[lawrencecchen]

Summary

Agents open their splits, files, diffs and pages in their own workspace, and Chief opens a task's things in that task's workspace (Lawrence 2026-11-02: "when there are a ton of workspaces, agents ... should open it in the same workspace ... careful with chief as well"). Also the r17 instruction changes (panes and columns are cmux objects; open names its pane). It contains #29080 until that lands.

• Untargeted viewers go beside the caller. An MCP app_file_open, diff viewer or tab_new_browser call with no target went to the app's focused pane, which with many workspaces is often another workspace. It now goes through open's placement beside the caller, when the app places the caller in a pane (db021ca, c1ee0b7). A pathless diff names the chat's folder.
• Chief: "workspace of the task". In a Chief turn (CMUX_CALLER_HOME_CHAT=1), the open and cmux_exec descriptions say that a request with a workspace's name in it, or about its project, agent, server or files, opens in that workspace in the background, and Chief names the workspace. Only a request with no workspace opens beside Chief. The rule is not in the instructions, which would pass 2048 characters with it (30a49d8, ec6f6b4, a82b64b, af0e5f6; the rule starts each description).
• Evals. tests/tool-evals/cases/workspace.ndjson: 17 cases in a session of 6 workspaces where the person looks at another one (terminals, splits, files, diffs, sites, browser tabs, an asked-for other workspace, and Chief docked left). New checks stayed_in_workspace and new_panes. The stand-in app now opens an untargeted action in the focused pane and refuses unknown arguments, as the app does (it had hidden the leak).

Results (Claude CLI, MCP code mode, 2 samples per case, median per task)

Run	Model	Pass	Leaks	Tokens	Seconds
Before (r17d, 14 cases)	Opus 5.5	27/28	0	77k	18.6
Before (r17d, 14 cases)	Sonnet 5.5	24/28	0	57k	10.8
Before (r17d, 3 Chief task cases)	Opus 5.5	4/6	2	92k	27.8
Before (r17d, 3 Chief task cases)	Sonnet 5.5	2/6	4	57k	17.7
After (r18e, 17 cases)	Opus 5.5	34/34	0	78k	20.5
After (r18e, 17 cases)	Sonnet 5.5	31/34	2	57k	12.9
After (r18f, 7 Chief cases)	Opus 5.5	14/14	0	78k	14.9
After (r18g = head af0e5f6, 7 Chief cases)	Opus 5.5	14/14	0	67k	16.7
After (r18f, 7 Chief cases)	Sonnet 5.5	14/14	0	58k	12.8
After (r18g = head af0e5f6, 7 Chief cases)	Sonnet 5.5	14/14	0	77k	13.8

Changelog

• Changed: an agent's untargeted file, diff or page opens beside its chat in its own workspace, and Chief opens a task's things in that task's workspace.

Observed / Not run

• Red (rbx cargo test --locked -p cmux-tui --lib -- <filter>): e7bda04 an_untargeted_viewer_from_a_chat_opens_beside_it failed; effd0f1 the Chief test failed; 8ced5fd chief_tools_open_in_the_workspace_of_the_task, an_untargeted_viewer_from_a_chat_opens_beside_it and an_untargeted_diff_names_the_chat_folder failed.
• Red at 14b2987: chief_tools_open_in_the_workspace_of_the_task and an_untargeted_diff_names_the_chat_folder failed.
• Green at af0e5f6 (and before at a82b64b): cli::mcp cli::beside 193 passed; --test cli caller_selector 4 passed; clippy -D warnings 0; cmux_surface classic and browser_engine passed.
• Observed: the eval results above (stand-in app, daemons and MCP on rbx).
• Not run: GPT 6 Astra and GPT 6.1 Sol (Codex through the subrouter fails, Canary blocked by unisolated Codex OAuth credential subrouter#640). A tagged app dogfood. The app's own placement for a plain terminal that runs cmux file open with no target (Swift, ControlRouter.placeBesideCaller) is not changed here.

[lawrencecchen]

Correctness review (subagent) of 373848c, and resolution

Blocking: none. The reviewer checked the string continuations and escapes, that no test pins the old wording, that pane is the target pane taken before the page→tab conversion, that success() always gives an object structuredContent, the edition-2024 borrows, and the test against the Fake backend.

