[teamleaderleo]

SW-10 — Preserve an MCP viewer when the app applied open but its acknowledgement was lost

Fixes the outstanding correctness review on merged #29080.

What was wrong

cmux mcp open({kind:"file", where:"below", ...}) first splits a pane, then issues the app's action.run to open a viewer. The MCP app transport can return state: "in_progress" when a reply is lost after the app accepted the action. open_tool.rs::call_open used to treat every isError:true as a definitive refusal and immediately pane_close its split, potentially deleting the viewer that successfully opened.

The same danger exists when a sticky-column update's response is uncertain.

Fix

• Introduce failed_open, which checks the existing typed MCP failure state.
• On in_progress, preserve the created pane; include created_pane, the original app idempotency_key (if present), and a recovery instruction in the MCP error receipt. The content text and structuredContent are generated from the same envelope.
• On a confirmed refusal and other definite errors, preserve the existing undo_split cleanup behavior.
• Use this handling for viewer-open and sticky-column errors, and the page-tab lookup path.

This is a deliberately bounded correctness repair. The separate larger improvement—stable whole-open IDs, guarded cleanup after user content arrives, and resumable multi-stage split+open—remains open. This patch refuses to destroy a possibly successful viewer when an acknowledgement is uncertain.

Test-first verification

The first commit (af641e542a63c7007a3ba4e83ff16285f82bfd51) adds an explicit lost acknowledgement after action.run scenario to the existing MCP open integration-style unit test. It asserts: in_progress receipt, original action key, created pane ID, recovery guidance and zero pane.close calls. The test's original definite-refusal branch continues to assert pane cleanup. Implementation follows in ce8ce541bdf09d1d89c9775293f0c70003afa13d.

Source base: feat-cmux-next@5f817fac2d9f8afa248f8be25064570c0f7677fd. Two files changed (MCP open code and MCP tests). No duplicate action registry, transport or global idempotency implementation.

Current verification: exact GitHub code/diff reviewed. This chat cannot run Rust locally; hosted PR checks and independent review are required before landing. Suggested focused test: cargo test -p cmux-tui --lib cli::mcp::tests::open_splits_and_opens_in_one_call, then the MCP test family and panic/clippy guard on the exact head.

SW-10 issue

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp8kahntcl/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpfn2c3k_9/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 788a5b7: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30752 -f ref=sw10/mcp-open-preserve-uncertain-20261101 -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: Web bundle key inputs (+4 more) is not red on the base 30b3f65; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4137634186201 (6ebdd6da98)

[teamleaderleo]

Owned by an agent session · session