[teamleaderleo]

Fixes a base crash in the cmux NEXT swift tests (and the same trap in the app).

What breaks

#27102 reads the page's _acpmux/status natively: AgentPaneTransport.analyze starts a detached AcpmuxStatusClient.call(socketPath:) on the connection's socket path. call builds NWConnection(to: .unix(path:)), and NWEndpoint.unix traps (SIGTRAP inside Network.framework) on a path longer than the Unix socket limit (103 bytes) or an empty one. LocalRouterClient.endpoint already documents and guards this trap; the status client did not.

AgentPaneSendPickedFolderPromptTests.journalReplayWaitsForDeferredTrustAcknowledgement opens a connection on <temporary folder>/send-picked-<UUID>/acpmux.sock (about 117 bytes) and sends a status, so the swift test process dies:

• Fleet replays of CmuxNextAgentPaneTests.Ag at base 214b514 and at 5a39be4 (that base plus cmux-next swift test: main-thread-heavy suites in their own processes, the broad pass sharded, SIGPIPE caught as in the app #26809's shard changes): both end with swiftpm-testing-helper ... exited with unexpected signal code 5 in journalReplayWaitsForDeferredTrustAcknowledgement(recovery:), case 0.
• CI (cmux-next swift test, run 41119535319): with SWIFT_BACKTRACE set, the trap instead hangs in _swift_spawnBacktracer → __wait4 until the stuck watchdog ends the shard (exit 143). The sample shows closure #1 in AgentPaneTransport.analyze (AgentPaneTransport+Check.swift:45) → AcpmuxStatusClient.call (AcpmuxStatusClient.swift:223) → Network → _sigtramp → handle_fatal_signal.

Fix

AcpmuxStatusClient.unixEndpoint(_:) refuses an empty path or one past AcpmuxEnvironment.maxSocketPathBytes with Failure.unreachable. call and AcpmuxEnvironment.watchHarnesses (the other .unix(path:) site in the module) use it, so the page gets its normal "status unavailable" error and the process lives on. Production paths from AcpmuxEnvironment are already short-aliased; this covers a connection whose socket path is taken as given.

Tests

AcpmuxStatusLongSocketPathTests: call on a 104- and 160-byte path and on an empty path throws; a 103-byte path still makes an endpoint; the page's status on a connection with a 160-byte socket path is answered with an error. Without the guard, call on such a path traps the test process: the base replay below, and #28495's red refs, which show the trap's frame in AcpmuxStatusClient.call.

No capture: nothing on screen changes; a path that used to crash the app now gets the page's existing "status unavailable" error.

Risk: low. Only paths that trapped before change behavior; they now fail like an absent daemon.

Overlap

#28495 fixes the same trap more widely (a shared NWEndpoint guard in CmuxNextCompat, plus the mobile daemon lane and the Cloud hub opener). An independent review blocked it at 4999e4b: its .socketPathTooLong escapes AcpmuxEnvironment.harness, which maps only .unreachable to the documented AcpmuxRPCError with isUnreachable. This PR is the narrow fix for the base crash and maps the refusal to .unreachable, so every existing unavailable-daemon path handles it. #28495's other sites stay with it.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 5 test failures on Blacksmith runners:

Failures

Test	View Logs
main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/ test_download_prints_the_active_profile_only	View Logs
stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/ Security has no stub	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/ CoreFoundation, missing 1: ['_CFRetain']	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/ CoreFoundation, missing 1: ['_log2']	View Logs
test_the_ten_first_party_gpl_crates_are_named_exactly (main.AppCrateLicenseGate.tes t_the_ten_first_party_gpl_crates_are_named_exactly)/ test_the_ten_first_party_gpl_crates_are_named_exactly (main.AppCrateLicenseGate.tes t_the_ten_first_party_gpl_crates_are_named_exactly)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high fast, independent review): SHIP at 47f543f

No blocking problems found.

• The guard accepts 103 UTF-8 bytes, rejects 104 and empty paths, and preserves .unreachable handling.
• Refused watches finish without connections, callbacks, or retries.
• The status-error expectation and page ID mapping are consistent; the stand-in never binds the oversized path.
• Deferred-trust replay appears compatible: trust acknowledgement releases replay independently of status success.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 47f543f: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28630 -f ref=fix--acpmux-status-long-socket-path -f platform=macos -f backend_mode=local

Default changes

This pull request changes 2 defaults at 47f543fb85c3 (what everyone gets without configuring anything):

• tunable-source.CmuxNextAgentPane/AcpmuxStatusClient.swift:call: "1cb8eba9689ce18fc69f4a22c40b9a4a115624d5848ca240dd7381553d53d839" -> "68cfee5db786297c0cb8f4914c52627d46890e24dba68143372313103f54cf83"
• tunable-source.CmuxNextAgentPane/AcpmuxStatusClient.swift:unixEndpoint: (none) -> "e7de1a61475aebd5c894e792f823f320900935176049586515f8fedcb01ad27c"

Signed off on this commit by review (codex gpt-6-astra high fast, independent review).

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

[teamleaderleo]

Closing: #28495 landed the same guard on feat-cmux-next (432fb31), so this one is superseded. On this head, its swift test passed the new suite and journalReplayWaitsForDeferredTrustAcknowledgement, the test that used to crash.

One point from the review here still holds for the merged code: AcpmuxEnvironment.harness maps only Failure.unreachable to AcpmuxRPCError.unreachable, so a too-long socket now surfaces as Failure.socketPathTooLong instead of an unreachable daemon. That fix belongs in a separate follow-up.