[teamleaderleo]

Leo, 2026-11-05: "You guys keep running into these. These are weird issues that I feel like you should be able to just fix beforehand and check on beforehand."

The open follow-ups from #36260, #36265, #36579 and #36592, in one PR. Each check that stops a hand-named field from drifting across a boundary now covers the cases it missed.

Webview to Swift bridge (agentBridgeContract.test.ts)

• The scan also finds senders that arrive as object properties (opts.send(...)), destructured parameters ({ post }, { send: s }, defaults included), and destructured locals (const { postNative: post } = deps). The self-test covers each shape, plus a daemon sender passed by object that it must not report.
• On its first run it found git.capabilities in checkpoints/controller.tsx, which no app serves. It is now listed under unserved in schemas/agent-bridge/contract.json with the reason. The Swift test fails once AgentPageOps serves it.

Swift to acpmux (scripts/ci/check-swift-acpmux-protocol.py)

• A closed object schema with no properties (additionalProperties: false) now allows no keys. Before, it allowed any key.
• The Swift method list and knownParams are tokenized as Swift strings: raw (#"..."#), multiline ("""), and strings containing ] or ,.
• _meta.acpmux keys are checked against the new closed AcpmuxRequestMeta type in the spec. That covers knownParams' meta set and the pane's writes (acpmux["k"] =, setAcpmuxMeta, setDecision(field:)). The check fails if the spec has no AcpmuxRequestMeta.
• acpmux (protocol/params.rs): all 65 methods the app sends now have closed params schemas (63 were untyped). The keys come from each handler's reads. AcpmuxRequestMeta lists the 68 keys acpmux reads from params._meta.acpmux. The IR and the web methods.ts/types.ts are regenerated, so most of this diff is generated. Three new allowlist entries, each with its reason: noProject is the pane's own key, stripped by AcpmuxPathPolicy before sending. ownerCloud and features are reply keys that RemoteAcpmuxWire writes when it answers initialize as the remote daemon.

CLI to app actions (cli/app.rs, action_argument_contract.rs)

• cmux open-remote --focus [true|false] and --focus=false now reach the action's own focus argument. Before, only --arg focus=... reached it. The run's own focus follows the same value. An action without a focus argument keeps --focus as the run's focus only.
• open_remote_focus_reaches_the_action pins those spellings.
• every_argument_named_like_a_cli_flag_reaches_its_action checks every argument an offered action takes whose --flag the CLI also owns. Each one must reach the action through that flag, or be listed in GLOBAL_FLAG_ARGUMENTS with the spelling that does reach it. Today four are listed: session on agent open, agent open-tab, remote connect and history resume, all reached with --arg session= or cmux action run ... --session. A new collision fails the test. So does a stale entry.
• cli-action-requests.json is regenerated: open-remote now sends focus through --focus.

After screenshots don't apply: this changes contract checks and the CLI's argument encoding only, with no UI.

Checks, all on fleet Linux:

• cmux-tui: action_argument_contract 6/6, clippy -D warnings on cmux-tui and acpmux, fmt.
• acpmux: protocol tests.
• Webviews: bridge contract 3/3, fmt.
• check-swift-acpmux-protocol.py on the repo, plus its 13 unit tests.

The review's follow-ups (multiline method literals in the app-wide scan; compression and any other request key missing from AcpmuxRequestMeta) are filed as follow-ups from the review receipt.

every_safe_transport_operation_has_a_noun_first_path (git.diff base/head) and root_help_lists_every_scope... (remote-host) fail the same way on base 424f297. They are not from this PR.

Takes back #28098: its untyped(method::…) registry line in acpmux/src/protocol/mod.rs is now keyed::<…Params>(method::…) with a closed params schema; the method, its kind and its handler are unchanged (the IR still lists all 292 methods).
Takes back #28859: its untyped(method::…) registry line in acpmux/src/protocol/mod.rs is now keyed::<…Params>(method::…) with a closed params schema; the method, its kind and its handler are unchanged (the IR still lists all 292 methods).
Takes back #29003: its untyped(method::…) registry line in acpmux/src/protocol/mod.rs is now keyed::<…Params>(method::…) with a closed params schema; the method, its kind and its handler are unchanged (the IR still lists all 292 methods).
Takes back #30188: its untyped(method::…) registry line in acpmux/src/protocol/mod.rs is now keyed::<…Params>(method::…) with a closed params schema; the method, its kind and its handler are unchanged (the IR still lists all 292 methods).
Takes back #30879: its untyped(method::…) registry line in acpmux/src/protocol/mod.rs is now keyed::<…Params>(method::…) with a closed params schema; the method, its kind and its handler are unchanged (the IR still lists all 292 methods).

Changelog

• CLI: cmux open-remote --focus false now opens the remote pane without focusing it, as the action's own focus argument says.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Closes the contract-check follow-ups from #36260, #36265, #36579 and #36592: each check that stops a hand-named field from drifting across a boundary now covers the cases it missed.

