acpmux: briefs asks the peers at once and names each one left out by teamleaderleo · Pull Request #28172 · manaflow-ai/cmux

teamleaderleo · 2026-10-30T08:38:25Z

_acpmux/briefs on the unix socket asks every connected peer for its briefs. It asked them one by one, each with the 600 s request budget, and left out a peer whose answer failed without saying so: one stalled peer held the whole list for ten minutes, and a peer that refused was simply missing. This is the same silent-wait class as the 2026-10-30 peer-handshake outage (#28105): an RPC error dropped (let Ok(..) else { continue }) while the caller waits on a timeout.

server/requests/briefs.rs list now asks the peers at once (join_all) under one 10 s deadline, as _acpmux/models already does (models_fanout.rs). Each peer left out is named with its error in peersFailed: [{peer, error}] (only when some peer was left out), logged at warn, and acpmux briefs ls prints left out PEER: ERROR on stderr. A request that misses the deadline is dropped, which takes its pending entry with it (ForgetPending); a late reply is ignored. The merge of remote rows and the peer-origin path are unchanged.

Performance

metric	before	after	delta	harness
`_acpmux/briefs` with one stalled peer of three	600 s (that peer's request budget)	10 s (one shared deadline)	-590 s	`peer_briefs_tests.rs`, tokio paused time (red: `the stalled peer held the list for 600s`)
peers left out with a reason	0 of 2	2 of 2	+2	same

Test

cargo test -p acpmux --lib briefs_tests (briefs_asks_the_peers_at_once_and_names_each_one_left_out): three fake peers on in-memory links (one stalls, one refuses, one lists a brief), under tokio's paused clock. The list comes back within 30 s (virtual), holds the listing peer's brief, and names the other two with their errors.

Red on the test commit aaace17 (run 41027814977): the stalled peer held the list for 600s
Green on the head 5a74935 (run 41028681107, cargo test -p acpmux --no-fail-fast): the test passes, and so does every other test except hermetic_daemon_guard::every_test_binary_runs_in_the_hermetic_environment, red on base the same way (tests/web_image_attachments.rs lacks the hermetic helper; acpmux tests: web_image_attachments runs hermetic, with node as its one host tool (base red) #28150 fixes it). The job's exit 1 is forced so the log prints.

Observed / Not run

Observed: the red and green runs above, on hosted Linux through cmux-ci test; an independent review (Codex gpt-6.1-sol, high) passed at 5a74935. Read, not run: no live fleet measurement.

Changelog

Fixed: listing briefs no longer waits up to ten minutes on one slow peer machine, and says which peers were left out and why.

Agent session: agent session

🤖 Generated with Claude Code

Red on base: the peers are asked one by one with the 600 s request budget each, so a stalled peer holds the list for ten minutes, and a refusing peer is left out with no word of why. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

_acpmux/briefs asked every connected peer for its briefs one by one, each with the 600 s request budget, and left out a peer whose answer failed with no word of why: one stalled peer held the list for ten minutes. The peers are now asked at once under one 10 s deadline (as _acpmux/models does), and each peer left out is named with its error in peersFailed, logged at warn and printed by acpmux briefs ls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93

blacksmith-sh · 2026-10-30T08:58:45Z

Found 22 test failures on Blacksmith runners:

Failures

Test	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='', primary='failure')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='', primary='failure')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='', primary='success')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='', primary='success')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='failure')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='failure')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='success')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='success')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='failure')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='failure')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='success')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='success')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='ubuntu-24.04', primary='failure')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='ubuntu-24.04', primary='failure')`	View Logs
`test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='ubuntu-24.04', primary='success')/` `test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting.` `test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae` `mon', runner='ubuntu-24.04', primary='success')`	View Logs

...and 12 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

github-actions · 2026-10-30T09:00:32Z

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: 3 commit(s) change the sidebar's drawing code without a Sidebar-Look: trailer or an entry in plans/cmux-next/sidebar-owner.md is not red on the base e0c0ee1; do not merge until green; see lane-rules

cursor · 2026-10-30T09:03:15Z

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

teamleaderleo · 2026-10-30T09:05:33Z

Review (the owner lane's independent review, at its land request): SHIP at 5a74935

Recorded by lane-gh-broker from this PR's owner lane, which asked to land this exact head after its independent review. next-autoland lands it once every red is the base's; a BLOCK at this head, a HOLD line or a hold label still stops it.

teamleaderleo · 2026-10-30T10:56:58Z

CI classification at 5a74935: the one red, PR checks / link (step "Update the PR's review line", which only writes the review line into this PR's body via scripts/ci/pr_status.py; it tests nothing), is infra, not this PR's. The same step failed on about 100 unrelated PRs between 08:10 and 10:18Z (e.g. #28264, #28260, #28154, #28257), and no failure after that. The cancelled body checks (risk evidence, pr-design-spec-check, pr-perf-section-check, pr-capture-check) were superseded by later edits. Every acpmux test either passes or fails the same way on base (hermetic_daemon_guard, fixed by #28150). Not rerun, to spare the shared token quota; next-autoland reads the link red as its own, so this needs a pinned merge at 5a74935.

…_slicing hits that landed after 08fb305) Base gained acpmux indexing_slicing hits while this PR was open (703 > 693): - cli/orchestrate.rs (65b5de8, #28016): harnessFrom via JsonSet::set. - cli/resolve.rs (9d318f9, #28000): choice_commands finds the session argument with enumerate and checks the preceding argument with get. - hub/key_route.rs (9d318f9, #28000): name and status are read with get. - hub/message_events.rs, hub/mod.rs, prompt_provenance.rs, server/outbox.rs (7050ae3, #27038): writes via set; outbox reads via pointer, where a missing value reads as Null, as indexing returned. - hub/paging.rs (e0f3350, #27614): the moot slot is read and cleared with get / get_mut. - server/peer_forward.rs (6225e77, #28141): fromAgent via set. - server/requests/briefs.rs (4a0b8f0, #28172): peersFailed via set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f

…_slicing hits that landed after 08fb305) Base gained acpmux indexing_slicing hits while this PR was open (703 > 693): - cli/orchestrate.rs (65b5de8, #28016): harnessFrom via JsonSet::set. - cli/resolve.rs (9d318f9, #28000): choice_commands finds the session argument with enumerate and checks the preceding argument with get. - hub/key_route.rs (9d318f9, #28000): name and status are read with get. - hub/message_events.rs, hub/mod.rs, prompt_provenance.rs, server/outbox.rs, server/peer_forward.rs (7050ae3, #27038): writes via set; outbox reads via pointer, where a missing value reads as Null, as indexing returned. - hub/paging.rs (e0f3350, #27614): the moot slot is read and cleared with get / get_mut. - server/requests/briefs.rs (4a0b8f0, #28172): peersFailed via set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f

github-actions · 2026-10-30T12:25:32Z

Shipped in:

cmux NEXT nightly 1.0.0-nightly.4104925832401 (7f97b8485c)
cmux NEXT nightly 1.0.0-nightly.4105124467401 (00e8c4a87d)
cmux NEXT nightly 1.0.0-nightly.4105156611101 (8bbd4ec341)

