)

* ci(cmux-tui artifacts): short Linux jobs take the shared 32/16 vCPU set

On 2026-10-30 every cmux-tui artifacts run on feat-cmux-next sat queued on
blacksmith-4vcpu-ubuntu-2404 (run 41007923202: tree preflight waited 4 min,
mark-tree-commits and point-feat-channel were still queued 15 min later), so
nightly-next promotion stalled behind the tree marker.

The 11 short Linux jobs now use the expression this workflow's publish jobs
already use: a non-Blacksmith LINUX_RUNNER pool, else Blacksmith 32 vCPU, or
16 vCPU while the overflow switch has failed over. A new guard test evaluates
every Linux runs-on of the workflow against each variable state.

* Test the hosted LINUX_RUNNER and the Darwin cross override

Codex review of #28240: the matrix lacked ubuntu-24.04, the value the overflow switch writes, and pinned LINUX_RUNNER_DARWIN_CROSS empty, so macos-cross-shadow's override was never exercised. Add both; a new test checks only that job reads the override.

* acpmux: a bare session name or id prefix reaches the one live session on any host; several are refused with each HOST/NAME command (#28000)

* acpmux: a bare name names the one live session on this host or a peer; several are refused with each HOST/NAME command

Every command that takes a session resolves a bare name or id prefix the same way, in the
daemon (hub/key_route.rs, applied on the unix socket before any check reads the key): the one
live session with that whole name (else id prefix) across this daemon and its peers. Closed
sessions count only when no live one matches. Several live matches are refused
(session_ambiguous, exit 2) with each choice, and the CLI prints the exact command for each.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux README: neutral host names in the ambiguity example

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux key_route: test hub is an Arc; the refusal list owns its strings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux: red/green request test, a name shared by a session here and a peer's is refused on info and send

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux key_route: a whole name and an id prefix are one tier; every choice in the data; keep's exact id is not routed; the argv swap skips an option's value (review of #28000)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux key_route: a sub-session's whole name (parent/child) is routed across hosts too (review of #28000)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux key_route tests: neutral sample host names (fleet rule lint)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

* acpmux key_route: poisoned locks are read, never unwrapped (crash ratchet)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* fix(l10n): fill the 8 cmux NEXT string-table keys missing languages (base red) (#28167)

"String tables (21 languages)" failed on feat-cmux-next with 112 style
errors against its warning cap of 100. The last 12 came from
action.agentPane.continueAfterError (9e836df43650), which shipped in 9 of
the 21 languages. Fill it and the seven older keys that made up the rest
of the debt, so the check reports 0 errors:

- ActionCatalog: action.agentPane.continueAfterError,
  action.palette.forkAgentConversation, action.palette.forkAgentConversationTo
- PaneCreation: paneCreation.allCommands
- Updater: updater.button.updateAvailable, updater.button.updateAvailableNamed
- CmuxHome: home.plan.title, home.plan.activeCount (all 20 languages)

Wording follows each table's neighbours (the Fork Conversation family,
Continue In…, Update Available, detail.plan). State is "translated" where
the key's other languages are, and "needs_review" in CmuxHome, as that
table's other machine translations are.


Agent-Session: https://cmux.com/deeplink/agent?id=aid-a98b158f6fd70b0eae26

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* ci(nightly): the remote-daemon build and attest jobs take the Linux runner set (#28209)

#25935 (85628c020a3) moved build-nightly-remote-daemon and
attest-nightly-remote-daemon off the Mac builder onto
blacksmith-4vcpu-ubuntu-2404. That label is outside the trusted runner set
of #27125 (9127e619f76, "Linux jobs take the runner set, not one small
Blacksmith label"), so tests/test_nightly_trusted_routing.py
test_every_linux_nightly_job_takes_a_runner_set_member is red on
feat-cmux-next (20 failures, both jobs) and nightly-guards / release-notary
is red on every feat PR.

Both jobs now use the runner-set expression of the other Linux nightly
jobs (16 vCPU when vars.LINUX_RUNNER names it, else 32). They stay off the
Macs, which was the goal of #25935.

tests/test_gh_budget_wait.py pinned the attest job to the 4 vCPU label;
that one assertion conflicts with the trusted-routing rule, so it now
checks that the job holds no Mac and takes the runner set. Its other
assertions are unchanged.

Test: python3 -I tests/test_nightly_trusted_routing.py (FAILED, failures=20
on 97133a48ad0; OK on this commit); python3 -I tests/test_gh_budget_wait.py
(OK on both).

