[teamleaderleo]

Summary

Base red: classic API guard / classic-api-guard fails on every PR into feat-cmux-next since about 09:10Z (#34711, #35173, #35174, #35175, #35178). The guard (added by #35126) lists the PR's files over REST, and that call fails with gh: API rate limit exceeded for installation (HTTP 403), so the step exits 1 before the guard runs.

When the REST listing fails, the step now reads the changed paths from refs/pull/N/merge instead: a depth-2 blobless fetch, then git diff --name-only --no-renames merge^1 merge. Its first parent is the base, so the diff is what the PR changes, and --no-renames lists a rename as both its old and new path, as the REST listing did. If that fails too (no merge ref, e.g. a conflicting PR), it warns and passes into feat-cmux-next, where the guard only warns anyway, and still fails into main.

Testing

• Fallback by hand: the fetch plus diff against refs/pull/35174/merge listed 6 paths. acpmux: wait for live daemon peers #35174 changes 6 files.
• python3 tests/test_classic_api_guard.py (13 OK), tests/test_ci_guard_workflow_structure.py, tests/test_ci_runs_on_values.py, actionlint on the workflow: all pass.

Observed / Not run

Observed: the commands above. Not run: a live run where REST fails. The workflow runs from the PR's own copy, so this PR's own check runs the new step.

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the classic API guard so it no longer fails on every PR into feat-cmux-next when the REST file listing hits the installation rate limit (HTTP 403).

• Adds a fallback that reads changed paths from refs/pull/N/merge using a depth-2 blobless fetch and git diff --name-only --no-renames.
• The merge ref is used only when its parents match the event's base and head SHAs, so a stale ref is ignored.
• If both listings fail, the check warns and passes into feat-cmux-next (where the guard only warns) but still fails into main.

^{Written for commit 5044fdd. Summary will update on new commits.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 5044fdd: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr35202 -f ref=fix/base-red-clippy-classic-guard -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 9d33307 to compare; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4182499138501 (e0aa712b3b)
• cmux NEXT nightly 1.0.0-nightly.4184087390301 (08052d331e)
• cmux NEXT nightly 1.0.0-nightly.4184224384601 (a3abfc4160)
• cmux NEXT nightly 1.0.0-nightly.4184409870901 (78ee0e108e)

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (subagent opus medium): SHIP at 48f1472

Checked set -e/pipefail behavior (every failure is inside an if), the git auth header form, that a partial paths.txt is overwritten, that --expected-files still matches (renames give two lines both ways), that no PR code runs, and that into main every failure path exits 1.

Follow-ups:

• F1 [follow-up] outcome:pending: refs/pull/N/merge can lag a synchronize push; check merge^2 against the PR head sha.
• F2 [follow-up] outcome:pending: the base64 token is in git's argv; pass it through GIT_CONFIG_* env instead.
• F3 [follow-up] outcome:pending: when the base already contains part of the change, the merge-ref diff can list fewer paths than changed_files, a spurious red into main (fails closed).

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
nightly cmux-tui resolve/nightly cmux-tui resolve	View Logs
the short nightly decide gate must use the pooled Linux route with a Blacksmith fallbac k/ the short nightly decide gate must use the pooled Linux route with a Blacksmith fallbac k	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, via router-review; carried because its --post hit a spent REST quota): SHIP at 48f1472

Visual verdict: no images; Leo tries the build

Checked the fallback's shell/Git behavior and the classic guard tests; no actionable correctness, security, or reliability issues found.

Follow-ups: none

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, next-review, since=20261104T101555Z): SHIP at 48f1472

SHIP at 48f1472

Visual verdict: unchanged by this diff

• [P2] [follow-up] [category:reliability] [finding:F1] [outcome:pending] Lines 68–70 fetch the mutable refs/pull/$PR/merge instead of the event’s merge SHA. If the PR or base changes during an old run, the fallback can compare a different merge against the checked-out base and classify the wrong paths. Pin the fetch to github.sha and verify its second parent matches the event head.

Follow-ups:

• [P2] [follow-up] [category:reliability] [finding:F1] [outcome:pending] Pin the fallback to the event’s merge SHA and verify its parent.

[teamleaderleo]

Review (codex, router-review): SHIP at 48f1472

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at 48f1472

Visual verdict: unchanged by this diff

Checked the fallback workflow logic, shallow merge diff behavior, and tests/test_classic_api_guard.py (13 tests passed).

Follow-ups: none

[cmux-bot]

cmux-bot approves 48f1472: an independent review passed this exact head (router-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

[teamleaderleo]

Review (codex, router-review): SHIP at 5044fdd

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at 5044fdd

Visual verdict: no images; Leo tries the build

Checked the fallback shell flow, merge-parent validation, rename handling, and targeted workflow tests; all pass.

Follow-ups: none

[cmux-bot]

cmux-bot approves 5044fdd: an independent review passed this exact head (router-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.