[lawrencecchen]

Summary

Follow-up to #33111. This branch contains the two commits of #33111. After #33111 lands, the diff here is only the last two commits.

1. A shared name is not a call of a Tunable helper. toggle, make and points are Tunable helpers. The old guard selected any declaration with a token of that name. For example, registry.bind("toggleSidebar") { ...model.toggle() } in AppActions.bindApp was selected, and the dependency walk then pulled in every handler's static func bind. Thus almost every app PR "changed a default". #32983 (OnboardingHandlers.swift:bind) and #32979 (NewTabPage.swift:paletteActions through HistoryHandlers.bind's closure make) were flagged only because of this.

Now a helper call counts only in two forms:

• Type.helper, where Type is declared in the helper's file
• a bare helper, in a file that declares one of the types of the helper's file (the same type or an extension of it)

x.helper and .helper are other members. The dependency walk is not changed.

Fingerprints on feat-cmux-next 38369c1: 6182 before, 449 after. No entry is added. All real helper callers stay, for example ChromeTunables.swift:space1, TabTunables.swift:compactTabWidth, MetricTunables.swift:sidebarWidth and every DropOverlayTunables entry. The bot-owned snapshot schemas/defaults/cmux-next.json is regenerated by base autofix; this PR does not edit it.

Results on the real diffs (defaults_guard.py check --base <merge base> --head <pr head>):

PR	old guard	this guard
#32983	tunable-source.CmuxNextApp/Handlers/OnboardingHandlers.swift:bind	no default change
#32979	NewTabPage+Open.swift:fillPaletteActions, NewTabPage.swift:paletteActions	no default change

2. Review findings from #33111

• If the write-access lookup for a receipt author fails, that author now counts for a BLOCK, never for a SHIP. Thus an unchecked receipt can only keep the guard red. Before, the receipt was dropped, so an unchecked BLOCK lost to an owner's earlier SHIP.
• If a lookup fails at the earlier head of a carried SHIP, the guard now names it in the error, as it does at the head. Before, it gave only a warning.

Regression command: python3 tests/test_defaults_guard.py

• Test commit 9094a65: 4 failures.
  • test_a_member_that_only_shares_a_helpers_name_is_not_a_tunable_source reproduces the bindApp/bind/make shapes.
  • test_an_unchecked_block_after_an_owners_ship_keeps_the_guard_red
  • test_an_unchecked_receipt_one_base_merge_back_is_named_in_the_error
  • test_a_receipt_whose_lookup_failed_is_named_in_the_error, for its new wording.
• Head: 72 tests OK.
• Real default changes are still caught:
  • The existing fixtures (helper, helper body, cross-file Factory.number, symbol, external symbol, dynamic, backticked) still fail without a review.
  • The new test_a_helper_called_from_an_extension_or_by_its_type_is_still_a_tunable_source covers an extension caller and a Type.helper caller in another module.
  • The name-collision test also checks that a real helper default change is still caught.

Observed / Not run

Observed:

• The fingerprint counts before and after on the feat tree.
• Both PR diffs, run through the old and the new guard.
• The test red and green results above.
• scripts/cmux-next/prepush-gate.py is clean.

Not run: a live pull_request_target run. The guard runs from the PR base, so this change is first used by PRs whose base contains it.

Changelog

none

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the defaults guard matching any token that shares a Tunable helper's name (toggle, make, points) as a helper call, which flagged nearly every app PR as changing a default; a helper now counts only for calls that can actually reach it, including Self.helper, typealiases of Tunable, and subclass or protocol-inherited helpers. This drops the fingerprint count on feat-cmux-next from 6182 to 449, and #32983 and #32979 no longer report default changes. Also makes an unchecked receipt whose author's write-access lookup fails count for a BLOCK only, so it can keep the guard red but never green.

• A call owner's receipt is trusted without the write-access REST lookup, which was exhausting the shared API quota (Chief: import browser cookies from Chrome on request #32983).
• Failed lookups are now named in the error, including at the earlier head of a carried SHIP, whose author's SHIP no longer counts but whose BLOCK does.
• Calls through a generic parameter (e.g., T.points) are still not matched.

^{Written for commit ef33467. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 65e1e63: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33161 -f ref=fix/defaults-guard-tunable-helpers -f platform=macos -f backend_mode=local

web and size checks: green

Default changes

This pull request changes 1 default at ef334672c952 (what everyone gets without configuring anything):

• guard.scripts/ci/defaults_guard.py: (none) -> "edited"

Signed off on this commit by review (independent-subagent, correctness first), carried from 65e1e63e464f across base merges.

Merge receipt: merged as eb55f4e11175 with these defaults changed, signed off by review (independent-subagent, correctness first), carried from 65e1e63e464f across base merges.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4160373381601 (d485585f77)
• cmux NEXT nightly 1.0.0-nightly.4160614853601 (0e8eb9bf99)

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[lawrencecchen]

Review (independent-subagent, correctness first): SHIP at 3a0a2e2

• First pass: BLOCK. Self.points(...) was no longer seen as a Tunable source. Fixed in 1e609b7 (red test) and 3a0a2e2. Self., typealias, subclass and protocol-extension helper calls are now caught.

• Feat tree: 6182 fingerprints before, 449 after. Every one of the 449 is in the old set. Chief: import browser cookies from Chrome on request #32983 and perf(new tab): Cmd-T makes the next spare after its open settled; the bar's palette actions are read in background slices #32979 report no tunable-source change.

• python3 tests/test_defaults_guard.py: 73 tests pass. The new test fails in all 6 subtests at 1e609b7.

• Still missed, rare, not used with any Tunable helper in the tree today (follow-up):

  • a conformance or subclass declared in another file
  • a subclass or protocol chain of more than one level
  • a nested generic clause
  • a typealias of a helper's type
  • a local let T = X.self

  Note: a file-scope constant used as default: was missed before this PR too.

[lawrencecchen]

Review (independent-subagent, correctness first): SHIP at 65e1e63

• 65e1e63 is a merge of origin/feat-cmux-next (7c578ac) into 3a0a2e2. git diff 3a0a2e2d60f 65e1e63e464f154db412f5ba13c8aac235061b04 -- scripts/ci/defaults_guard.py tests/test_defaults_guard.py is empty.
• The PR's diff against feat touches only those 2 files. It is the same patch as the 4 commits reviewed at 3a0a2e2. The merge took feat's 81a6951 (defaults guard: a call owner's SHIP counts when the REST quota is spent (#32983) #33111 squash), whose two files are identical to e0d7252 on this branch, so the merge lost nothing.
• python3 tests/test_defaults_guard.py at the head: 73 tests OK.
• The non-blocking findings from the 3a0a2e2 review still apply.