* chore(next): base autofix at afe5e8ddc4c6

- regenerated web/data/cmux-shortcuts.generated.json
- regenerated schemas/defaults/cmux-next.json
- cargo fmt in cmux-tui

Made again on afe5e8ddc4c6: it moved the inputs of a repair made at 4e5fe0232da3.

scripts/cmux-next/base-autofix.sh: https://github.com/manaflow-ai/cmux/actions/runs/41040753079

* fix(inspector): hide unsupported chat environment save (#28238)

* test: reproduce silent environment save failure

Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f

* fix: surface failed Session Info environment saves

Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f

* style: format environment save fixtures

Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f

* test: assert actual gallery color scheme and reduced motion

Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f

* test: wait for Environment before checking gallery settings

Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f

* fix(inspector): hide unsupported chat environment save

Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e

* acpmux: a person's Stop of a chat on a peer holds the other agents' messages there (#28141)

* test(acpmux): a person's Stop of a peer's chat holds the agent messages there (red)

On base the peer takes the forwarded Stop as a plain cancel: no
queue_paused with reason stop on the peer, and the agent message runs.
A fake peer checks that only a peer listing personStop gets the field,
and that a non-person's Stop never carries it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-3918eb692ec76bbeec6e

* fix(acpmux): a person's Stop of a chat on a peer holds the agent messages there

The peer daemon's link is never the person on the peer, so a Stop for a
peer's chat was a plain cancel there: the stopped turn ended and the
next agent message started a turn at once. This daemon now forwards the
person's Stop with _meta.acpmux.personStop to a peer that lists the
personStop feature, and a peer takes it only from a peer daemon's own
link (PeerToken, held to the peer's rules, not via web or device) and
runs the same person_stop as for its own person. An older peer gets the
plain cancel. A client's own personStop field is dropped before the
forward.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-3918eb692ec76bbeec6e

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* docs(cmux-tui): agent-hooks: cmux-next has no ssh-tmux mirror (#27797)

The line said ssh-tmux mirrored workspaces get no agent badges from the
cmux-tui journal. A main sync had dropped the sentence #19104 added, so it
read as a cmux-next gap and sent two helpers after one that does not exist
(HQ#5226 row 3). cmux-next SSH machines run cmux-tui on the host with the
full CLAUDE_EVENTS set; the ssh-tmux mirror is classic-only and reports
badges through its own tmux subscription.


Agent-Session: https://cmux.com/deeplink/agent?id=aid-c689cdaab52479676c52

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* fix(webviews): dispose page subscriptions after their store stops (#27861)

* fix(webviews): scope page store subscriptions to their lifetime

Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e

* style(webviews): format store lifetime regression tests

Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e

* fix(webviews): guard auxiliary store continuations

Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e

* fix(webviews): fence stale app continuations

Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e

* fix(webviews): stop stale app reload continuations

Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e

* Agent pane: answered question and checklist as Claude desktop cards (#27938)

* feat(agent-pane): answered question and checklist as Claude desktop cards

An answered question now collapses to a compact bordered card in the
transcript: each question, the chosen answers (Other text included) in grey
under it, then who answered. An ask that ended unanswered is the same card with
Skipped, Stopped before an answer or Not answered in the answer's place. The
todo list keeps its bordered card, spinner, dashed and check marks.

QuestionCard and PlanList are memoized on their immutable inputs; a new test
counts their commits while 200 tokens stream in the same turn.

Gallery: answered looks (stacked shipped, inline, check), ended looks (card
shipped, pill, rule), and a todo list looks entry (card shipped, borderless,
count).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* fix(agent-pane): answered card spacing from the design tokens

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* test(agent-pane): cards re-created per token, as the transcript does; lower the type-scale baseline

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* test(agent-pane): count the cards' own renders, not a re-created Profiler's commits

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* test(agent-pane): mark the module mock's promise as handled

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* fix(agent-pane): one reply handler per live ask, so the memoized question card skips pane updates

Review (Astra) of 0dd7e865: App.tsx made replyToQuestion(permission) anew each render, so the
pending card's memo never held.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* test(agent-pane): mount the live ask's card wrapper in the render-count test

The live question card's reply handler moves into PermissionQuestion, which
App.tsx's PermissionAsk renders; the test mounts that wrapper with one
permission across 200 tokens, so dropping its useMemo fails the test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: a peer link hears no change of a row mirrored from another peer (#28152)

* test(acpmux): a peer link hears no change of a row mirrored from another peer

Red on base: every change of a mirrored row goes out on every peer link,
which drops it (peer.rs), so with 25 peers each change went out 24 times.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

