feat(composer): preflight selected session auth

Merged
TE
9d ago
+776-26

Leo: we also want to be having that modal picker situation, like be able to surface, say, like, Oh, you gotta re-authenticate. You gotta log in again on the modal picker before the user even sends a prompt.

This client follows the daemon-owned _acpmux/session/auth contract. It queries the exact session or selected New Tab target, keys replies by session/harness/host/route, preserves source-specific detail, and blocks only signedOut, expired, and routeAuthNeeded. routeUnreachable and peerUnreachable remain visible but non-blocking; unknown does not add an auth refusal. Auth blocks are checked in App and Composer's force-send path, so Trust approval cannot bypass auth. Account route changes invalidate the prior verdict and preserve the selected harness.

The compact and full picker show the selected route's auth state and the provided opaque login detail. Existing host-wide harness health remains only the legacy picker rail signal; it is not used to block sends.

Design reference: manaflow-ai/cmux-design-references/apps/claude/live/composer-demo-ready.png and leo-workspace/design/composer.md: the quiet configuration row and existing picker surface. A pending auth check keeps the prompt gated without inserting a temporary note or moving the New Tab controls; only an actual auth refusal adds its note.

Dependencies: daemon sessionAuth feature/method are feature-gated. Unsupported daemons resolve to unknown and never block. #26631 is source-only health classification and is intentionally not mutated here.

Verification

  • Reviewed head: 4625d000e87be17554bdb2b53a9f1f1c28dcfb81; diff merge-base 1e8fb3c8624c8bb65cb70c7073105d48c88c5753.
  • Focused hosted run 40782152760: SUCCESS, tested SHA 4625d000e87be17554bdb2b53a9f1f1c28dcfb81 (source snapshot 52126a0a69bfbdd20998cc57cece17871e730e27, matching tree 91e1e6b975ff2b26bf2c77bc8a6269ab74f9ce20). Auth/environment suite: 34 pass, 0 fail, 184 expects. New Tab DOM/frame row-stability suite: 24 Chromium/WebKit cases pass, 0 fail, 88 expects; no transient auth note is inserted.
  • Changed-file vp fmt, git diff --check, and exact-head python3 scripts/cmux-next/prepush-gate.py: pass, no new violations. Heavy validation ran hosted, not on Big Red.
  • Normal CI run 40782131345 is pending. Its actual webview test results and base comparisons must pass before landing; a continue-on-error shard job marked SUCCESS is insufficient.
  • Exact-head gallery before/after: built 4625d000e87b, auth-health states signed-in, signed-out, expired and unknown in light/dark. New Tab comparison.
  • Independent Astra HIGH/FAST review on GCP1: SHIP at 4625d000e87be17554bdb2b53a9f1f1c28dcfb81, no blocking findings.
  • Remote recovery is display-only: show the daemon-provided exact host/command; this PR does not run a remote login action or fall back to a local terminal.
  • Nonblocking native dependency: relay #26886 remains separately held by Swift HOLD #26809/HQ4779. That HOLD does not apply to this web PR; the web client uses the capability fallback when the native relay is unavailable. No native execution is claimed here.

agent-identity footer
Agent session: agent session