Non-blocking

• or_insert could keep an app's own pane field. Fixed in 00a36c4: insert, so the answer always names the target pane.
• "side by side" did not match where: below, which stacks the files. Fixed in 00a36c4: the hint now says "both in view … one above the other in that column".
• The added pane can take an answer about 45 bytes over MAX_RESULT_BYTES, because fit() runs first. Left as is: this is cosmetic, and the limit is a soft budget for the model's context.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[lawrencecchen]

rbx verification of 373848c: cargo test -p cmux-tui MCP filter 158 passed, 4 passed; clippy -D warnings 0; cmux_surface classic 2 passed; browser_engine 4 passed. 00a36c4 (two-line review fix) is under test, and an open-case eval run on its build follows.

[cubic-dev-ai]

No issues found across 4 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review af0e5f6: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr29178 -f ref=feat-cmux-next-tool-evals-r17 -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: No literal state roots (per-build isolation S7, cx-is1kf.8) is not red on the base dfc60a4; do not merge until green; see lane-rules

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp1enlfd2c/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmp28iut29w/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[lawrencecchen]

Correctness review (subagent) of the merge resolution 0294309 and the new commits up to a4199ca, with the resolution at aec62b6:

1. Redirect gate too wide (medium-high): fixed in c1ee0b7. An untargeted file open, diff viewer or tab new-browser call goes beside the caller only when the app places the caller in a pane (caller_scope::is_placed and a pane). A caller the app does not know, or a workspace with no pane, keeps the app's own placement. Regression: an_untargeted_viewer_from_a_chat_opens_beside_it (three unplaced callers).
2. in_progress retry key (medium): not changed. The error of open carries the app stage's key as idempotency_key, and open_idempotency_key next to it. fix(mcp): preserve open viewer pane when the app acknowledgement is lost (SW-10) #30752's open_splits_and_opens_in_one_call asserts this. A retry with the stage key can start a second open. @teamleaderleo: should the error's idempotency_key be the open's own key? I left your contract as it is.
3. Pathless diff picks the target pane's folder (medium): fixed in c1ee0b7. It now names the chat's folder (path: ".", which is made absolute against the chat). An empty or non-string path is not redirected. Regression: an_untargeted_diff_names_the_chat_folder.
4. Chief instructions past 2048 characters (medium): fixed in c1ee0b7 and ec6f6b4. The Chief rule moved from the instructions to the open and cmux_exec descriptions, only in a Chief turn. Regression: chief_tools_open_in_the_workspace_of_the_task, which also checks the Chief instructions are 2048 characters or fewer.

Low findings: a non-bool focus reads as false (unchanged, same as open). An untargeted call with where, as_text or a blank browser tab is not redirected (unchanged, follow-up). Harness: the eval stand-in now refuses an argument the action schema lacks, as the app does (63a365a).

Merge resolution 0294309: the reviewer found it correct.

Verification on rbx (Linux, cmux-rust-builder-1):

• Red: e7bda04 an_untargeted_viewer_from_a_chat_opens_beside_it failed; effd0f1 chief_instructions_open_in_the_workspace_of_the_task failed; 8ced5fd the three new regressions failed.
• Green at aec62b6: cargo test -p cmux-tui --lib -- cli::mcp cli::beside 193 passed; --test cli caller_selector 4 passed; clippy -D warnings 0; cmux_surface classic and browser_engine passed.

[lawrencecchen]

Second correctness review (subagent) of a4199ca..a82b64b, with the resolution at af0e5f6:

1. Medium: Chief's rule at the end of the cmux_exec description (about 6 KB) could be cut by a client. Fixed in af0e5f6: the rule starts the open and cmux_exec descriptions. Regression: chief_tools_open_in_the_workspace_of_the_task asserts that the description starts with the rule.
2. Low: a server whose allowed list has neither open nor cmux_exec gets no Chief rule. Not changed. Chief's server lists both.
3. Low: a file open with an idempotency_key of 129 to 200 characters would be refused after the redirect. Fixed in af0e5f6: such a call keeps the action's own path. Regression: an_untargeted_diff_names_the_chat_folder (long key case).
4. Low (test gap): path: "." is checked only in untargeted. Not changed. The reviewer confirmed that chat_path makes it absolute (open_tool.rs).

Checks the reviewer passed: both tools/list branches apply chief_rule; caller_has_pane matches caller_scope::apply; the stand-in refusal cannot reject a valid MCP call.

rbx: red at 14b2987 (chief_tools_open_in_the_workspace_of_the_task, an_untargeted_diff_names_the_chat_folder failed). Green at af0e5f6: cli::mcp cli::beside 193 passed; --test cli caller_selector 4 passed; clippy -D warnings 0; cmux_surface classic and browser_engine passed.