* acpmux: a peer link hears no change of a row mirrored from another peer

Every change of a row this daemon mirrors from a peer went out as
_acpmux/session_changed on every other peer's link too, where the link
drops it (peer.rs: a mirrored row or a notice naming a peer). With 25
peers that was 24 copies of each change, tools included. A link now
hears only this daemon's own rows' changes, as its watch list since
#28105 lists only them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

* acpmux: a link still hears a peer's pending prompt; only session_changed is skipped

Review of 8f1a1fdc: the link check returned before the peer permission
branch, and a link is any client named acpmux-peer, so a unix-socket
watcher with that name lost a peer's _acpmux/permission_pending. The check
now guards only the session_changed send; the permission branch is as on
base.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: briefs asks the peers at once and names each one left out (#28172)

* test(acpmux): briefs asks the peers at once and names each one left out

Red on base: the peers are asked one by one with the 600 s request budget
each, so a stalled peer holds the list for ten minutes, and a refusing
peer is left out with no word of why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

* acpmux: briefs asks the peers at once and names each one left out

_acpmux/briefs asked every connected peer for its briefs one by one, each
with the 600 s request budget, and left out a peer whose answer failed
with no word of why: one stalled peer held the list for ten minutes. The
peers are now asked at once under one 10 s deadline (as _acpmux/models
does), and each peer left out is named with its error in peersFailed,
logged at warn and printed by acpmux briefs ls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* test(cmux-tui): a lost terminal's end finds its pages read ahead (red)

Lawrence 2026-10-30: after a reboot the daemon's adoption records every
lost terminal's end before it answers anyone: 750-821 ms for 462
terminals on a clone of a 41.6 GB registry, 60% of it cold page reads.
Each end appends journal subjects (terminal, tab, pane, screen,
workspace) to journal_subject_index_by_subject_sequence, keyed by random
public ids, and a terminal event keyed by terminal id, so each insert
lands on a leaf nothing read earlier.

startup_prefetch_covers_every_page_a_terminal_end_writes: every page key
an end writes is one the startup reads ahead. terminal_end_prefetch_keys
is a stub that reads nothing, as the startup does now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* perf(cmux-tui): the startup reads a lost terminal's end pages ahead

Root cause (Lawrence 2026-10-30): after a reboot every terminal host is
gone, and the adoption records each terminal's end before the daemon
answers: on a clone of a 41.6 GB registry with 462 lost terminals that
was 750-821 ms, and 60% of it was cold page reads. Each end appends
journal subjects (terminal, tab, pane, screen, workspace) to
journal_subject_index_by_subject_sequence (8.4 GB, keyed by random public
ids) and a terminal event keyed by terminal id; 2,244 serial reads of
leaves nothing had read yet (313 ms cold, 12 ms warm, measured alone).

A background thread starts right after the registry opens and reads
those leaves on 8 read-only connections of its own while the restore
runs (terminal_end_prefetch.rs): the keys are every terminal that is
neither exited nor tombstoned, since which hosts are gone is known only
during adoption. It writes nothing and takes no registry lock; it only
puts pages in the OS page cache, and its errors are dropped. When every
host is alive the reads are wasted: a few thousand small reads on a
background thread.

Clone of the 41.6 GB registry, same Mac, release build, 462 lost
terminals, 6 runs each: terminal.adopt_hosts 750-821 -> 410-425 ms;
daemon start 2,401-2,638 -> 2,103-2,186 ms; first sidebar.get
2,484-2,759 -> 2,183-2,270 ms (one run 3,683, an exec stall outside the
daemon's own timing). sidebar.get p50 about 5 ms either way.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: new and ensure keep a predecessor's harness, or say why not (#28016)

* test(acpmux): a successor keeps its predecessor's harness (red)

Part of HQ#5266. Red/green tests for acpmux new naming a predecessor:
a bare default start where the predecessor ran a named profile is
refused, a different harness is warned with the flag that keeps it,
--harness-from copies it, and nothing names a predecessor: no warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf

* feat(acpmux): new and ensure keep a predecessor's harness, or say why not

Part of HQ#5266 (item 3). Leo, 2026-10-30: "that visibility into
huge-blue guys was (and is?) pretty bad". The deputies relaunched with
only area and role tags came back on the bare default harness, without
their profile's autocompact cap.