Bridge and Swift-to-acpmux checks

• The webview scan now catches senders passed as object properties or destructured parameters and locals; this caught git.capabilities, now listed as unserved in the agent-bridge contract.
• Closed schemas with no properties reject any key, Swift method strings tokenize as raw and multiline strings, and _meta.acpmux keys must appear in the new closed AcpmuxRequestMeta.
• All 65 methods acpmux serves now have closed params schemas derived from handler reads; AcpmuxRequestMeta covers the 68 _meta.acpmux keys. The IR and web types are regenerated, so most of the diff is generated.
• Three allowlist entries added: noProject (the pane's own key, stripped by AcpmuxPathPolicy) and ownerCloud/features (reply keys for initialize).

CLI action arguments

• cmux open-remote --focus [true|false] and --focus=false now reach the action's own focus argument; only --arg focus=... did before.
• A new contract test fails on any action argument whose --flag the CLI owns and that can't reach the action through that flag; four session cases are listed in GLOBAL_FLAG_ARGUMENTS. cli-action-requests.json is regenerated.

Changelog: cmux open-remote --focus false now opens the remote pane without focusing it. Two test failures (every_safe_transport_operation_has_a_noun_first_path, root_help_lists_every_scope...) also fail on base and are not from this PR.

^{Written for commit 97e8c40. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 58414b0: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr36820 -f ref=contract/followups-3 -f platform=macos -f backend_mode=local

Passes: CI passes on 58414b0d4a.

CI passes on 58414b0d4a (run 42128088684 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

Gallery before/after for 58414b0: 16 states rendered, 0 images differ, 3788 more touched states not rendered. Images are in the run's artifact, not on this public PR; the independent review of this head reads them on its own, so the PR needs no hand-made screenshots of these states.

gh run download 42128088132 -R manaflow-ai/cmux -n gallery-advisory-36820-58414b0d4ab402ac251415dd5dc6aa5f81ecbdc4 (then read gallery-review.json)

States

State	Theme	Status	Diff	Picked by
agent-pane.live-chat-watch/choice-alone	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/choice-alone	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/take-over-refused	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/take-over-refused	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.access-offer/turn-no-credits	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-no-credits	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-low-credits	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-low-credits	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-no-offer	Apple System Colors Light	unchanged	0%	imports types.ts (2 hops)
agent-pane.access-offer/turn-no-offer	Apple System Colors	unchanged	0%	imports types.ts (2 hops)
agent-pane.approval-edits/single	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-multiedit	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-multiedit	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-multiedit	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-multiedit	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-long	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-long	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-long	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-long	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)

_{Pick other states with a Gallery: entry.id, entry.id/variant line in the PR body.}

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (codex, router-review): SHIP at 97e8c40

Reviewer: codex gpt-6-astra high, fast tier.

Follow-ups: 2. They land as checklist items in this PR's one follow-up tracking issue in this repo (Follow-ups: #N ..., label follow-up; add to an open one before filing, never one issue per finding), linking this receipt; the lane that opened the PR fixes them forward.

SHIP at 97e8c40

Visual verdict: no images; Leo tries the build

• [P2] [follow-up] [category:tooling] [finding:F1] [outcome:pending] The app-wide Swift scan still applies METHOD_SHAPE line-by-line (scripts/ci/check-swift-acpmux-protocol.py:38-40,281-291), so a multiline literal containing an unquoted method name is invisible. Tokenize all Swift literals there and add a regression test.

• [P2] [follow-up] [category:correctness] [finding:F2] [outcome:pending] AcpmuxRequestMeta is closed but omits the valid compression request key (cmux-tui/crates/acpmux/src/protocol/params.rs:57-72); peers already send it during initialize (cmux-tui/crates/acpmux/src/peer.rs:1462-1464) and the server reads it (frame_compress.rs:41-46). The generated schema/types therefore reject an existing supported request. Include all request metadata keys or keep this nested object open.

Follow-ups:

• F1: Cover multiline Swift method literals in the global scan.
• F2: Complete the request metadata schema, including compression.

[cmux-bot]

cmux-bot approves 97e8c40: an independent review passed this exact head (router-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.

[teamleaderleo]

Review (codex, router-review): SHIP at 58414b0

Reviewer: codex gpt-6-astra high, fast tier.

Follow-ups: 2. They land as checklist items in this PR's one follow-up tracking issue in this repo (Follow-ups: #N ..., label follow-up; add to an open one before filing, never one issue per finding), linking this receipt; the lane that opened the PR fixes them forward.

SHIP at 58414b0

Visual verdict: no images; Leo tries the build

• [P2] [follow-up] [category:correctness] [finding:F1] [outcome:pending] AcpmuxRequestMeta is closed but omits request keys such as class and topic, which acpmux send --class/--thread places in session/prompt metadata (output.rs, params.rs). The generated schema/types therefore reject or cannot represent valid requests.

• [P2] [follow-up] [category:correctness] [finding:F2] [outcome:pending] --focus=anything on an action with a focus argument silently becomes true; the parser only treats the literal "false" as false (app.rs). Invalid inline boolean values should produce a usage error.

Follow-ups:

• F1: Complete AcpmuxRequestMeta with all request metadata keys and add coverage.
• F2: Reject invalid inline --focus values.

[cmux-bot]

cmux-bot approves 58414b0: an independent review passed this exact head (router-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.