…g 703 > 693): rewrite the new hits without panics (#28134) * acpmux: restart tool previews cut strings without slicing (4 string_slice hits from #26984) The Rust panic ratchet is red on feat-cmux-next: acpmux string_slice 98 > baseline 94. The four new hits are in hub/restart_resume.rs, added by 84705bd (#26984): input_prefix and masked_scan cut at a char boundary with `[..end]`, mask_input_assignments with `[..assignment.end()]`, and safe_tool_text with `[..at]`. The two char-boundary cuts share one `char_prefix` helper that reads with `str::get`; the regex-end and rfind cuts use `get` too. Every index was already a char boundary, so behaviour is unchanged; the unreachable None arms keep the redacting side ("[secret]" alone, or an empty prefix). A new test cuts multibyte text at each spot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f * acpmux ls: the table pads without indexing (3 indexing_slicing hits from #28046) table() read each row's cell and each column's width by index, and render() bumped a hidden count by index. They now use get / get_mut. A row shorter than the header used to panic in table(); now its missing cells are left out. A row longer than the header has its extra cells padded to no width. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f * acpmux: JSON reads and writes without indexing (6 indexing_slicing hits from #28046, #27685, #27809, #26984) - cli/run/ls.rs (72c0200, #28046): the ls request params and the filtered sessions write through JsonSet::set. - hub/cancel.rs (95243d1, #27685): forced_answer's `restarted` too. - hub/remote_rows.rs (e863077, #27809): mark_peer_stale reads status, stale and lastSeen with get. A missing field compares the way the Null that indexing returned did. - hub/restart_resume.rs (84705bd, #26984): BoundedJsonWriter copies at most `remaining` bytes with take, not a slice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f * acpmux: JSON and slice reads and writes without indexing (15 indexing_slicing hits that landed after 08fb305) Base gained acpmux indexing_slicing hits while this PR was open (703 > 693): - cli/orchestrate.rs (65b5de8, #28016): harnessFrom via JsonSet::set. - cli/resolve.rs (9d318f9, #28000): choice_commands finds the session argument with enumerate and checks the preceding argument with get. - hub/key_route.rs (9d318f9, #28000): name and status are read with get. - hub/message_events.rs, hub/mod.rs, prompt_provenance.rs, server/outbox.rs, server/peer_forward.rs (7050ae3, #27038): writes via set; outbox reads via pointer, where a missing value reads as Null, as indexing returned. - hub/paging.rs (e0f3350, #27614): the moot slot is read and cleared with get / get_mut. - server/requests/briefs.rs (4a0b8f0, #28172): peersFailed via set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f * panic ratchet: lower acpmux indexing_slicing 693 -> 688, unwrap_used 144 -> 143 (measured at 0c8a50c, run 41050016507) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f * acpmux: Stop reads its answer without indexing (2 indexing_slicing hits from #28154); keep the acpmux baseline at 693 hub/turns.rs (0a088aa, #28154): is_stopped_before_prompt and the stopped answer read with get, not index. A missing reason compares like Null did, and stopReason is always present in stopped_answer(). The acpmux baseline goes back to base's 693 / 144. acpmux hits landed three times while this PR was open, and a baseline pinned to today's exact count would turn base red the next time one lands before this PR merges. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f * acpmux: drop three JsonSet imports that super::* already brings in (clippy unused_imports) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-d9e7e9f7fb2b87a57d5f --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…up (#28214) * ci(cmux-tui): skip docs-only artifact publishes Agent-Session: https://cmux.com/deeplink/agent?id=aid-55ad21df065d5bc316b2 * ios: New Message to one agent sends its images (#27877) * test(ios): New Message to one agent forwards its images Red first: routing a New Message / Forward to one agent sends only the text, so images are dropped and an image-only message sends nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-e06379967aeecbaaded3 * fix(ios): New Message to one agent sends its images New Message and Forward addressed to one agent sent only the text as the agent's prompt: attached images were dropped, and an image-only message sent nothing after the sheet closed. The images now go as the prompt's image attachments, bytes and order kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-e06379967aeecbaaded3 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * carry of #26682: fix(setup): report actionable harness authentication checks (#28187) * test(setup): cover actionable harness auth reports Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1 * fix(setup): expose actionable harness auth recovery Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1 * docs(setup): clarify actionable verification failures Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1 * fix(setup): preserve disabled profile check uncertainty Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1 * test(setup): select custom profile among discovered harnesses Agent-Session: https://cmux.com/deeplink/agent?id=aid-252635b51d8eab1624f1 * fix(setup): an expired credential reports signed_out with the login recovery Base added acpmux::harness_health::Auth::Expired; setup already routes it to the login action, so its auth_status is signed_out (the match was non-exhaustive and cmux-tui did not compile). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f8805b2d0f3b1303441e --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: leave superseded tool output out of a chat's open page (#27614) * acpmux: leave superseded tool output out of open pages and sealed segments codex-acp re-sends a running command's whole output as the content of every tool_call_update, so a Codex chat's log grows with the square of its output and its open page holds a few snapshots of one command. A page a client bounds by bytes (maxBytes) now leaves out updates a newer update of the same call in the scan makes moot, and drops moot content from the rest. Each sealed segment of a live chat's log loses the content a later update of the same call in it supersedes, on a thread of its own; seq, deltas and each call's last content stay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: supersede only within a prompt; fence the sealed rename Review findings on #27614: - A call id names a call within one prompt: a user_message or turn_started between two updates keeps both, in pages and on disk. A read cut at a prompt (a fork through a turn) sees every call as logged. - The copy goes in under the writers' lock a retention commit holds, and only over the very file it was read from (device, inode, length): a retention rewrite, a delete or a replacement is never overwritten. - A segment that changed stops the pass without moving the marker. - The copy is removed on any error, and a crash's copy by the next pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: keep this PR to the open page; sealed-segment compaction moves to a follow-up Review found that rewriting sealed segments changes what a fork or export pinned mid-prompt reads, so this PR now changes only pages read newest first with a byte bound. A page of some kinds still resets at every prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: touch only output-only updates, and keep the oldest of each call a page reads Review: dropping any covered update changed the fold where an update carries more than output (input keys merge, subagent _meta, a diff a hidden call shows), and the start time a page takes from the first update it reads. Now only an update of status and text content is touched, and the oldest of each call a page reads stays until an older record of the call makes it moot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: scope superseded calls by subagent owner, keep content:null, honour stubs Review: a native subagent numbers its calls apart from its chat; an explicit content null clears output; a record a page stubs carries no output. Each now supersedes nothing it should not. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: fix superseded tests (clippy useless_vec, the clear test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: a params _meta of any other shape is never plain Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * cmux NEXT: one machine link state for the sidebar and the agent pane; a down machine reconnects on use (#26786) * feat(machines): one machine link state for the sidebar and the agent pane, reconnecting on use The sidebar machine header draws a spinner while a machine connects or reconnects and red when it is down; the agent pane gets the same word (machineLink) for its composer strip; opening or sending to a chat on a down machine reconnects it and goes on once its handshake finished. Sidebar-Look: Leo 2026-10-28 "you just get a little green dot ... as if you were working on your own computer, but now it's remote" Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * test(sidebar): a still of the machine headers in each link state Sidebar-Look: Leo 2026-10-28 "you just get a little green dot ... as if you were working on your own computer, but now it's remote" Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(machines): an optional update draws the connected dot; a cancelled send is not retried Sidebar-Look: Leo 2026-10-28 "you just get a little green dot ... as if you were working on your own computer, but now it's remote" Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(agent-pane): a send cancelled while its machine reconnects stops waiting at once Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(agent-pane): a cancelled send reconnects nothing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(agent-pane): a send cancelled during its machine's reconnect is not retried Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(agent-pane): the strip's machine and its Reconnect are the machine the tab's chat runs on Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(agent-pane): a released tab's page leaves the machine link; the last one ends its observation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(agent-pane): name the settings JSONValue the page event carries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 (cherry picked from commit f354c6952a5a6f9521264472294d9f0880db35f1) * test(agent-pane): the Observable fake machine is not private (its macro's extension needs it) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * feat(sidebar): remote machines follow acpmux's peer state pushes from the app's own daemon The app's own acpmux watch now reads `_acpmux/peer_state_changed` and hands it to the remote machines' sidebar: a listed peer's header goes up or down at once, a repeat changes nothing, and an unknown or removed peer, or a reopened watch, reads `_acpmux/peers` again. A mirrored acpmux's (the Chief home's) pushes are ignored, so only this Mac's own links show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(sidebar): a peer list read that a push overtook is read again A push that lands while `_acpmux/peers` is in flight (a separate socket, so its answer may be from before the push) drops that answer and reads the list once more; pushes come only on a state change, so a burst ends in one more read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * fix(sidebar): any peer push drops the list read it overtook, one that changes nothing shown too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-4ba8980ae4e8eecb82d6 * cmux NEXT machine link: a send stops waiting on a link that needs a person, and a failed socket or handshake reconnects too Review findings at fbdd271: awaitLink waited the whole 45 s budget when the reconnect ended stuck (a refused sign-in, a required update); it now ends at once. The retry wrapped only the endpoint, so a socket or daemon handshake failing after the endpoint came back bypassed the reconnect; the attach client now asks the machine link (AgentSessionAttachClient.Reconnect) when any part of its connection fails, and tries once more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-5b0be570f0b96d2d4c7b * cmux NEXT machine link: the reconnect retry runs in the caller's task, and a failed first try ends no attachment Review findings at 703d820: a first try whose handshake failed closed its transport, whose onClose ended the page's attachment before the retry; and the reconnect wait ran in the shared unstructured connect task, so a cancelled call kept waiting. The retry now wraps the shared connection in the caller's task; a quiet first try tells its loss only when no retry follows or the retry fails too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-5b0be570f0b96d2d4c7b * Fix machine link event delivery and reconnect endpoint Agent-Session: aid-b12e655d1a89af187c5a * Pass empty scripts for machine link delivery Agent-Session: https://cmux.com/deeplink/agent?id=aid-16e16f9e7a55152abe76 * Report quiet attach loss after endpoint failure Agent-Session: https://cmux.com/deeplink/agent?id=aid-16e16f9e7a55152abe76 * Fix machine-link guard and lint findings Agent-Session: https://cmux.com/deeplink/agent?id=aid-16e16f9e7a55152abe76 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: cmux-bot[bot] <348531757+cmux-bot[bot]@users.noreply.github.com> * ci(cmux-tui): owned minis skip the Go and branch Rust caches that never restore (#27840) * ci(cmux-tui): owned minis skip the Go and branch Rust caches that never restore On owned Mac minis, the macOS job's setup-go cache never restored: untarring it over the mini's own read-only ~/go/pkg/mod failed with Permission denied (8 of 8 sampled jobs), after a ~63 s download and before another save attempt. The rust-cache restored 0 of 8; its branch saves cost ~155 s each and filled most of the 10 GB GitHub cache store, evicting other entries. Owned minis now run setup-go without the Actions cache, and save the cargo cache only from feat-cmux-next. Blacksmith VMs keep both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-a7306ef145c005ad24ab * ci: keep cache regression out of guard workflow Agent-Session: https://cmux.com/deeplink/agent?id=aid-4777d4f75452817a742b --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next tests: the test process's children start without SWIFT_BACKTRACE (#28122) #25857 made the swift test wrapper export SWIFT_BACKTRACE=enable=yes,... so a crash of the test process prints its stack. Every child inherited it: - An exit test's child traps on purpose. With the variable set, it spawned the backtracer to symbolicate the whole test binary, and the parent sat in wait4 until the stuck-test watchdog ended the run (BlockingCheckTests .aCheckedFileManagerCallOnTheMainThreadTraps, #26809 run 40999753339 shard 6, exit 143). - A privileged tool writes "swift runtime: backtrace-on-crash is not supported for privileged executables." to stderr first. A test reading the child's stderr took that line for the answer: ChromiumRuntimeInstaller failed with unsafeEntry and then stalled 303 s (same run, shard 5), as the python bridges #27981 fixed one by one did. The test bundle's load-time constructor now unsets the variable. The Swift runtime read it when libswiftCore loaded, before the bundle, so the test process keeps its own backtracer and no child gets one. Agent-Session: https://cmux.com/deeplink/agent?id=aid-1288bbb2b5d2f5c6b66a Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * chore(next): base autofix at e0f33500c849 - cargo fmt in cmux-tui Made again on e0f33500c849: it moved the inputs of a repair made at 941b7a4b133a. scripts/cmux-next/base-autofix.sh: https://github.com/manaflow-ai/cmux/actions/runs/41038166183 Re-applied on 91e0204e3ada, which feat-cmux-next moved to after e0f33500c849. * ci(cmux-tui artifacts): short Linux jobs take the shared 32/16 vCPU set (#28240) * ci(cmux-tui artifacts): short Linux jobs take the shared 32/16 vCPU set On 2026-10-30 every cmux-tui artifacts run on feat-cmux-next sat queued on blacksmith-4vcpu-ubuntu-2404 (run 41007923202: tree preflight waited 4 min, mark-tree-commits and point-feat-channel were still queued 15 min later), so nightly-next promotion stalled behind the tree marker. The 11 short Linux jobs now use the expression this workflow's publish jobs already use: a non-Blacksmith LINUX_RUNNER pool, else Blacksmith 32 vCPU, or 16 vCPU while the overflow switch has failed over. A new guard test evaluates every Linux runs-on of the workflow against each variable state. * Test the hosted LINUX_RUNNER and the Darwin cross override Codex review of #28240: the matrix lacked ubuntu-24.04, the value the overflow switch writes, and pinned LINUX_RUNNER_DARWIN_CROSS empty, so macos-cross-shadow's override was never exercised. Add both; a new test checks only that job reads the override. * acpmux: a bare session name or id prefix reaches the one live session on any host; several are refused with each HOST/NAME command (#28000) * acpmux: a bare name names the one live session on this host or a peer; several are refused with each HOST/NAME command Every command that takes a session resolves a bare name or id prefix the same way, in the daemon (hub/key_route.rs, applied on the unix socket before any check reads the key): the one live session with that whole name (else id prefix) across this daemon and its peers. Closed sessions count only when no live one matches. Several live matches are refused (session_ambiguous, exit 2) with each choice, and the CLI prints the exact command for each. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux README: neutral host names in the ambiguity example Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux key_route: test hub is an Arc; the refusal list owns its strings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux: red/green request test, a name shared by a session here and a peer's is refused on info and send Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux key_route: a whole name and an id prefix are one tier; every choice in the data; keep's exact id is not routed; the argv swap skips an option's value (review of #28000) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux key_route: a sub-session's whole name (parent/child) is routed across hosts too (review of #28000) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux key_route tests: neutral sample host names (fleet rule lint) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c * acpmux key_route: poisoned locks are read, never unwrapped (crash ratchet) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fbbcdf857038daa63e0c --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(l10n): fill the 8 cmux NEXT string-table keys missing languages (base red) (#28167) "String tables (21 languages)" failed on feat-cmux-next with 112 style errors against its warning cap of 100. The last 12 came from action.agentPane.continueAfterError (9e836df43650), which shipped in 9 of the 21 languages. Fill it and the seven older keys that made up the rest of the debt, so the check reports 0 errors: - ActionCatalog: action.agentPane.continueAfterError, action.palette.forkAgentConversation, action.palette.forkAgentConversationTo - PaneCreation: paneCreation.allCommands - Updater: updater.button.updateAvailable, updater.button.updateAvailableNamed - CmuxHome: home.plan.title, home.plan.activeCount (all 20 languages) Wording follows each table's neighbours (the Fork Conversation family, Continue In…, Update Available, detail.plan). State is "translated" where the key's other languages are, and "needs_review" in CmuxHome, as that table's other machine translations are. Agent-Session: https://cmux.com/deeplink/agent?id=aid-a98b158f6fd70b0eae26 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * ci(nightly): the remote-daemon build and attest jobs take the Linux runner set (#28209) #25935 (85628c020a3) moved build-nightly-remote-daemon and attest-nightly-remote-daemon off the Mac builder onto blacksmith-4vcpu-ubuntu-2404. That label is outside the trusted runner set of #27125 (9127e619f76, "Linux jobs take the runner set, not one small Blacksmith label"), so tests/test_nightly_trusted_routing.py test_every_linux_nightly_job_takes_a_runner_set_member