A session/new from the command line names a predecessor by
--harness-from, a succeeds= tag, --report-to or its starter of the same
name family, a NAME-N name, or an area= tag (one pass over the session
index; no transcript read). A start with no -m or -p that lands on the
default where the predecessor ran a named profile is refused; a start
whose profile, launcher, model, effort or autocompact cap differs gets a
one-line warning naming both and --harness-from. --harness-from copies
the predecessor's profile, preset, model and effort.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf

* fix(acpmux): a successor's check reads the session index once and copies Ultracode

Review of #28016 (Sol): --harness-from copies Claude's Ultracode effort,
the launcher compared is the one the session last started with, a copy
that still differs says so, ensure --host --harness-from is refused up
front, and the predecessor is found in one pass over the index.
--report-to keeps the name-family rule the brief asks for (a helper's
coordinator is not its predecessor), now with a test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf

* fix(acpmux): --harness-from is refused wherever it would not be honoured

Re-review of #28016 (Sol): a session/new with harnessFrom over the app's
or a web connection, or on an ephemeral run or an adopt, was started as
an ordinary session and the copy silently dropped. It is refused now,
over every connection but the local socket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* feat(next): scroll the session rail independently (#26520)

* feat(next): grow the session rail height

Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6

* feat(next): let the session rail scroll independently

Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6

* fix(next): wait for rail overflow in height gallery

Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6

* fix(next): align rail hit testing with visible ticks

Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6

* Rail wheel: the rail owns it only while it scrolls; browsing is per session

The transcript reader listener captures on the scroller, an ancestor of the
rail, so a stopPropagation on the list ran too late: an upward wheel over an
overflowing rail released the transcript follow. The reader now skips a wheel
over a rail list marked data-rail-scrolls (railWheel.ts).

A rail that fits its prompts is no scroll container again (overflow hidden),
so the wheel over it reaches the transcript. The browsing latch remembers its
session, so a reused transcript showing another chat follows its reader.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Rail wheel test: wrap a line past the print width

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Rail wheel: a jump landing correction goes on under a rail wheel

settleScroll ends on any reader input captured on the window, which runs
before the rail can stop the event, so a wheel over an overflowing rail
cancelled a clicked tick landing mid-correction. It now skips a wheel the
rail owns (railOwnsWheel), as the transcript reader does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Scrollbar guard: the rail list may hide its own scrollbar

The session rail spec keeps the overflowing rail list free of any visible
scrollbar. Allow the two hiding rules in threadMinimap.css only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: a subagent pane draws its chat from the kept tail (#28235)

showSubagent asks the app for a subagent pane, which is a new tab on the
chat's own session, but never handed the chat over first the way openOwnTab
and onMoveToTab do before chat.openTab. The pane opened blank and waited on
its own attach. Hand the chat over first, and hold the call site in the
source-reading wiring test.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* chat-open bench: a timed-out or errored open never counts as a time (#28255)

valid() looked only at whether first_content_ms and longest_empty_ms are
numbers, so a trace that timed out but still carried them went into the
medians. Reject timed-out and errored records first.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* ci(cmux-tui): the attestation waits out a rate limit until GitHub answers again (#28269)

Owner run 41017791425 (2026-10-30) built tree 13939dda, then lost it in
"publish to R2": actions/attest-build-provenance was refused "API rate
limit exceeded for installation" at 07:14, 07:15, 07:17 and 07:21. The
backoffs between the four tries waited a fixed 60, 120 and 240 s
(gh_budget_wait.sh --backoff), the limit still held at the last try, and
the job failed with the tree unpublished, so the NEXT nightly kept
promoting an older commit.

gh_budget_wait.sh gets --backoff-probe TRY PROBE: the action hides the
refused response, so it reads PROBE (a read of the attestations API with
the same token) and, while GitHub refuses it for the rate limit (429, or
403 with x-ratelimit-remaining: 0, Retry-After or a message naming the
limit), waits for the reset that refusal names (Retry-After, else
x-ratelimit-reset, else the secondary-limit backoff) and reads again. The
next try runs once GitHub answers. A probe answered at once (200, 404, a
permission 403, a 5xx) waits as --backoff did. Every wait counts against
the job's ledger; the publish passes now allow 50 minutes (was 15), inside
their 75-minute timeout with the 15 minutes of work. The last try still
must pass, so nothing ships without provenance, and a real attestation
failure still fails the publish.

Tests: test_gh_budget_wait.py drives --backoff-probe against a fake gh
(the reset a refusal names, a limit that holds for three looks, Retry-After
and 429, the secondary-limit schedule, a probe answered at once, the job
total); test_cmux_tui_publish_retries.py checks the publish passes wire it.
Both fail against the previous script and workflow.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* New Tab: project and machine head the composer, menus open away from the chat, and Cloud picks wait for the machine (#27956)

* feat(composer): project and machine head the composer; menus open away from the chat

Leo 2026-10-29: "project and cloudness at the top. make them open away from teh chat, which is
obviously up if it is up, down if it is down. and stop making them take up so much space."

