PR #25858 - manaflow-ai/cmux

Fixes #25830

Chief chats show a live Browser or Computer card while a turn uses those tools, a Secure Store sign-in card, and up to three next-step chips. The live card updates its screenshot and step, then marks itself done when the turn ends. Text fallback preserves reply threading when an owner does not accept cards.

Behavior

Mac Home draws all three cards. Open browser opens the target beside the chat, or opens the Cloud desktop for a machine target. Switching from browser to computer clears the previous browser target, URL and screenshot.
The sign-in card opens a sheet on the Mac and saves through the login keychain as “cmux Secure Store.” Replacing a saved login updates the existing item atomically; a failed update preserves the previous credential.
cmux browser right fill-login --submit fills inside the app; the response contains neither username nor password. The browser.agentSecureStoreFill setting is off by default.
Next-step chips send their text as the person. Sending marks the chip optimistically; a failed send releases it for another click. Native chosen state requires the local person or a participant explicitly identified as human, so missing author metadata cannot choose a chip.
iPhone Chief draws all three cards. Open browser shows a zoomable screenshot. Add offers to add the sign-in on the Mac; this PR adds no credential transport from phone to Mac.
The home-channels webview displays cards; its next-step chips remain display-only.

Credential isolation

Fills require an HTTPS agent-profile tab that was not opened by page script. A persisted profile/site guard separates agent code from saved-login fills. Agent code includes eval, wait functions, storage/cookie writes, browser-host evaluation and raw DevTools. Filled sites refuse agent code, screenshots and PDF capture.

Both native control and WebKit frame execution pin the admitted origin in the actual receiving JavaScript context before executing agent source. Async bodies are parsed to EOF in a trusted, off-main JavaScriptCore context without invocation before WebKit or CEF wraps them; native execution preserves strict CSP and page-world semantics. Origin guards throw literals so a hoisted Error declaration cannot run on a mismatch. Wait chunks re-admit the current page. Opaque/unknown origins reserve the entire profile. Raw DevTools durably reserves the entire profile, including targets the app cannot track; a profile that has held a fill cannot attach it. Fills fail closed while a relay is attached, when guard data is unreadable, or when an exclusion cannot be saved durably. Concurrent fill attempts retain independent reservations.

Filled passwords are cleared when the page reveals or replaces the field, or becomes hidden/frozen. Script URLs are refused by the browser host. These controls do not claim protection against a compromised site receiving its own login.

Wire and ownership

Cards are agent-only conversation parts, validated by both the Rust conversation owner and cloud home owner with shared conformance cases. People cannot send or edit messages into cards. Screenshot records use attachment ownership/type/size validation. Generated Rust wire files come from the canonical exporter. Cards do not count as agent turns.

Verification

Observed / Not run

Current head: f2a33361b2ec4577f12220a3f5631aacc804766a, merged with base 7e3f42175d197fb78a65c9ae26f5045dbe3fbd8c using normal merges and pushes. Independent exact-head review confirms the complete repaired PR patch is preserved; the base’s page-focus callback and the PR’s login-guard injection coexist.
The latest blocking review identified failed-delivery state and unknown-author classification. Both have behavioral regressions committed before their fix.
Red at be4da7b01d008e4a7f9728bd688c7a7534a1a02f: fleet step 9beb53a1286765914517c628 executed all 19 HomeChiefCardTests. The new failed-send test observed a checked, disabled chip; the new actual-projection test observed unknown authors choosing chips. Those two tests failed; the other 17 passed. Fleet step 68a1c025d3953f700dac6a05 executed all 8 ConversationCardTests; the new test failed on both the chip and sign-in acknowledgment after failed delivery.
Green at current head f2a33361b2ec4577f12220a3f5631aacc804766a: the same focused commands passed all 19 native card tests (fleet ea2822caed5bf632cc40f4ce, aws-m4pro-2) and all 8 iOS card-state tests (fleet 7419d3a893108d9bca7de5fa, aws-m4pro-4), exit 0. The exact-head independent correctness review returned SHIP and confirms delivery changes reach visible historical cards.
Exact-head app compile and Release compile passed. The signing-hook guard now passes because this head includes the landed base repair #29332. Exact-head fresh-Home launch passed (fleet 2c9d17442c041ef32f015278): Home at 6.1 seconds, up 30 seconds, no crash; capture lease released.
Static pre-push gates passed. Swift syntax parsing passed. No builds or heavy tests ran on the person's Mac.
Historical evidence: head f039c5093086 passed app compile, fresh-Home launch, and all four webview shards plus all four base replays. Earlier fleet step 19605c0468d4426ccff4d42b passed 65 browser/login/Home/Keychain tests at 5eb93e9. Parent 79f2c971df48 passed all 10 WebKit frame-code policy and 4 WebKit exit-recovery tests, and 1,373 backend API tests. These are earlier-head results.
Earlier Rust red/green on rbx: cargo test --test chief_cards had three expected failures at c152b58a001b (duplicate fallback cards, lost final edit, stale computer-card browser targets), then passed all 14 after repair; 6 conversation-card tests also passed.
Consulted Apple's Buttons HIG for the iOS state correction. The visual design is unchanged.
Not run at the final head: manual iPhone cards, a real-site saved-login flow, live CEF execution, interactive webview sweep, or input-to-frame performance measurements. Captures below are historical.

Reproduce the focused regressions remotely, using the same commands on the red and repaired SHAs:

cmux-ci run --class light --script scripts/ci/package-test-lane.sh \
  --ref f2a33361b2ec4577f12220a3f5631aacc804766a \
  --arg=suite --arg=Packages/Shared/CmuxMessagesLab --arg=HomeChiefCardTests \
  --env CMUX_CI_XCODE_APP=/Applications/Xcode_26.6.app
cmux-ci run --class light --script scripts/ci/package-test-lane.sh \
  --ref f2a33361b2ec4577f12220a3f5631aacc804766a \
  --arg=suite --arg=Packages/iOS/CmuxConversation --arg=ConversationCardTests \
  --env CMUX_CI_XCODE_APP=/Applications/Xcode_26.6.app

The remaining web shard failure names agents: cmux agent fork-conversation-to-new-column-right in tests/next-docs.test.ts (“every cmux command written in a hand-written page is a real CLI verb”). The test, pages.ts, action-surfaces catalog and reference builder are byte-identical to merged base 7e3f42175d197fb78a65c9ae26f5045dbe3fbd8c. This PR does not add or remove that command. The actual base push job at 61e8cf8a624d7164be163a2d6360382d30cef068 fails that exact test with the same sole unknown command. The repository’s per-test classifier compares the two job logs and exits 0 with own: false. Unrelated PR #26078 also fails the same way. The assertion inputs were compared directly with Git; no bun code ran locally. This inherited failure is outside this PR’s scope.

Performance

No perf numbers: this repair fixes merge integration, isolation correctness and check failures; no speed improvement is claimed, and input-to-frame distributions were not measured.

Native capture

The real tour below is from 11271a184d4c80014d0f9e1027cabd51737d7f2f, before the later integration repairs; it is historical visual evidence, not a final-head capture. Both light and dark tour steps passed. A later native fleet build at 32386b7017547b8deed0671c54324da0d3ddf91f passed; it is historical build evidence, not a final-head launch.

Viewed after image: yes
Visual verdict: The cards and controls are legible in both appearances, with the upper browser-card content clipped by the scrolled conversation header.

Capture tour-chief-cards at 11271a184d4c (fleet build, capture mini, text checked for private data)

Light	Dark

Changelog

Added: Chief shows a live browser or computer card, a Secure Store card for site sign-ins, and tappable next-step suggestions.