fix(acpmux): guard remote session cancellation

Merged
AU
7d ago
+307-4

Summary

  • Route request-form and notification-form session/cancel through the remote origin and ownership guard.
  • Refuse Web and Peer cancellation of local-origin sessions while preserving local Unix cancellation and same-owner remote cancellation.
  • Preserve Web provenance when a Peer forwards a notification-form cancellation.
  • Assert the actual turn_end side effect for refused and allowed request/notification paths.

Testing

  • Red: ./scripts/verify-cmux-tui-hosted.sh --filter remote_request_and_notification_cancels_cannot_stop_local_sessions on test-only head 99850e67ad3: failed with Web request returning {} and no ownership refusal.
  • Green: hosted run 38846991989 on the corrected fixture: Linux test, lint, MSRV, and focused Web control regression passed.
  • Green: hosted run 38847830979 on current head 62a7bdfd25de: peer-hop notification cancellation regression passed.
  • Green: PR Rust/build lanes and focused same-tree checks passed.
  • Baseline blocker: cmux-next checks is red on Swift-only type-scale and package-convention violations in BrowserFitFrameView.swift, OmnibarStyle.swift, PageSelectionMenu.swift, and BuiltInAdBlockerSetting.swift; none are changed by this PR.

Review

  • Correctness-first subagent review found and the implementation fixed two issues: remote cancellation now continues through the Web control policy after ownership validation, and peer-forwarded notification cancels retain _meta.acpmux.via = "web" provenance.

Issues

Changelog

  • Fixed remote Web and Peer session cancellation to respect session origin ownership.

Issue lifecycle

Impact map

  • Source of truth and owner: cmux-tui/crates/acpmux/src/server/remote_guard.rs owns remote origin, ownership, and Web control checks; requests.rs owns request/notification dispatch.
  • Direct callers and sibling entrypoints inspected: request dispatch, notification dispatch, peer forwarding, Hub::cancel, resolve/resolve_remote, and existing prompt/mutation control paths.
  • Cross-surface effects: Web and Peer ACP callers now share the guard for both wire forms; local Unix and LocalApp behavior remains on their existing paths; no UI, persistence, localization, or release metadata changes.
  • Tests and evidence: remote_guard.rs covers Web and Peer refusal of local sessions, Unix cancellation side effects, same-owner Web request and Peer notification cancellation side effects, and Web policy refusal; peer_integration.rs covers peer-hop notification forwarding.
  • Residual risk: remote sessions are authorized by the existing remote_origin ownership boundary and existing Web control policy; peer-owned sessions continue to be checked by their owning daemon.

Mergeability

  • Base branch: feat-cmux-next
  • Base SHA from fresh conflict gate: 061e8a777651250ee9c36b58194cbcc329eddc1b
  • Head SHA: 62a7bdfd25def2cb65894c0017caacb9464c0e46
  • Conflict-only gate: PASS (speculative merge b0b14513f6967e3f440150bfbd0ecc6261369236)

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Routes session/cancel for Web and Peer connections through the remote origin and ownership guard, so remote callers can no longer stop local-origin sessions.

  • Web and Peer cancels of local-origin sessions are refused with an ownership error; local Unix cancellation and same-owner remote cancellation are unaffected.
  • Web cancellation of remote sessions still requires the existing Web control policy approval, including when the request or notification is forwarded through a peer.
  • Adds regression tests asserting the turn_end side effect for refused and allowed request and notification paths.

Fixes https://github.com/manaflow-ai/cmux/issues/20998.