is red on feat-cmux-next (20 failures, both jobs) and nightly-guards / release-notary is red on every feat PR. Both jobs now use the runner-set expression of the other Linux nightly jobs (16 vCPU when vars.LINUX_RUNNER names it, else 32). They stay off the Macs, which was the goal of #25935. tests/test_gh_budget_wait.py pinned the attest job to the 4 vCPU label; that one assertion conflicts with the trusted-routing rule, so it now checks that the job holds no Mac and takes the runner set. Its other assertions are unchanged. Test: python3 -I tests/test_nightly_trusted_routing.py (FAILED, failures=20 on 97133a48ad0; OK on this commit); python3 -I tests/test_gh_budget_wait.py (OK on both). * chore(next): base autofix at afe5e8ddc4c6 - regenerated web/data/cmux-shortcuts.generated.json - regenerated schemas/defaults/cmux-next.json - cargo fmt in cmux-tui Made again on afe5e8ddc4c6: it moved the inputs of a repair made at 4e5fe0232da3. scripts/cmux-next/base-autofix.sh: https://github.com/manaflow-ai/cmux/actions/runs/41040753079 * fix(inspector): hide unsupported chat environment save (#28238) * test: reproduce silent environment save failure Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f * fix: surface failed Session Info environment saves Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f * style: format environment save fixtures Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f * test: assert actual gallery color scheme and reduced motion Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f * test: wait for Environment before checking gallery settings Agent-Session: https://cmux.com/deeplink/agent?id=aid-ed6c50a2fcd43ba5fe7f * fix(inspector): hide unsupported chat environment save Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e * acpmux: a person's Stop of a chat on a peer holds the other agents' messages there (#28141) * test(acpmux): a person's Stop of a peer's chat holds the agent messages there (red) On base the peer takes the forwarded Stop as a plain cancel: no queue_paused with reason stop on the peer, and the agent message runs. A fake peer checks that only a peer listing personStop gets the field, and that a non-person's Stop never carries it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-3918eb692ec76bbeec6e * fix(acpmux): a person's Stop of a chat on a peer holds the agent messages there The peer daemon's link is never the person on the peer, so a Stop for a peer's chat was a plain cancel there: the stopped turn ended and the next agent message started a turn at once. This daemon now forwards the person's Stop with _meta.acpmux.personStop to a peer that lists the personStop feature, and a peer takes it only from a peer daemon's own link (PeerToken, held to the peer's rules, not via web or device) and runs the same person_stop as for its own person. An older peer gets the plain cancel. A client's own personStop field is dropped before the forward. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-3918eb692ec76bbeec6e --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * docs(cmux-tui): agent-hooks: cmux-next has no ssh-tmux mirror (#27797) The line said ssh-tmux mirrored workspaces get no agent badges from the cmux-tui journal. A main sync had dropped the sentence #19104 added, so it read as a cmux-next gap and sent two helpers after one that does not exist (HQ#5226 row 3). cmux-next SSH machines run cmux-tui on the host with the full CLAUDE_EVENTS set; the ssh-tmux mirror is classic-only and reports badges through its own tmux subscription. Agent-Session: https://cmux.com/deeplink/agent?id=aid-c689cdaab52479676c52 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(webviews): dispose page subscriptions after their store stops (#27861) * fix(webviews): scope page store subscriptions to their lifetime Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e * style(webviews): format store lifetime regression tests Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e * fix(webviews): guard auxiliary store continuations Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e * fix(webviews): fence stale app continuations Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e * fix(webviews): stop stale app reload continuations Agent-Session: https://cmux.com/deeplink/agent?id=aid-aaebdf126bd73033484e * Agent pane: answered question and checklist as Claude desktop cards (#27938) * feat(agent-pane): answered question and checklist as Claude desktop cards An answered question now collapses to a compact bordered card in the transcript: each question, the chosen answers (Other text included) in grey under it, then who answered. An ask that ended unanswered is the same card with Skipped, Stopped before an answer or Not answered in the answer's place. The todo list keeps its bordered card, spinner, dashed and check marks. QuestionCard and PlanList are memoized on their immutable inputs; a new test counts their commits while 200 tokens stream in the same turn. Gallery: answered looks (stacked shipped, inline, check), ended looks (card shipped, pill, rule), and a todo list looks entry (card shipped, borderless, count). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * fix(agent-pane): answered card spacing from the design tokens Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * test(agent-pane): cards re-created per token, as the transcript does; lower the type-scale baseline Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * test(agent-pane): count the cards' own renders, not a re-created Profiler's commits Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * test(agent-pane): mark the module mock's promise as handled Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * fix(agent-pane): one reply handler per live ask, so the memoized question card skips pane updates Review (Astra) of 0dd7e865: App.tsx made replyToQuestion(permission) anew each render, so the pending card's memo never held. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * test(agent-pane): mount the live ask's card wrapper in the render-count test The live question card's reply handler moves into PermissionQuestion, which App.tsx's PermissionAsk renders; the test mounts that wrapper with one permission across 200 tokens, so dropping its useMemo fails the test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: a peer link hears no change of a row mirrored from another peer (#28152) * test(acpmux): a peer link hears no change of a row mirrored from another peer Red on base: every change of a mirrored row goes out on every peer link, which drops it (peer.rs), so with 25 peers each change went out 24 times. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93 * acpmux: a peer link hears no change of a row mirrored from another peer Every change of a row this daemon mirrors from a peer went out as _acpmux/session_changed on every other peer's link too, where the link drops it (peer.rs: a mirrored row or a notice naming a peer). With 25 peers that was 24 copies of each change, tools included. A link now hears only this daemon's own rows' changes, as its watch list since #28105 lists only them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93 * acpmux: a link still hears a peer's pending prompt; only session_changed is skipped Review of 8f1a1fdc: the link check returned before the peer permission branch, and a link is any client named acpmux-peer, so a unix-socket watcher with that name lost a peer's _acpmux/permission_pending. The check now guards only the session_changed send; the permission branch is as on base. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: briefs asks the peers at once and names each one left out (#28172) * test(acpmux): briefs asks the peers at once and names each one left out Red on base: the peers are asked one by one with the 600 s request budget each, so a stalled peer holds the list for ten minutes, and a refusing peer is left out with no word of why. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93 * acpmux: briefs asks the peers at once and names each one left out _acpmux/briefs asked every connected peer for its briefs one by one, each with the 600 s request budget, and left out a peer whose answer failed with no word of why: one stalled peer held the list for ten minutes. The peers are now asked at once under one 10 s deadline (as _acpmux/models does), and each peer left out is named with its error in peersFailed, logged at warn and printed by acpmux briefs ls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * test(cmux-tui): a lost terminal's end finds its pages read ahead (red) Lawrence 2026-10-30: after a reboot the daemon's adoption records every lost terminal's end before it answers anyone: 750-821 ms for 462 terminals on a clone of a 41.6 GB registry, 60% of it cold page reads. Each end appends journal subjects (terminal, tab, pane, screen, workspace) to journal_subject_index_by_subject_sequence, keyed by random public ids, and a terminal event keyed by terminal id, so each insert lands on a leaf nothing read earlier. startup_prefetch_covers_every_page_a_terminal_end_writes: every page key an end writes is one the startup reads ahead. terminal_end_prefetch_keys is a stub that reads nothing, as the startup does now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(cmux-tui): the startup reads a lost terminal's end pages ahead Root cause (Lawrence 2026-10-30): after a reboot every terminal host is gone, and the adoption records each terminal's end before the daemon answers: on a clone of a 41.6 GB registry with 462 lost terminals that was 750-821 ms, and 60% of it was cold page reads. Each end appends journal subjects (terminal, tab, pane, screen, workspace) to journal_subject_index_by_subject_sequence (8.4 GB, keyed by random public ids) and a terminal event keyed by terminal id; 2,244 serial reads of leaves nothing had read yet (313 ms cold, 12 ms warm, measured alone). A background thread starts right after the registry opens and reads those leaves on 8 read-only connections of its own while the restore runs (terminal_end_prefetch.rs): the keys are every terminal that is neither exited nor tombstoned, since which hosts are gone is known only during adoption. It writes nothing and takes no registry lock; it only puts pages in the OS page cache, and its errors are dropped. When every host is alive the reads are wasted: a few thousand small reads on a background thread. Clone of the 41.6 GB registry, same Mac, release build, 462 lost terminals, 6 runs each: terminal.adopt_hosts 750-821 -> 410-425 ms; daemon start 2,401-2,638 -> 2,103-2,186 ms; first sidebar.get 2,484-2,759 -> 2,183-2,270 ms (one run 3,683, an exec stall outside the daemon's own timing). sidebar.get p50 about 5 ms either way. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: new and ensure keep a predecessor's harness, or say why not (#28016) * test(acpmux): a successor keeps its predecessor's harness (red) Part of HQ#5266. Red/green tests for acpmux new naming a predecessor: a bare default start where the predecessor ran a named profile is refused, a different harness is warned with the flag that keeps it, --harness-from copies it, and nothing names a predecessor: no warning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf * feat(acpmux): new and ensure keep a predecessor's harness, or say why not Part of HQ#5266 (item 3). Leo, 2026-10-30: "that visibility into huge-blue guys was (and is?) pretty bad". The deputies relaunched with only area and role tags came back on the bare default harness, without their profile's autocompact cap. A session/new from the command line names a predecessor by --harness-from, a succeeds= tag, --report-to or its starter of the same name family, a NAME-N name, or an area= tag (one pass over the session index; no transcript read). A start with no -m or -p that lands on the default where the predecessor ran a named profile is refused; a start whose profile, launcher, model, effort or autocompact cap differs gets a one-line warning naming both and --harness-from. --harness-from copies the predecessor's profile, preset, model and effort. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf * fix(acpmux): a successor's check reads the session index once and copies Ultracode Review of #28016 (Sol): --harness-from copies Claude's Ultracode effort, the launcher compared is the one the session last started with, a copy that still differs says so, ensure --host --harness-from is refused up front, and the predecessor is found in one pass over the index. --report-to keeps the name-family rule the brief asks for (a helper's coordinator is not its predecessor), now with a test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf * fix(acpmux): --harness-from is refused wherever it would not be honoured Re-review of #28016 (Sol): a session/new with harnessFrom over the app's or a web connection, or on an ephemeral run or an adopt, was started as an ordinary session and the copy silently dropped. It is refused now, over every connection but the local socket. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f479d2ccf4cedb6ae7cf --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(next): scroll the session rail independently (#26520) * feat(next): grow the session rail height Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6 * feat(next): let the session rail scroll independently Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6 * fix(next): wait for rail overflow in height gallery Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6 * fix(next): align rail hit testing with visible ticks Agent-Session: https://cmux.com/deeplink/agent?id=aid-424868970109118b3cd6 * Rail wheel: the rail owns it only while it scrolls; browsing is per session The transcript reader listener captures on the scroller, an ancestor of the rail, so a stopPropagation on the list ran too late: an upward wheel over an overflowing rail released the transcript follow. The reader now skips a wheel over a rail list marked data-rail-scrolls (railWheel.ts). A rail that fits its prompts is no scroll container again (overflow hidden), so the wheel over it reaches the transcript. The browsing latch remembers its session, so a reused transcript showing another chat follows its reader. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Rail wheel test: wrap a line past the print width Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Rail wheel: a jump landing correction goes on under a rail wheel settleScroll ends on any reader input captured on the window, which runs before the rail can stop the event, so a wheel over an overflowing rail cancelled a clicked tick landing mid-correction. It now skips a wheel the rail owns (railOwnsWheel), as the transcript reader does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Scrollbar guard: the rail list may hide its own scrollbar The session rail spec keeps the overflowing rail list free of any visible scrollbar. Allow the two hiding rules in threadMinimap.css only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: a subagent pane draws its chat from the kept tail (#28235) showSubagent asks the app for a subagent pane, which is a new tab on the chat's own session, but never handed the chat over first the way openOwnTab and onMoveToTab do before chat.openTab. The pane opened blank and waited on its own attach. Hand the chat over first, and hold the call site in the source-reading wiring test. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * chat-open bench: a timed-out or errored open never counts as a time (#28255) valid() looked only at whether first_content_ms and longest_empty_ms are numbers, so a trace that timed out but still carried them went into the medians. Reject timed-out and errored records first. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * ci(cmux-tui): the attestation waits out a rate limit until GitHub answers again (#28269) Owner run 41017791425 (2026-10-30) built tree 13939dda, then lost it in "publish to R2": actions/attest-build-provenance was refused "API rate limit exceeded for installation" at 07:14, 07:15, 07:17 and 07:21. The backoffs between the four tries waited a fixed 60, 120 and 240 s (gh_budget_wait.sh --backoff), the limit still held at the last try, and the job failed with the tree unpublished, so the NEXT nightly kept promoting an older commit. gh_budget_wait.sh gets --backoff-probe TRY PROBE: the action hides the refused response, so it reads PROBE (a read of the attestations API with the same token) and, while GitHub refuses it for the rate limit (429, or 403 with x-ratelimit-remaining: 0, Retry-After or a message naming the limit), waits for the reset that refusal names (Retry-After, else x-ratelimit-reset, else the secondary-limit backoff) and reads again. The next try runs once GitHub answers. A probe answered at once (200, 404, a permission 403, a 5xx) waits as --backoff did. Every wait counts against the job's ledger; the publish passes now allow 50 minutes (was 15), inside their 75-minute timeout with the 15 minutes of work. The last try still must pass, so nothing ships without provenance, and a real attestation failure still fails the publish. Tests: test_gh_budget_wait.py drives --backoff-probe against a fake gh (the reset a refusal names, a limit that holds for three looks, Retry-After and 429, the secondary-limit schedule, a probe answered at once, the job total); test_cmux_tui_publish_retries.py checks the publish passes wire it. Both fail against the previous script and workflow. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * New Tab: project and machine head the composer, menus open away from the chat, and Cloud picks wait for the machine (#27956) * feat(composer): project and machine head the composer; menus open away from the chat Leo 2026-10-29: "project and cloudness at the top. make them open away from teh chat, which is obviously up if it is up, down if it is down. and stop making them take up so much space." - New Tab heads its box with the folder and machine in every look (no longer in the quiet row). - Location menus open on the side away from the conversation, read from the composer position, and slide along that side to stay in the window instead of flipping onto the chat. - One compact strip: 24 px, 4 px between content-sized pills. - Cloud machines: a pick on a paused or unlinked machine waits for it and moves the chat there once ready; resume reads Starting at once; failed reads Couldn t start; New Cloud Machine says what one gives in the plain menu. - design/composer-menus.md records the placement rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(composer-menus): New Tab placement only; the agent chat keeps its row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Gallery cover names the component; onboarding test matches the cloud row by prefix The New Cloud Machine row now carries its description, so its accessible name starts with the label rather than equalling it. A gallery cover names a component, so the hook cover goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * New Tab headline play reads the computer pill above the box The computer pill moved from the quiet row to the strip above the box, beside the folder pill, so a project name of another width moves it sideways; the play now holds only its row and size. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Cloud pick wait ends on a failed start and on any chat change A refused resume or open now marks the machine failed instead of leaving it at its old stage, and a pick waiting on a machine that failed reads Couldn't start and stops waiting to move the chat. A chat change drops the wait for good, so a chat that returns to the same key (an empty New Tab id) never inherits another chat's pick. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Cloud pick wait ends for good when the account stops listing the machine Before, the stored pick survived a list without the machine, so the machine coming back with a ready peer could still move the chat. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(acpmux): send's examples go in help_examples, not its own after-help (base red) (#28301) #28000 gave `acpmux send` an after-help with its own Examples:, while #28013 (landed before it) moved every command's examples into cli/help_examples and refuses a listed command that also has its own: help_examples::tests::every_example_entry_names_a_visible_command_once fails on feat-cmux-next since #28000 ("send": its after-help has its own Examples:). #28000's three examples (the one live name, HOST/NAME, an id prefix) move into the send entry; its after-help keeps the refusal note. Test: cargo test -p acpmux --lib help_examples (5 pass; red on base). Agent-Session: https://cmux.com/deeplink/agent?id=aid-c11d09c9f41988fc1d93 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: start other MCP servers (cmux-cua) on first call, not to list them (#27976) * cmux mcp serve: list other servers' tools from a stored list; start them on first call A harness lists its MCP servers' tools as it starts (Codex once per thread), and `cmux mcp serve` started every upstream (cmux-cua among them) to answer that list. So every chat ran a cmux-cua helper whether or not it ever used computer use: 93 to 131 idle helpers on cosmic-gray on 2026-10-29. The list an upstream gives at its start is now stored in ~/.cache/cmux/mcp-upstreams (0700, files 0600, written whole), keyed by the server's command, args, env names (not values), the command's size and mtime, and cmux's version. tools/list answers from it without starting the server; the first tools/call starts it, relists and stores again. With no stored list, or a torn one, the server starts to be listed as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: check a call against the started server list; keep stored lists private and per program Review (codex gpt-6-astra): a stored tool the server dropped is refused as not run before it is sent; entries are read only from a folder and file the user owns that others cannot write (no symlinks); the key names the program PATH resolves the command to; a list is stored only under the key the command had before its server started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: rustfmt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: clippy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: key a stored list by the executable the server runs on its own PATH Review (codex gpt-6-astra): resolve skipped neither non-executable files nor the server env PATH that Command uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: a stored list keys the script an interpreter runs; a path nobody may run has no key Review (codex gpt-6-astra) round 4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: tests run an executable server and keep their script Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp: key a bare relative script arg too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux mcp serve: fmt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * cmux NEXT MCP: tool evals on real Claude/Codex harnesses, and code mode takes the script shapes models write (#28085) * tool-evals: replay real Claude Code turns against real cmux MCP, CLI and a headless daemon (t3code mcp-tool-use shape) * tool-evals: stand-in app replays the real app's action catalogue (823 tools, as in the app) * cmux docs: a sentence query finds the tool that matches most of its words; stop words ignored; daemon tool ranks before its app_ twin * test: cmux mcp serve resolves current to the caller's pane in a session no app owns (red) * cmux mcp: current resolves from the daemon when no app owns the session, as the CLI does * tool-evals: stand-in app answers beside; tab-not-split and run-without-empty-shell cases * tool-evals: 20 cases mined from real transcripts; docs ranking test names the daemon tool first * cmux mcp: with no app, a terminal with no place goes beside the chat (daemon neighbor); decimal fields take numbers; tool-evals Edit/Write * cmux mcp code mode: short rules in instructions (fits the 2048-char cut), common-tool sheet and result shapes in cmux_exec; compact docs answers; did-you-mean on unknown tool * test: compact docs answers and did-you-mean for an unknown tool in a script * cmux mcp code mode: tool sheet names the arguments of rename, grouping, status and notification (tool-evals: three regressions back to pass); harness setup settles before the agent looks * tool-evals: round 1 results (Sonnet and Opus, code mode); model retry on a dropped gateway connection * cmux mcp: review fixes: no-app fallback only places terminals (open_url stays on the daemon); text says terminal takes no current; compact only cmux's own tools and keeps required args; decimal schema stays a string, whole floats taken; empty query lists families * cmux docs: a tool's own name ranks first; caller terminal comes through the backend so the no-app open_url test fails without its guard; focus wording matches tab_focus * tool-evals: generic harness (OpenCode-like prompt, cmux tools listed directly) and an OpenRouter adapter, so any model runs * tool-evals: a failed session open stops its daemon (an overloaded panel leaked 1,115); OpenRouter fails fast on 4xx and a missing key * tool-evals: hybrid surface (cmux_exec plus the 21 common tools listed directly) * tool-evals: run on Linux (the rbx builder) without sandbox-exec * tool-evals: rbx panel scripts and cross-model comparison * cmux mcp code mode: tool calls return Promises (.catch works), a script written as one function runs, a missing selector and a timer name their fix, and the sheet runs commands in a shell tab that stays open (11-model panel) * tool-evals: real claude and codex CLIs as harnesses (claude-cli:<model>, codex-cli:<model>), each in a clean agent home with cmux MCP behind a logging relay * tool-evals: Claude through the Agent SDK and Codex through app-server (no TUI per run), each with a clean home and cmux MCP behind a logging relay * tool-evals: Claude Agent SDK runs the installed Claude Code (the bundled 2.1.81 got a 400 for Opus 5.5); an API Error result is an agent error * test(tool-evals): eval agents cannot open pages or reach the person's cmux (red) The sign-in-link-in-cmux case asks a model to open a link; models that ran `open https://example.com/device?code=ABCD-1234` opened it in the person's default browser (Helium) 11 times on 2026-10-28. The Claude Code and Codex samples run with no sandbox, and the shell sandbox allows /usr/bin/open. Moves the shell profile into live-guard.mjs unchanged and adds probes for open, osascript and the person's cmux app sockets in both profiles. * fix(tool-evals): eval agents run sandboxed off the person's browser and cmux app Claude Code and Codex samples now run under sandbox-exec with agentProfile, and the API runner's shell profile gets the same guards: /usr/bin/open and osascript cannot run, LaunchServices open is denied, and the person's cmux app sockets (~/.local/state/cmux, /tmp/cmux*.sock, $TMPDIR/cmux*/) are unreachable. A model that runs `open <url>` in sign-in-link-in-cmux now fails inside its sample instead of opening a Helium tab or a cmux tab. bun test tests/tool-evals/live-guard.test.mjs: 10/10 (3/10 before). * tool-evals: a sample waits while the Mac's PTYs are near the cap (the person's cmux shares it) * tool-evals: --remote-daemon runs each sample's daemon and MCP server on another host over ssh (this Mac's PTYs stay free); rbx panel takes a binary and drops gpt-oss-120b for GLM 5.3 Prime * tool-evals: agents run in a sandbox that hides this machine's skills and other samples' results (Codex read an old cmux skill and searched past results) * tool-evals: sign-in-link-in-cmux is an app-tier case (headless has no cmux browser); --tier selects * cmux mcp code mode: a script reads a change's new ids from the top of its answer too, and a terminal by its tab (head panel: 39 'needs terminal' errors across models) * cmux mcp: a terminal named by its tab resolves to that tab's terminal id (the daemon's current needs a pane, so the earlier shortcut failed its own test) * cmux mcp: review fixes: a tab names its terminal only where a terminal is required (terminal_list keeps its tab filter), in the tab's session and scope; a script that only starts like a function runs as written, and a wrapped one gets cmux * cmux mcp code mode: function-form scripts detected from the text alone (no eval probe, which could run script code), arrow forms wrapped again; tool-evals guard allows the resolved sample path (Codex could not read its home) * tool-evals: the remote MCP settings file is written and read back before the server starts (15 h4 samples got 'MCP server is off' and fell back to the shell) * cmux mcp code mode: a script that calls its own function returns that function's value; drop a test case that could not fail * cmux mcp code mode: a self-calling function script returns its value even when its body returns (the guard looked for 'return' anywhere) * tool-evals: the guard lets an agent list the directories above its own sample (Codex canonicalizes CODEX_HOME and stalled at start) * tool-evals: a sample that never reached the model (429, exhausted accounts, dropped stream) is retried; --rerun-errors runs again only an earlier run's agent/harness failures * cmux mcp code mode: the tool sheet names pane_neighbor_get (the pane on the person's right) and terminal_process_get (Opus looked for a layout tool); stand-in app focus names the tab * cmux mcp: a record a tool returned works where its id goes (models pass pane_neighbor_get's {pane: {id}} to tab_list); the sheet shows that answer's shape * cmux mcp code mode: the sheet says 'next to X' means a new tab in X's pane, and pane_split only when the person says split (6 of 9 OpenRouter models split the logs pane) * tool-evals: workspace order is graded by the sidebar's personal placement order (workspace_place {index} moves a workspace there; the session index stays) * tool-evals: round 2 results (12 models, real harnesses) * cmux mcp: a record becomes its id only where an id goes (a selector or a resource-id field); a json field keeps its object (review: keybindings_set args, settings_set value) * fix(cli): describe every cmux cloud verb in its help (#28252) * fix(cli): describe every cmux cloud verb in its help `cmux cloud --help` listed 54 verbs as bare names in two misaligned columns, with no descriptions, examples or mention of --confirm, and `cmux cloud <verb> --help` printed the same list again. The help is now grouped (machines, run and connect, files, snapshots, ports, network, chats, account), opens with a quick start (list, new, exec, pause, resume, kill), gives each verb one line in English and Japanese, and marks the verbs that need --confirm. `cmux cloud <verb> --help` prints that verb's usage and description and names `cmux action describe` for the full argument list. `cmux help cloud` now follows the locale too. The verbs live in one table (cli/cloud_help.rs) whose rows are rendered in one column; a test fails when it differs from the catalog's offered cloud verbs, and the cloud exec parse error reuses the table's usage line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb75b7af9902231028aa * fix(cli): cloud help flags match the catalog; say which verbs take no target Review findings: new-machine gains --repo, --bootstrap and --bootstrap-script, open-desktop --viewer, deliver-secrets --names; apply-machine-config loses a --repo it does not take. The intro says an action on one machine needs --target, since new-machine, start-session --name and move do not. A test now pins which verbs take no target. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb75b7af9902231028aa --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * ci(ios): add unsigned Release simulator compile route (#27642) * test(ci): cover compile-only iOS Release simulator route Behavioral tool-double coverage; fleet execution pending publication. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb41776d46de72ff2a6a * ci(ios): add unsigned Release simulator compile mode Add release-build with no injected DEBUG/demo conditions and no simulator launch or publication; retain evidence on success and failure. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb41776d46de72ff2a6a * test(ci): consume simulator inventory in runtime fixture Drain the piped JSON before returning the fixture choice, matching the real selector and avoiding SIGPIPE in legacy-mode checks. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb41776d46de72ff2a6a --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(ios): make recovery screens retry their failed loads (#27309) * fix(ios): retry failed loads from recovery screens Wire the shared recovery control to the workspace loader, terminal owner, stream opener, Feed refresh, Home refresh and conversation loader. Add behavioral loader tests and persistent demo capture states. Fleet compile and execution pending; this lane VM has no Swift compiler. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * test(ios): use anonymous recovery capture fixtures Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): keep terminal recovery controls inactive in tab cards Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): split terminal retry closure for compiler Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): validate recovery release highlight Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): await feed recovery and reopen failed channels Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): import feed recovery dependencies explicitly Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): fail closed feed channels before retrying Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): bound feed handshakes and release cancelled requests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): clear chat readiness after cancelled feed binding Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): retain terminal failure recovery and parallelize feed retry Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): bound terminal feed reads during recovery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): simplify concurrent recovery isolation capture Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): close failed initial terminal attachments Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): await Home reconnect before retry refresh Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 * fix(ios): stop cancelled Home retries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-ca6f72e5137c0c9569e8 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: a chat's first frame waits on one daemon round trip (#27755) * cmux-next: a chat's first frame waits on one daemon round trip Opening a chat asked acpmux, one after another: initialize, _acpmux/status, the chat list, the attach, then the turn opener, permissions and handoff. Now everything after the handshake goes out together (status, the list, the attach and its permission and handoff reads), and acpmux names the turn's opener in the attach reply (`turnOpener`), so the first frame waits on the handshake plus one round trip. An older acpmux leaves `turnOpener` out and the pane reads it as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * acpmux: rustfmt the turn opener Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: hold a dropped early attach's live records until the chat attaches again Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: an early attach whose reply is of another session starts the chat over Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: name the early attach's held records apart from copyLive's Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: an early attach whose row changed after it streamed attaches again Records the attach asked with the chat list streamed before the row changed may be of the session before (recreated meanwhile), so the open attaches again. A dropped early attach's held records are discarded by the next attach, whose page holds them, instead of applied: some may be of another session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: the new-tab tail tests wait for the tail read the early attach goes out before The attach now goes out with the chat list, so a held attach is asked before the host tail is read and drawn; the tests let that read land before they look. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: no retry for an early attach whose row only changed status An ordinary record is followed by its row change, so marking an early attach suspect on any row change after a record retried normal streaming opens. The cases it was for are peer chats, whose dropped early attach's records the next attach now discards; a row that names another session is still caught by the watch (strayedFrom) and the reply checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: the peer-copy daemon scripts the attach asked of the listed chat The pane now asks its chat's attach with the chat list, before it knows the chat runs on another machine, and drops that attach for a peer chat. The stand-in daemon answered its once-only hooks (records during the attach, a recreation, refusals) on that first attach; it now answers an attach asked before the list as the machine is, and scripts the one the open asks of the chat as listed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: the peer-copy daemon tells an attach asked before the list by the list's answer The pane sends the list and the early attach in one go, so the list is asked before that attach; what marks it is that the list was not answered yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: a dropped early attach's refusal is handled; peer tests count the listed attaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: the peer-copy daemon answers an early attach of its local chat as before Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cmux-next: a dropped early attach is detached once it is in, not before acpmux runs each request on its own task, so a detach sent while the attach was still out could run first and leave its subscription behind. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * Agent pane: copy button in an expanded card's top-right corner (#28057) * feat(agent-pane): copy button in an expanded card's top-right corner Leo: "wouldnt it be a little copy symbol on the top right within this card?" One shared CardCopy (the transcript's CopyButton) at the top-right of every expanded message or prompt card: a started sub-session's prompt, a wait's reply, another agent's message. Faint at rest, full on the card's hover; the highlight is the button's own box. Raw stays. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * fix(agent-pane): card copy panel contains its float; gallery tool without a non-null assertion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * fix(agent-pane): card copy uses the layer and size tokens; gallery notes wrap Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * fix(agent-pane): card copy gallery writes through a stand-in clipboard; spacing token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * style(agent-pane): format the card copy gallery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * fix(agent-pane): card copy gallery presses the button after the panel settles The matrix runner's pointer click landed while the panel's open motion still moved the button, so the copied states never saw the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * chore(next): base autofix at 569f9ea15f62 - vp fmt webviews/src/agent-session/acpmux/chatOpenTrips.test.ts - vp fmt webviews/src/agent-session/acpmux/direct.ts - vp fmt webviews/test/agent-pane-new-tab-cached-chat.test.ts - vp fmt webviews/test/agent-pane-peer-copy.test.ts scripts/cmux-next/base-autofix.sh: https://github.com/manaflow-ai/cmux/actions/runs/41050433356 * sidebar: a hover control stays lit while its menu is open, and lights alone (#27912) * sidebar: a hover control stays lit while its menu is open, and lights alone A workspace row's more, close and chevron followed isHovered alone, so they vanished as the pointer moved onto the row's open more menu. SidebarRowMenu now holds WorkspaceRowView.showsMenu for the synchronous popUp; the controls stay and OverflowButton.showsMenu keeps the more button pressed (lit). The row's fill does not change. A workspace tile's more menu reused the profile control's showsMenu, which paints the selected fill over the whole pill. The tile now holds its hover controls and lights only its more button; the profile control, whose pill is the control, keeps the selected step. A group header's open editor painted the hover step over the whole bar and did not light its trigger. The more button now stays lit whi…