- New Tab heads its box with the folder and machine in every look (no longer in the quiet row).
- Location menus open on the side away from the conversation, read from the composer position,
  and slide along that side to stay in the window instead of flipping onto the chat.
- One compact strip: 24 px, 4 px between content-sized pills.
- Cloud machines: a pick on a paused or unlinked machine waits for it and moves the chat there
  once ready; resume reads Starting at once; failed reads Couldn t start; New Cloud Machine says
  what one gives in the plain menu.
- design/composer-menus.md records the placement rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(composer-menus): New Tab placement only; the agent chat keeps its row

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Gallery cover names the component; onboarding test matches the cloud row by prefix

The New Cloud Machine row now carries its description, so its accessible
name starts with the label rather than equalling it. A gallery cover
names a component, so the hook cover goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* New Tab headline play reads the computer pill above the box

The computer pill moved from the quiet row to the strip above the box,
beside the folder pill, so a project name of another width moves it
sideways; the play now holds only its row and size.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Cloud pick wait ends on a failed start and on any chat change

A refused resume or open now marks the machine failed instead of
leaving it at its old stage, and a pick waiting on a machine that
failed reads Couldn't start and stops waiting to move the chat. A
chat change drops the wait for good, so a chat that returns to the
same key (an empty New Tab id) never inherits another chat's pick.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Cloud pick wait ends for good when the account stops listing the machine

Before, the stored pick survived a list without the machine, so the
machine coming back with a ready peer could still move the chat.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* fix(acpmux): send's examples go in help_examples, not its own after-help (base red) (#28301)

#28000 gave `acpmux send` an after-help with its own Examples:, while
#28013 (landed before it) moved every command's examples into
cli/help_examples and refuses a listed command that also has its own:
help_examples::tests::every_example_entry_names_a_visible_command_once
fails on feat-cmux-next since #28000 ("send": its after-help has its own
Examples:). #28000's three examples (the one live name, HOST/NAME, an id
prefix) move into the send entry; its after-help keeps the refusal note.

Test: cargo test -p acpmux --lib help_examples (5 pass; red on base).


Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: start other MCP servers (cmux-cua) on first call, not to list them (#27976)

* cmux mcp serve: list other servers' tools from a stored list; start them on first call

A harness lists its MCP servers' tools as it starts (Codex once per thread),
and `cmux mcp serve` started every upstream (cmux-cua among them) to answer
that list. So every chat ran a cmux-cua helper whether or not it ever used
computer use: 93 to 131 idle helpers on cosmic-gray on 2026-10-29.

The list an upstream gives at its start is now stored in
~/.cache/cmux/mcp-upstreams (0700, files 0600, written whole), keyed by the
server's command, args, env names (not values), the command's size and
mtime, and cmux's version. tools/list answers from it without starting the
server; the first tools/call starts it, relists and stores again. With no
stored list, or a torn one, the server starts to be listed as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: check a call against the started server list; keep stored lists private and per program

Review (codex gpt-6-astra): a stored tool the server dropped is refused as
not run before it is sent; entries are read only from a folder and file the
user owns that others cannot write (no symlinks); the key names the program
PATH resolves the command to; a list is stored only under the key the
command had before its server started.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: rustfmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: clippy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: key a stored list by the executable the server runs on its own PATH

Review (codex gpt-6-astra): resolve skipped neither non-executable files nor
the server env PATH that Command uses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: a stored list keys the script an interpreter runs; a path nobody may run has no key

Review (codex gpt-6-astra) round 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: tests run an executable server and keep their script

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp: key a bare relative script arg too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux mcp serve: fmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* cmux NEXT MCP: tool evals on real Claude/Codex harnesses, and code mode takes the script shapes models write (#28085)

* tool-evals: replay real Claude Code turns against real cmux MCP, CLI and a headless daemon (t3code mcp-tool-use shape)

* tool-evals: stand-in app replays the real app's action catalogue (823 tools, as in the app)

* cmux docs: a sentence query finds the tool that matches most of its words; stop words ignored; daemon tool ranks before its app_ twin

* test: cmux mcp serve resolves current to the caller's pane in a session no app owns (red)

* cmux mcp: current resolves from the daemon when no app owns the session, as the CLI does

* tool-evals: stand-in app answers beside; tab-not-split and run-without-empty-shell cases

* tool-evals: 20 cases mined from real transcripts; docs ranking test names the daemon tool first

