Custom panes built with Chief, and an App Store review flow

AU
2d ago
+12119-94

Fixes https://github.com/manaflow-ai/cmux/issues/26579

Chief can build a local custom pane, have the person install it through the App Store's native consent sheet, and open it beside the chat. Saving its files reloads the pane. The store adds versioned submissions, a reviewer queue, and approved Community listings. The App Store entry stays behind the default-off Preview Features setting.

Design: custom-panes-DESIGN.md.

What changed

  • Host manifest-v2 web panes at an app-specific origin, with a nonpersistent data store, restrictive CSP, closed network hosts, root-contained background file reads, and main-frame bridge validation. Disable, uninstall, disconnect, policy changes, and missing packages clear an already-open document and revoke its bridge, including cached detached views; re-enabling restores the eligible pane.
  • Route bridge calls through the verified native connection and the daemon's current install, enablement, and grant checks. Chief's bundled custom-pane skill and Workspace Board example use the companion for supervisor reads and normal app actions for the store and pane placement.
  • Add authenticated submissions, separate reviewer decisions, and approved Community downloads. Publication, review decisions, and installed-version replacement require native consent. Reviewers cannot decide their own submissions. Downloads validate bundle hash and package contents before replacing the catalog entry.
  • Preserve exact numeric SemVer ordering beyond JavaScript's safe integer range, accept long valid version identifiers consistently, and serialize registry publication with local catalog reloads. Install the approved Community version even when an older uninstalled bundle is cached, and preserve a newer unsent draft when an earlier send finishes.
  • Fix defaults-guard membership resolution for genuine independent exact-head review receipts. The guard still uses trusted base policy and rejects stale and self reviews.

Changelog

  • Added: Ask Chief to build a custom pane beside your chat, then submit it for App Store review.

Verification

Head fc840535c397e46ea94f8ff51c95c8b48d601266, tree 425d8d30851d47f3e3bc7dba4acd5c896360500c, normally merges base e899518539cd40b12ce14fb95281bddf38635a42. Both parents and incoming changes are preserved; no pushed history was rewritten. The registry/trajectory migration conflict preserves TrajectoryDO v20 in all environments and adds AppRegistryDO v21 only in local/development/staging. Production has neither the registry binding nor its creation migration.

The lifecycle regression was committed before the fix. This focused command executed at regression commit 024b1dd30fcf24156d388f7f79bccd2419066649 (fleet step ca220df482267e603bff8f15) and at this head (step 3213c9dd36fde39bf949f3ef, which also selected the other seven focused suites):

cmux-ci run --class light --script scripts/ci/package-test-lane.sh --ref SHA \
  --arg suite --arg Packages/macOS/CmuxNext --arg AppWebPaneUpdateTests \
  --env CMUX_CI_XCODE_APP=/Applications/Xcode_26.6.app

Before the fix, all seven revocation cases failed with 35 assertions: stale package resources/document and a still-enabled bridge. On this head, all seven pass, as do restoration, initial stale-disabled rejection, crash callbacks, and manifest replacement. This proves actual WebKit behavior, not a source-text assertion.

Observed / Not run

  • Exact-head fleet execution: all eight native suites PASS, 43 named tests including parameterized cases. Suites: AppWebPaneTests, AppWebPaneSchemeHandlerTests, AppWebPaneUpdateTests, AppRegistrySubmissionTests, AppRegistryPageProviderTests, AppOpenTargetTests, AppsPageBridgeTests, RightPanePlacementTests. Long-version downloads, package-root containment, bridge restrictions, and pane placement were exercised.
  • Exact final tree on Freestyle: full web-lint recipe PASS across webviews/web/cmux-tui frontend, 30 registry model/UI tests PASS, four sample-draft tests PASS, 31 backend registry/trajectory tests PASS, and backend type checking PASS. The receipt verifies the full tree before and after execution. Backend tests used the Workers Vitest runner; an earlier plain Bun invocation executed no tests and is not evidence.
  • Exact-head rbx: 189 apps tests PASS; strict Clippy across the five affected packages PASS. Defaults suite: python3 tests/test_defaults_guard.py, 64 PASS. Static prepush gate and actual push hooks PASS. Release compile and defaults-guard rerun PASS.
  • Exact-head tagged fleet build issue-26579-pane-flow-twentytwo, job 725f5f9ebb83dfbd859d8174, PASS with workspace_reset: true; artifact SHA256 87cbd96e2d05127b8158d8e5d98a2d53cb5e72d5343b316ad230ffad8fd61a64. Try the tagged build. Local backend mode; this does not establish shared-service or production behavior.
  • Exact-head fresh-home launch PASS: Home rendered in 6.1 seconds, alive for 30 seconds, no crash or uncaught exception. Screenshot upload was withheld because agent-author privacy metadata is absent; the privacy check was not bypassed.
  • Independent correctness-first review: SHIP on this exact head. Current risk-evidence, merge-freeze, and capture checks pass. The Rust panic-ratchet red matches the base-branch failure: indexing 832 > 831 and string slicing 83 > 82 in the unchanged cmux-tui crate. Classification and evidence.
  • Earlier live Chief verification created and discovered a synthetic Linear-style local pane without restarting; it remained uninstalled, disabled, and without grants. Not run: live installation/public review submission, production registry deployment, macOS 14/15 runtime, or a full Swift-suite pass. Native consent is retained. The original 26579-custom-panes-app-store tag is preserved because it contains active chats and agents.
  • Earlier advisory gallery review inspected Community and My Submissions in light/dark at width 1000, with no blocking visual finding (artifacts). Those images are prior-head evidence; current-head native screenshot publication remains withheld by privacy controls.

Risk

risk:high: daemon socket commands, publication in the person's name, and a registry creation migration for local/development/staging. Preview Features defaults off; native install/update/publication consent and current daemon grants remain required. Review routes return 404 until reviewers are configured.

cmux-platform: This existing registry implementation stays production-unbound pending its move to cmux-platform, a per-person pending-submission cap or write rate limit, and the required migration/promotion validation. This PR does not enable production.