[teamleaderleo]

Leo asked his Chief for "a pinned Needs you view in Chief Home, Feed and iPhone listing items waiting on Leo (PRs held for his trial like #30817, sign-ins, approvals, consent cards), plus an iPhone push when one appears."

This PR covers the sign-ins. When a subagent calls escalate_auth, the Chief drives the sign-in in Home's right pane and posts one line in its own chat ("Needs you: touch the sensor (SITE)"). Nothing reached the Feed, so the sign-in was missing from the Feed's pinned Needs you section and from anything that reads the Feed (Home, iPhone, push).

What changes

• New optchat-chief/src/needs_you_feed.rs. On escalate_auth, the brain posts one open Feed request through the app's existing feed.request control method on CMUX_SOCKET_PATH. It reaches the socket the same way subagent workspaces and cloud_workspace already do.

  • A passkey escalation becomes a passkey request. password, 2fa and oauth become a sign-in request: origin, page URL, reason, and the subagent's session as context.
  • The dedupe key is chief-auth:<chief id>:<subagent>:<site>, so a repeat escalation joins the open item.
  • Priority is the kind's default (high), so it gets the Feed's push.

• The request closes (feed.cancel) when either of these happens:

  • The Chief tells that subagent it is signed in. This is the skill's tell(aN, "Signed in to SITE ...; go on."), and the message must name the site unless it is the subagent's only open sign-in. Reason: answered_elsewhere.
  • The subagent is cancelled (control cancel, or any stop that settles it as cancelled). Reason: poster_gone.

  Otherwise it lapses after an hour (expires_in_ms), which is longer than any sign-in page waits.

• Posts and cancels run in order on one worker thread, off the brain's loop. Stop condition: the thread ends when the brain drops its sender (the host stops). No timer or poll is added.

• No app, so no CMUX_SOCKET_PATH (a CLI or Cloud Chief): nothing is posted.

The Swift side doesn't change: FeedControl's feed.request/feed.cancel already exist. No UI and no default change. #22646 and #24071 are untouched.

Not localized: the title and body ("Sign in to npmjs.com", "a1 needs it: ...") are the Chief's own English text, like its chat lines. The Feed row's kind label and buttons come from the app's localized strings.

Testing

tests/needs_you_feed.rs (5 tests) uses a recording FeedPort and the brain harness:

• An escalation posts an open sign-in request with its key, origin, URL, reason and expiry.
• A passkey escalation posts a passkey request.
• An unrelated tell leaves the request open, and "Signed in to npmjs.com ..." withdraws it.
• control cancel withdraws it with poster_gone.
• Site matching.

Results:

• Red at a5a1b41 (test only): the fleet Linux run (cargo test --locked --test needs_you_feed) fails to compile the test: error[E0432]: unresolved imports optchat_chief::needs_you_feed.
• Green at 1818b01: the fleet Linux run of the whole crate (cargo test --locked --no-fail-fast in optchat-chief) passes (CARGO_EXIT=0, no failed test anywhere), needs_you_feed included.
• Head b070fab adds the review's first two fixes: one idempotency key per escalation, and "not signed in yet" no longer closes the request. The same whole-crate fleet run passes at this head (CARGO_EXIT=0).
• cmux-ci fresh-home passes at both 1818b01 and b070fab: Home appeared at 6.6 s and the app stayed up 30 s with no crash.

Not run

• No live run of a real escalation against a signed-in app yet.

Chief area (Native/OptChat/optchat-chief/): independent review at the head, whole-crate tests with no failure (so there is nothing to compare against base), a fresh-home launch on a fleet Mac, and a review request to @lawrencecchen, who has the most commits on these paths in the last 30 days. The request is for awareness and doesn't hold the merge.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Review (subagent claude-opus-5-5 medium): SHIP at b070fab

Visual verdict: no UI code changed.
Checked: the posted params against FeedPost and the sign-in/passkey prompt schemas; the feed.request/feed.cancel request shapes against FeedControl.swift and control_call/reply_result; the worker thread keeps each post ahead of its cancel and ends when the sender drops; the code compiles under edition 2024 by reading; the tests wait on deadlines, not sleeps. Two findings from the review at 1818b01 are fixed in b070fab: each escalation now gets its own idempotency key, and a negated "not signed in" message no longer closes the request.

Follow-ups:

• [follow-up] A subagent that finishes normally (not cancelled) leaves its request up until the 1 h expiry. Requests open when the Chief host restarts stay up the same way, because the open list lives only in memory.
• [follow-up] cut counts Rust chars, while the schema's isMaxLength counts UTF-16 units, so text with non-BMP characters near a limit could fail validation. That failure only shows in the log.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review b070fab: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33850 -f ref=needs-you-signin-feed -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4165528235801 (b08cc6f4d3)
• cmux NEXT nightly 1.0.0-nightly.4165709173201 (7f6fe51cc3)
• cmux NEXT nightly 1.0.0-nightly.4165880669801 (de5076464a)
• cmux NEXT nightly 1.0.0-nightly.4166004947701 (abcde7ea04)

[teamleaderleo]

@lawrencecchen for awareness, since this is Chief code you own most of: escalate_auth now posts an open Feed sign-in/passkey request through the app's feed.request (new needs_you_feed.rs, plus small hooks in brain/control.rs, brain/spawns.rs, brain/mod.rs and host.rs). It is withdrawn when the Chief tells the subagent it is signed in, or when the subagent is cancelled. This isn't a wait gate.

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex, router-review): SHIP at b070fab

Reviewer: codex gpt-6.1-sol xhigh, fast tier.

Follow-ups: 5. Each lands as an issue in this repo that links this receipt; the lane that opened the PR fixes it forward.

SHIP at b070fab
Visual verdict: no images; Leo tries the build

1. [P2] [follow-up] needs_you_feed.rs:129: Route the row to the waiting Chief pane. “Sign in” and “Use passkey” call model.open, whose installed handler opens context.url in a new browser tab outside Home. The invented browser_tab has no resolver, so clicking cannot reveal the pending passkey ceremony.

2. [P2] [follow-up] needs_you_feed.rs:245: Recover open requests after a host restart. Both request tracking maps start empty, while Feed items survive. Subsequent completion messages and cancellations cannot withdraw those items, leaving them pinned until expiry.

3. [P2] [follow-up] needs_you_feed.rs:174: Require an affirmative completion statement. Both “Once you are signed in to npmjs.com, continue” and “You are not yet logged in to npmjs.com; wait” currently close the request prematurely.

4. [P2] [follow-up] needs_you_feed.rs:263: Keep the complete idempotency key within the backend’s 128-character limit. A valid 90-character hostname already produces a 129-character key with an eight-character Chief ID, so its escalation is rejected without creating a Feed item.

5. [P2] [follow-up] needs_you_feed.rs:133: Supply an after screenshot of a real sign-in request in Needs you; none was available.

Rust tests could not run because Cargo is absent.

Follow-ups:

• Route sign-in actions to the waiting Chief pane.
• Recover outstanding requests across host restarts.
• Prevent conditional and negative messages from closing requests.
• Bound idempotency keys to 128 characters.
• Capture the new row in a live build.