* cmux mcp: with no app, a terminal with no place goes beside the chat (daemon neighbor); decimal fields take numbers; tool-evals Edit/Write

* cmux mcp code mode: short rules in instructions (fits the 2048-char cut), common-tool sheet and result shapes in cmux_exec; compact docs answers; did-you-mean on unknown tool

* test: compact docs answers and did-you-mean for an unknown tool in a script

* cmux mcp code mode: tool sheet names the arguments of rename, grouping, status and notification (tool-evals: three regressions back to pass); harness setup settles before the agent looks

* tool-evals: round 1 results (Sonnet and Opus, code mode); model retry on a dropped gateway connection

* cmux mcp: review fixes: no-app fallback only places terminals (open_url stays on the daemon); text says terminal takes no current; compact only cmux's own tools and keeps required args; decimal schema stays a string, whole floats taken; empty query lists families

* cmux docs: a tool's own name ranks first; caller terminal comes through the backend so the no-app open_url test fails without its guard; focus wording matches tab_focus

* tool-evals: generic harness (OpenCode-like prompt, cmux tools listed directly) and an OpenRouter adapter, so any model runs

* tool-evals: a failed session open stops its daemon (an overloaded panel leaked 1,115); OpenRouter fails fast on 4xx and a missing key

* tool-evals: hybrid surface (cmux_exec plus the 21 common tools listed directly)

* tool-evals: run on Linux (the rbx builder) without sandbox-exec

* tool-evals: rbx panel scripts and cross-model comparison

* cmux mcp code mode: tool calls return Promises (.catch works), a script written as one function runs, a missing selector and a timer name their fix, and the sheet runs commands in a shell tab that stays open (11-model panel)

* tool-evals: real claude and codex CLIs as harnesses (claude-cli:<model>, codex-cli:<model>), each in a clean agent home with cmux MCP behind a logging relay

* tool-evals: Claude through the Agent SDK and Codex through app-server (no TUI per run), each with a clean home and cmux MCP behind a logging relay

* tool-evals: Claude Agent SDK runs the installed Claude Code (the bundled 2.1.81 got a 400 for Opus 5.5); an API Error result is an agent error

* test(tool-evals): eval agents cannot open pages or reach the person's cmux (red)

The sign-in-link-in-cmux case asks a model to open a link; models that ran
`open https://example.com/device?code=ABCD-1234` opened it in the person's
default browser (Helium) 11 times on 2026-10-28. The Claude Code and Codex
samples run with no sandbox, and the shell sandbox allows /usr/bin/open.

Moves the shell profile into live-guard.mjs unchanged and adds probes for
open, osascript and the person's cmux app sockets in both profiles.

* fix(tool-evals): eval agents run sandboxed off the person's browser and cmux app

Claude Code and Codex samples now run under sandbox-exec with agentProfile,
and the API runner's shell profile gets the same guards: /usr/bin/open and
osascript cannot run, LaunchServices open is denied, and the person's cmux
app sockets (~/.local/state/cmux, /tmp/cmux*.sock, $TMPDIR/cmux*/) are
unreachable. A model that runs `open <url>` in sign-in-link-in-cmux now
fails inside its sample instead of opening a Helium tab or a cmux tab.

bun test tests/tool-evals/live-guard.test.mjs: 10/10 (3/10 before).

* tool-evals: a sample waits while the Mac's PTYs are near the cap (the person's cmux shares it)

* tool-evals: --remote-daemon runs each sample's daemon and MCP server on another host over ssh (this Mac's PTYs stay free); rbx panel takes a binary and drops gpt-oss-120b for GLM 5.3 Prime

* tool-evals: agents run in a sandbox that hides this machine's skills and other samples' results (Codex read an old cmux skill and searched past results)

* tool-evals: sign-in-link-in-cmux is an app-tier case (headless has no cmux browser); --tier selects

* cmux mcp code mode: a script reads a change's new ids from the top of its answer too, and a terminal by its tab (head panel: 39 'needs terminal' errors across models)

* cmux mcp: a terminal named by its tab resolves to that tab's terminal id (the daemon's current needs a pane, so the earlier shortcut failed its own test)

* cmux mcp: review fixes: a tab names its terminal only where a terminal is required (terminal_list keeps its tab filter), in the tab's session and scope; a script that only starts like a function runs as written, and a wrapped one gets cmux

* cmux mcp code mode: function-form scripts detected from the text alone (no eval probe, which could run script code), arrow forms wrapped again; tool-evals guard allows the resolved sample path (Codex could not read its home)

