feat(cmux-next): Credential Vault for the Chief and agents

AU
3d ago
+13747-115

Fixes #26412.

The Chief and agents can request credentials by name and use them through cmux vault. Settings > Chief > Credential Vault manages names, agent access and usage metadata. Home offers to move detected keys into the vault before sending and excludes them from its saved draft cache while vault interception is enabled.

The credential feature is an opt-in canary. The live Debug Settings toggle credentialVault.enabled defaults to off in DEV/NIGHTLY; Release keeps it off. Off refuses all seven vault socket methods and native Settings operations before reading storage or showing sheets, hides metadata, and restores Home's ordinary draft behavior. Requests admitted while enabled may finish after switching off. Re-enabling refreshes Settings metadata.

Values and authoritative scopes live together in login Keychain items. The editable index has metadata only; modifying or replaying it cannot grant credential access. Legacy values are person-only. Socket writes and uses of person-only credentials require native approval. Allow is click-only; shared debug input and inspection helpers cannot approve it or expose secure fields. Stale Settings scope changes cannot silently enable agents. Remote relays deny vault methods.

vault exec injects credentials into the child environment and masks exact values in output. Masking prevents accidental disclosure; an authorized child can still transform or write the value. --no-mask preserves child arguments after --.

Verification

Head: 5367d7fb2d3d4ea25e07999c6b22a7e6341926d2. Merged base: 79e9919c5c5cc97a1b9855e2cafc655050f883f5. Normal merges and plain pushes preserve the published branch history. Both sides of the five overlapping files survive the final merge; all 79 feature deltas are preserved.

  • Exact-head native fleet run 60097e794f39c550e51dfab5 on aws-m4pro-3 passed 50 test functions in 8 executed suites: CredentialVaultControl (19), Settings (7), ScopeIntegrity (6), SecretRecord (3), DebugDialog (2, including 5 parameterized helper cases), CmuxDialogClickOnly (3), SettingsSchemaExport (6), and ManagedPreferencesManifest (4). Command: cmux-ci run --class light --script scripts/ci/package-test-lane.sh --ref 5367d7fb2d3d4ea25e07999c6b22a7e6341926d2 --arg=suite --arg=Packages/macOS/CmuxNext --arg=CredentialVaultControlTests,CredentialVaultSettingsTests,CredentialVaultScopeIntegrityTests,CredentialVaultSecretRecordTests,CredentialVaultDebugDialogTests,CmuxDialogClickOnlyTests,SettingsSchemaExportTests,ManagedPreferencesManifestTests.
  • Exact-head Home draft replay feac802b903d34d7f581e7a4 on aws-m4pro-2 passed all 7 HomeSecretSendTests. Command: cmux-ci run --class light --script scripts/ci/package-test-lane.sh --ref 5367d7fb2d3d4ea25e07999c6b22a7e6341926d2 --arg=suite --arg=Packages/Shared/CmuxMessagesLab --arg=HomeSecretSendTests.
  • Exact-head rbx5 run passed 5 CLI vault tests: rbx --lane pr26487-vault -- cargo test --locked -p cmux-tui cli::vault::tests -- --nocapture. Filtered integration binaries executed zero tests and provide no additional coverage.
  • Freestyle independently reproduced complete Git tree 761f8a4e0fb8ba075afa77e0344e513872571c3a. Both frozen installs, all 7 Vault card tests / 34 assertions, full webviews bun run check (3,463 typechecked files), and web typecheck, complexity and managed-relay catalog checks passed. Generated JSON ESLint reported its standard ignored-file warning only.
  • The final static pre-push gate and Swift syntax check pass. Hooks remained enabled; formatting/Bun work ran on Freestyle. The generated settings export preserves all 602 base rows/defaults and adds the base-owned chooser row, totaling 603; generated files were not hand-merged.
  • Exact-head tagged build 76a80505396d15bb39a94a93 passed, including source/tag/cleanup receipts, and was published to HQ. Artifact SHA-256: 1b1f5884f480c7c4bb12ef5deeeae923e21fbabe712040613a887a4fa5159a9e. CI compile and fast gates are green.
  • Correctness-first integration review returned SHIP on this exact head. Final independent security review inspected the completed native and Home replays and also returned SHIP on this exact head.
  • Remaining red checks are proven base findings: the release-notary pin allowlist mismatch and two next-docs freshness tests for the base's cloudSetNetworkAccess action. The latter pass at this head and merged base, but fail identically at the newer base used by CI's synthetic merge.
  • Scoped localization audit: 1,428 feature entries and the rollout catalog have zero parity errors. Translations are machine-written, without native-language review.

Regression evidence

The shared input regression command package-test-lane.sh suite Packages/macOS/CmuxNext CredentialVaultDebugDialogTests failed all 5 expected sink-denial cases at 8686907e8228d412dc09dcb18cc25edf3f641aec (fleet f56a789354ce9ea87fa168bf), then passed on this head. debug.new_tab → frame_strip had bypassed the wrapper consent check; guards now cover the shared sinks, sequence admission and each replayed event. This is headless policy-ordering evidence, not a live AppKit exploit demonstration.

cd webviews && bun test src/pages/settings/credentialVaultCard.test.tsx failed both out-of-range timestamp cases at 53c8fd4b9bfa6ebab807a32cf104277584d0438e, then passed all 7 after repair and on this head. Earlier incomplete-checkout protocol-red evidence is withdrawn.

Earlier focused red/green receipts remain in the commit history: rollout tests failed at 94976ae53442c07ada3ba03b47b4b9d23fe362a6 and passed all 26 at d8de82f37b71aa8ca7f8b9c8f12e7dbcebe482c3; HomeSecretSendTests failed at 1209b3b5147a23ed8fdb5bc0682f00886e0f6f7a and passed all 7 at f86b70faa173db8e30e300a2b4e2b26e1a841fc9; usage-count regression failed at 86ed074675cd70c0bcef2898b1d88b1f0bfd31c9 and passed with the six vault suites at 10ddf809a42ef3f0a8a07c574d3b430443f85894.

Observed / Not run

Executed focused tests cover authorization, protected scopes, Settings mutations, draft handling, parser/masking and rendered card summaries. Native Keychain ACLs, real pointer approval/cancellation and end-to-end secure sheets have not been dogfooded. No local Swift/Rust/Bun builds or tests ran. Cloud was not exercised. The tagged app was built and registered without launch; this is build evidence, not live dogfood. Fleet logs were inspected as rendered exports, not verified against raw CAS bytes.

Try it

Exact-head tagged build: issue-26412-vault-merge-verified, desktop-only local backend mode. Tag Opener health and registration were verified without launching it. There is no Cloud backend URL for this local-only build. Superseded task tags had no running app process; stopping the prior input-guard tag found no local backend state. Their data and registrations were preserved.

Enable Credential Vault in Debug Settings, then open Settings > Chief > Credential Vault and add a disposable credential. Try cmux vault ls and cmux vault exec --env NAME -- command; person-only reads should request approval.

No capture: no existing native capture scene drives the secure approval flow; debug automation intentionally cannot approve it. No security bypass was added for a screenshot. The Settings card has fixture tests and the gallery advisory route.

Changelog

  • Added: Opt-in Credential Vault stores API keys in the Keychain and lets the Chief and agents use them by name, with native approval and Settings controls.