#20752 agent pane: page the session list through the host's pane policy (cx-2lv1k)

cx-2lv1k. Re-lands #20644, which was reverted in #20717 (P1 cx-ibngi). This time the host's pane policy allows the new requests.

What #20644 missed

The page asked _acpmux/watch for a limit and read later pages with _acpmux/sessions {limit, cursor}. The cmux host's pane policy allowed neither, so it refused both and local chats lost their session list. The browser tests talked to a stand-in daemon directly, so they never crossed the policy.

Change

• Host policy: the Swift pane policy (AcpmuxPaneMethods.requests, knownParams) and its Rust mirror (cmux-agent-pane-policy/policy.json) now allow:

  • _acpmux/watch with limit;
  • _acpmux/sessions with limit/cursor.

  acpmux answers both from the same handler over the same session summaries (session_list_reply(hub.all_session_summaries(), …)), so the pane sees nothing it did not already see through watch. Two frame cases used _acpmux/sessions as an example of a method the pane may not send. They now use _acpmux/web_token_rotate, which stays refused.

• Page: the #20644 pager (sessionPages.ts, direct.ts) is back. When the pane needs the whole list at once, it now sends watch with no limit instead of _acpmux/sessions {}, and every host already answers that. Remote panes never page: their host's watch reply carries only the pane's own session and no nextCursor, so they never send _acpmux/sessions (which RemoteAcpmuxWire refuses).

• Tests that now cross the policy:

  • the stand-in daemon in agent-pane-session-pages.test.ts refuses whatever policy.json refuses, the same way the host does, and a final test asserts nothing was refused;
  • the allowlist test (tests/typescript.rs) also scans sessionPages.ts.

Verification

• Rust policy test (cargo test -p cmux-agent-pane-policy):
  • red at fc033f3: params_rule fails "_acpmux/watch every known param", and frames fails "request _acpmux/sessions passes: got Refuse { MethodRefused }";
  • green on the head: 16 + 4 passed.
• Browser test (agent-pane-session-pages.test.ts, Chromium):
  • on the old policy, 4 fail with _acpmux/watch limit refused;
  • on the new policy, 5/5 pass.
• Other checks on the merged head:
  • Swift cross-compile passes;
  • ui-rules and gallery-coverage pass;
  • crash ratchet ok;
  • the god-file check reports no file this PR touches.
• bun run check fails only on a formatting issue in src/pages/home-channels/cloudHome.ts, which is on base and untouched here. This PR waits for that base fix before merging.
• Not verified: a live local NEXT chat. This PR relies on the policy tests above.

Changelog

• Fixed: agent chats open without waiting for a long session list to download, and the list still fills in behind them.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Pages the agent session list so opening a chat no longer waits for the whole list — the newest page opens the chat and the rest loads behind it. This re-lands the pager from #20644 (reverted in #20717) with the host side it lacked: the pane policy refused the page's new requests, so local chats lost their session list.

• The Swift pane policy and policy.json now allow _acpmux/watch with limit and _acpmux/sessions with limit/cursor; both answer the same session summaries.
• The whole-list read uses watch without a limit, which every host answers, so remote panes never page.
• The browser test's daemon now refuses what policy.json refuses, and the policy allowlist test scans sessionPages.ts.
• The formatting-only change in cloudHome.ts is applied, so the previously blocking bun run check failure is resolved.