* tool-evals: the remote MCP settings file is written and read back before the server starts (15 h4 samples got 'MCP server is off' and fell back to the shell)

* cmux mcp code mode: a script that calls its own function returns that function's value; drop a test case that could not fail

* cmux mcp code mode: a self-calling function script returns its value even when its body returns (the guard looked for 'return' anywhere)

* tool-evals: the guard lets an agent list the directories above its own sample (Codex canonicalizes CODEX_HOME and stalled at start)

* tool-evals: a sample that never reached the model (429, exhausted accounts, dropped stream) is retried; --rerun-errors runs again only an earlier run's agent/harness failures

* cmux mcp code mode: the tool sheet names pane_neighbor_get (the pane on the person's right) and terminal_process_get (Opus looked for a layout tool); stand-in app focus names the tab

* cmux mcp: a record a tool returned works where its id goes (models pass pane_neighbor_get's {pane: {id}} to tab_list); the sheet shows that answer's shape

* cmux mcp code mode: the sheet says 'next to X' means a new tab in X's pane, and pane_split only when the person says split (6 of 9 OpenRouter models split the logs pane)

* tool-evals: workspace order is graded by the sidebar's personal placement order (workspace_place {index} moves a workspace there; the session index stays)

* tool-evals: round 2 results (12 models, real harnesses)

* cmux mcp: a record becomes its id only where an id goes (a selector or a resource-id field); a json field keeps its object (review: keybindings_set args, settings_set value)

* fix(cli): describe every cmux cloud verb in its help (#28252)

* fix(cli): describe every cmux cloud verb in its help

`cmux cloud --help` listed 54 verbs as bare names in two misaligned columns,
with no descriptions, examples or mention of --confirm, and
`cmux cloud <verb> --help` printed the same list again. The help is now
grouped (machines, run and connect, files, snapshots, ports, network, chats,
account), opens with a quick start (list, new, exec, pause, resume, kill),
gives each verb one line in English and Japanese, and marks the verbs that
need --confirm. `cmux cloud <verb> --help` prints that verb's usage and
description and names `cmux action describe` for the full argument list.
`cmux help cloud` now follows the locale too.

The verbs live in one table (cli/cloud_help.rs) whose rows are rendered in
one column; a test fails when it differs from the catalog's offered cloud
verbs, and the cloud exec parse error reuses the table's usage line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb75b7af9902231028aa

* fix(cli): cloud help flags match the catalog; say which verbs take no target

Review findings: new-machine gains --repo, --bootstrap and
--bootstrap-script, open-desktop --viewer, deliver-secrets --names;
apply-machine-config loses a --repo it does not take. The intro says an
action on one machine needs --target, since new-machine, start-session
--name and move do not. A test now pins which verbs take no target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb75b7af9902231028aa

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* ci(ios): add unsigned Release simulator compile route (#27642)

* test(ci): cover compile-only iOS Release simulator route

Behavioral tool-double coverage; fleet execution pending publication.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb41776d46de72ff2a6a

* ci(ios): add unsigned Release simulator compile mode

Add release-build with no injected DEBUG/demo conditions and no simulator launch or publication; retain evidence on success and failure.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb41776d46de72ff2a6a

* test(ci): consume simulator inventory in runtime fixture

Drain the piped JSON before returning the fixture choice, matching the real selector and avoiding SIGPIPE in legacy-mode checks.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb41776d46de72ff2a6a

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ios): make recovery screens retry their failed loads (#27309)

* fix(ios): retry failed loads from recovery screens

Wire the shared recovery control to the workspace loader, terminal owner, stream opener, Feed refresh, Home refresh and conversation loader. Add behavioral loader tests and persistent demo capture states. Fleet compile and execution pending; this lane VM has no Swift compiler.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* test(ios): use anonymous recovery capture fixtures

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): keep terminal recovery controls inactive in tab cards

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): split terminal retry closure for compiler

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): validate recovery release highlight

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): await feed recovery and reopen failed channels

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): import feed recovery dependencies explicitly

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): fail closed feed channels before retrying

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): bound feed handshakes and release cancelled requests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): clear chat readiness after cancelled feed binding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): retain terminal failure recovery and parallelize feed retry

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): bound terminal feed reads during recovery

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): simplify concurrent recovery isolation capture

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): close failed initial terminal attachments

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): await Home reconnect before retry refresh

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

* fix(ios): stop cancelled Home retries

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: a chat's first frame waits on one daemon round trip (#27755)