teamleaderleo · 2026-11-01T10:33:51Z

W2-13 follow-up on merged #28172 — healthy peer briefs can vanish from a full first page

Source review at feat-cmux-next 277be6a1b1a296d98a8920db927712c9476fd08e; no runtime test run here. The concurrent-peer deadline and explicit peersFailed from this PR are good. There is a separate, deterministic first-page completeness/order bug in server/requests/briefs.rs:L108–177:

let mut rows = hub.briefs.list(status, limit) first fills the requested page from the local/cache ledger (up to limit, newest first; hub/dispatch.rs:L124–134).
The handler next fetches every connected peer successfully, appends new remote brief records to that full page and then answers rows.into_iter().take(limit). It never reorders the combined records by time.
Repro from code: 50 local briefs + one newer, healthy remote brief; _acpmux/briefs {limit:50} returns the 50 local records, silently omits the remote brief. peersFailed is absent because the peer answered. A subsequent read might find the cached remote row, which makes progress inspection misleading, and an older remote row can be perpetually crowded out.
agent_briefs_list MCP defaults to 50, caps at 200 and has no cursor, so agent consumers hit the same initial omission and have no unambiguous way to exhaust the result set.

Small owner-area fix: fetch bounded peer pages as today, dedupe on briefId, merge/sort the union by createdAt (stable ID tiebreak), then truncate to the requested limit; carry peersFailed as now. Preserve briefs and existing RPC field names for old clients. Add has_more/an opaque cursor in a separate protocol change if an exhaustive history is required. An optional explicit incomplete when peer replies fail/are capped would avoid “everything reported” claims.

Falsifying regression: add to peer_briefs_tests.rs one local page filled to limit and one newer peer row; assert the newer row is returned once, correct ordering holds, and peersFailed is empty. Repeat through MCP agent_briefs_list and native _acpmux/briefs in a hosted test.

Ownership: this is a follow-up finding on the existing acpmux owner path, no competing PR or merge. It comes from W2-13 and builds on this PR's existing peer test.

teamleaderleo and others added 2 commits October 30, 2026 08:37

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 08:38 — with GitHub Actions Inactive

github-actions Bot added the risk:normal Risk tier (docs/ci/risk-tiers.md) label Oct 30, 2026

teamleaderleo temporarily deployed to ci-routing-agent October 30, 2026 08:58 — with GitHub Actions Inactive

teamleaderleo marked this pull request as ready for review October 30, 2026 09:03

teamleaderleo temporarily deployed to artifacts October 30, 2026 09:16 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to sentry-dsyms October 30, 2026 09:16 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to artifacts October 30, 2026 09:26 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to artifacts October 30, 2026 09:27 — with GitHub Actions Inactive

teamleaderleo temporarily deployed to artifacts October 30, 2026 09:28 — with GitHub Actions Inactive

This was referenced Oct 30, 2026

acpmux: a session list too large for one message goes in pages #28182

Merged

acpmux: a peer chat whose attach fails is attached again, and says why #28157

Merged

teamleaderleo merged commit 4a0b8f0 into feat-cmux-next Oct 30, 2026
233 of 247 checks passed

teamleaderleo deleted the lane/acpmux-briefs-fanout branch October 30, 2026 10:58

This was referenced Oct 30, 2026

Base red: acpmux panic ratchet (string_slice 98 > 94, indexing_slicing 703 > 693): rewrite the new hits without panics #28134

Merged

acpmux: a guest's prompt waits for the owner #26747

Closed

teamleaderleo mentioned this pull request Oct 30, 2026

acpmux ls: read the session list in pages (never one reply), --cursor, titles at most 200 chars #28373

Merged

Navigation Menu

Repository navigation

acpmux: briefs asks the peers at once and names each one left out - #28172

acpmux: briefs asks the peers at once and names each one left out#28172
teamleaderleo merged 2 commits into
feat-cmux-nextfrom
lane/acpmux-briefs-fanout

teamleaderleo commented Oct 30, 2026 •

edited

Loading

Uh oh!

blacksmith-sh Bot commented Oct 30, 2026

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

cursor Bot commented Oct 30, 2026

Uh oh!

teamleaderleo commented Oct 30, 2026 •

edited

Loading

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

teamleaderleo commented Nov 1, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

teamleaderleo commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Performance

Test

Observed / Not run

Changelog

Uh oh!

blacksmith-sh Bot commented Oct 30, 2026

Failures

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

cursor Bot commented Oct 30, 2026

Bugbot needs on-demand usage enabled

Uh oh!

teamleaderleo commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teamleaderleo commented Nov 1, 2026

W2-13 follow-up on merged #28172 — healthy peer briefs can vanish from a full first page

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

teamleaderleo commented Oct 30, 2026 •

edited

Loading

teamleaderleo commented Oct 30, 2026 •

edited

Loading

github-actions Bot commented Oct 30, 2026 •

edited

Loading