[lawrencecchen]

Review (independent-subagent): BLOCK at af0e5f6

The SHIP at 0e545f9 covered only the r17 instruction text and pane in open's answer. Everything below came after it: db021ca/c1ee0b7 (the untargeted-viewer interception), the Chief rule and the workspace evals.

Blocking: a second owner of beside-caller placement (db021ca, c1ee0b7; mcp.rs call, open_tool::untargeted)

• The app already owns this placement. ControlRouter.placeBesideCaller (ControlCaller.swift) places openBrowser and openDiffViewer for acpmux agent and Chief callers, and it runs only when request.target == nil. Now the MCP server sends an explicit target for every caller that system.identify places in a pane, and that includes every acpmux agent chat and Chief. So the app owner is bypassed for exactly the callers it was written for, and there are two placement rules for the same actions.
• This is a behavior regression in the real app:
  • openBrowser loses the same-kind rule (Leo 2026-10-31: a tab in the pane that already holds a browser, else a split below a lone pane, never a third column). open's right takes the geometric pane_neighbor_get pane and its shown tab, so a page can land in the terminal pane of the right column.
  • The app's besideCaller path is lost too: AgentBesidePlacement, the agent-tab marking, and newColumnBeside background placement. The app's besidePane also skips docked columns, and pane_neighbor_get does not.
• The PR says the root gap stays open: "ControlRouter.placeBesideCaller ... is not changed here". That gap is file.open missing from besideCallerActions, and terminal-id callers not placed. So cmux file open from a terminal still leaks into the focused workspace. This is a partial fix in a second layer. Under the standing rule (no second owner, root-cause fixes, REVIEW-STANDARD), the fix belongs in placeBesideCaller: add file.open, and accept a terminal_id caller. Then the MCP interception can be removed, and the CLI and MCP share one path (cmux-shared-behavior).
• Evidence gap: every eval ran against the stand-in app. The stand-in places an untargeted run in the focused pane for all callers, but the real app places agent and Chief callers beside the chat. So the evals measured the leak for a terminal caller only, and they do not show the real-app result for acpmux and Chief chats. No tagged app dogfood was run (the PR says so).

Not blocking

• Focus: none of the new paths requests a focus change (focus is sent only when true; Chief's rule says "in the background"). I found no focus steal in the Rust code. I did not verify this in the real app.
• The action contract does not apply here: this is the MCP server process, not an app action handler. The interception adds one extra system.identify round trip per untargeted viewer call, and nothing on the main thread waits for it.
• The Chief rule (prefix on open and cmux_exec in a CMUX_CALLER_HOME_CHAT=1 turn) is prompt text only. It is gated correctly, and the test checks its position and the 2048-character limit on the instructions. OK.
• The tests cover what they claim (the Rust unit tests, with red/green recorded in the body). The Swift side has no test, because nothing changed there.

CI on this head: no red is the PR's own

• cmux-next checks: the "No literal state roots" step fails on cmux-host/src/cloud/clone_mark.rs. That file is not in this PR. acpmux: a copied Cloud machine's first start stops inherited turns instead of continuing them #33140 brought it into the base, and base fixed it in base red: clone-mark asks role::acpmux_home for acpmux's home, no literal state root (after #33140) #33218.
• inventory (test_event_stream_drift_is_rejected) and nightly-guards / release-notary: these paths are not touched by this PR. Guest page: a link join does not stand in for an invite accept #34003 and perf(status indicators): one Cmd-Tab resyncs the indicators once, not once per notice #34002 are green on newer bases.
• clippy, cmux-next fast tier (cargo) and acpmux tests pass.

[lawrencecchen]

Lead: I removed ready-to-land after the independent BLOCK at af0e5f6 (comment 6609251823). The MCP interception adds a second owner of 'beside the caller' placement next to ControlRouter.placeBesideCaller, which Lawrence's standing rule rejects, and it bypasses the app's browser rule for agent chats and Chief. The principled fix is in placeBesideCaller itself: add file open and accept terminal callers, so the CLI and MCP share one path. Then drop the MCP-side interception. The evals must run against the real app (a tagged build), not the stand-in. Whoever owns this PR: please take it from there.