* cmux-next: a chat's first frame waits on one daemon round trip

Opening a chat asked acpmux, one after another: initialize, _acpmux/status,
the chat list, the attach, then the turn opener, permissions and handoff.
Now everything after the handshake goes out together (status, the list, the
attach and its permission and handoff reads), and acpmux names the turn's
opener in the attach reply (`turnOpener`), so the first frame waits on the
handshake plus one round trip. An older acpmux leaves `turnOpener` out and
the pane reads it as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* acpmux: rustfmt the turn opener

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: hold a dropped early attach's live records until the chat attaches again

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: an early attach whose reply is of another session starts the chat over

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: name the early attach's held records apart from copyLive's

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: an early attach whose row changed after it streamed attaches again

Records the attach asked with the chat list streamed before the row changed may
be of the session before (recreated meanwhile), so the open attaches again. A
dropped early attach's held records are discarded by the next attach, whose page
holds them, instead of applied: some may be of another session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: the new-tab tail tests wait for the tail read the early attach goes out before

The attach now goes out with the chat list, so a held attach is asked before the
host tail is read and drawn; the tests let that read land before they look.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: no retry for an early attach whose row only changed status

An ordinary record is followed by its row change, so marking an early attach
suspect on any row change after a record retried normal streaming opens. The
cases it was for are peer chats, whose dropped early attach's records the next
attach now discards; a row that names another session is still caught by the
watch (strayedFrom) and the reply checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: the peer-copy daemon scripts the attach asked of the listed chat

The pane now asks its chat's attach with the chat list, before it knows the chat
runs on another machine, and drops that attach for a peer chat. The stand-in
daemon answered its once-only hooks (records during the attach, a recreation,
refusals) on that first attach; it now answers an attach asked before the list
as the machine is, and scripts the one the open asks of the chat as listed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: the peer-copy daemon tells an attach asked before the list by the list's answer

The pane sends the list and the early attach in one go, so the list is asked
before that attach; what marks it is that the list was not answered yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: a dropped early attach's refusal is handled; peer tests count the listed attaches

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: the peer-copy daemon answers an early attach of its local chat as before

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cmux-next: a dropped early attach is detached once it is in, not before

acpmux runs each request on its own task, so a detach sent while the attach was
still out could run first and leave its subscription behind.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Agent pane: copy button in an expanded card's top-right corner (#28057)

* feat(agent-pane): copy button in an expanded card's top-right corner

Leo: "wouldnt it be a little copy symbol on the top right within this card?"

One shared CardCopy (the transcript's CopyButton) at the top-right of every
expanded message or prompt card: a started sub-session's prompt, a wait's
reply, another agent's message. Faint at rest, full on the card's hover; the
highlight is the button's own box. Raw stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* fix(agent-pane): card copy panel contains its float; gallery tool without a non-null assertion

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* fix(agent-pane): card copy uses the layer and size tokens; gallery notes wrap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* fix(agent-pane): card copy gallery writes through a stand-in clipboard; spacing token

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* style(agent-pane): format the card copy gallery

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

* fix(agent-pane): card copy gallery presses the button after the panel settles

The matrix runner's pointer click landed while the panel's open motion
still moved the button, so the copied states never saw the check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* chore(next): base autofix at 569f9ea15f62

- vp fmt webviews/src/agent-session/acpmux/chatOpenTrips.test.ts
- vp fmt webviews/src/agent-session/acpmux/direct.ts
- vp fmt webviews/test/agent-pane-new-tab-cached-chat.test.ts
- vp fmt webviews/test/agent-pane-peer-copy.test.ts

scripts/cmux-next/base-autofix.sh: https://github.com/manaflow-ai/cmux/actions/runs/41050433356

* sidebar: a hover control stays lit while its menu is open, and lights alone (#27912)

* sidebar: a hover control stays lit while its menu is open, and lights alone

A workspace row's more, close and chevron followed isHovered alone, so they
vanished as the pointer moved onto the row's open more menu. SidebarRowMenu now
holds WorkspaceRowView.showsMenu for the synchronous popUp; the controls stay
and OverflowButton.showsMenu keeps the more button pressed (lit). The row's
fill does not change.

A workspace tile's more menu reused the profile control's showsMenu, which
paints the selected fill over the whole pill. The tile now holds its hover
controls and lights only its more button; the profile control, whose pill is
the control, keeps the selected step.

A group header's open editor painted the hover step over the whole bar and did
not light its trigger. The more button now stays lit whi…

This branch was previously deployed

1 inactive deployment
ci-routing-agent — 9d9e4d62 Deployed Oct 30, 2026 by teamleaderleo via wait for same-key tree publisher #82359
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk:normal Risk tier (docs/ci/risk-tiers.md)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant