cnx-ios: fix full-verify defects D1āD14 (Chief, teams, previews, Codex default, polish)
Summary
Fixes the defects a fresh verifier found in the cmux-next iOS app at 3e6a2b56eff (cmux INTERNAL 1.2.0); report: cnx-ios/verify/full-verify-app-20261019.md on feat-cnx-ios-fullverify-app.
| ID | Fix |
|---|---|
| D2 Chief never loads | The Mac app hands cnx-hostd its own Chief owner (CNX_CHIEF_SESSION, and CNX_CHIEF_SOCKET once connected), for tagged and Release builds. The phone shows "Chief isn't available" with the reason and Try Again instead of an endless spinner. |
| D3 Chief send drops the message | Until Chief takes sends, Send keeps the text in the composer and offers Try Again or Send When Chief Connects (the outbox); voice and + are off meanwhile. |
| D1 Create team fails silently | Stack refuses client-side team creation in both projects (client_team_creation_enabled: false). New Worker route POST /v1/teams creates the team with the project's server key; the phone uses it and rereads Stack's list. |
| D9 File previews refused | cnx-hostd's file service also reads the folders of the Mac daemon's tabs (the agentcwd roots acpmux already shares), dropping /, home and its ancestors. SECURITY.md updated. |
| D4 Codex default model | acpmux skips a catalog start model the harness does not list (only the catalog default, only when the harness reports catalog ids); phone Default uses the Mac's own pick; model errors read as sentences; the composer model menu shows whenever models are listed. |
| D8 Claude Start Chat | A request while another opens says "Still opening ā¦"; every request is logged. Root cause pending live check. |
| D5 | Autocorrect and auto-capitals off in name fields and the agent composer. |
| D7/D11 | The loading skeleton no longer overlays the Mac lines, so Connect gets its tap. |
| D10 | Short inline Feed rows draw as native text instead of a web view each. |
| D6/D12/D13/D14 | No "line 0"; Codex's bare "finished" says where to look; "Allowed"/"Allowed once"; Home previews the newest reply; VoiceOver's time matches "now". |
CmuxTabsKit and CmuxConversation are unchanged. No transport files changed.
Tests
- Swift (mini-cmux11s,
cnxkit-test.sh): ChiefUnavailableTests, ChiefFailureTests, ServiceTeamCreationTests, AgentCatalog*, TurnFailureCopyTests, LastAnswerTests, RelativeStampSpokenTests, FeedPlainTextTests, TerminalFeedTests, FeedPendingTests: pass. - Mac Swift (fleet
cmux-ci run): IPhoneHostChiefTests, CnxHostTests. - Rust (rbx): cnx-hostd all tests + clippy; acpmux 521 tests (nextest) + clippy, new
a_catalog_default_the_harness_does_not_offer_is_not_used. - Worker (mini-cmux11s, vitest): 45 pass incl. new
test/teams.test.ts;http.test.tsexpected API 0.8.0 (stale on base, wrangler says 0.9.0). - Red runs: each failing test was committed before its fix; red was a compile failure (missing API) or, for acpmux, the catalog model being set. Separate red runs were not executed.
Review
Correctness-first subagent review found no blockers; should-fix items (HOME fallback in hostd, stored-spelling compare, acpmux skip limited to catalog defaults, Try Again stuck, voice/+ send paths, team-creation limiter) and nits are fixed in later commits.
Open
- D1 live: the Workers need
STACK_SECRET_SERVER_KEYfor the dev and prod Stack projects, and theTEAM_LIMITbinding deploys with them. Not deployed here. - Live verification over the real link: see
cnx-ios/verify/fixes-r1-20261020.md.
Mac-side counterpart against feat-cnx-ios-macnext: see linked PR.
Changelog
- Fixed: cmux-next iOS Chief, team creation, file previews, Codex default model and several smaller issues found by a full verification.
š¤ Generated with Claude Code
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3.svg)
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg)
Need help on this PR? Tag @codesmith-bot with what you need.
Summary by cubic
Fixes the 14 defects a full verification found in the cmux-next iOS app, across the phone app, the Mac's host daemon, the acpmux harness hub, and the backend Worker.
Chief on the phone now says why it's unavailable instead of an endless spinner, offers Try Again (which ends on every exit and never opens Chief twice), and keeps a message written before Chief connected; a prompt reuses one acpmux id on resend so the Mac never runs it twice, a returned draft for a prompt the Mac was already running is withdrawn from the composer, and unsent text survives a rebuild. The Mac app hands hostd its own Chief owner and socket, so DEV and tagged builds serve the right Chief.
Team creation goes through the Worker (POST /v1/teams) with the project's server key instead of Stack's refused client call, and a per-user rate limit with the phone's Try Again shown when it fails; creation is rate-limited to 3 a minute. File previews like the agent-chat workspaces (never /, home or its ancestors), a catalog default model applies only when the harness offers it (never a saved pick), and a running chat's model and mode menus come from the session detail _acpmux/attach returns. Close All Tabs now asks first, like Safari.
Smaller fixes: autocorrect and auto-capitalization off in code-like fields, the loading skeleton no longer blocks Mac rows, short feed rows draw as native text, plain-English failure messages replace raw JSON, VoiceOver reads times and lines correctly, and copy is clearer. Tests added for each fix; no transport files changed.