fix(chief memory): the launch-time memory offer never lists ~/Downloads or ~/Desktop (restores the #28811 test)

Merged
LA
7d ago
+71-12

Summary

Privacy bug, live on feat-cmux-next: Home's first-run memory offer (HomeHostView -> ChiefMemoryImportHandlers.detectForOffer) runs the bundled optchat-chief memory import-from detect at every launch until the person clicks the offer. The person did not ask for it. detect listed ~/Downloads and ~/Desktop to look for claude.ai and ChatGPT export zips. macOS charges that read to cmux and shows the prompt "cmux would like to access files in your Downloads folder".

This PR:

  1. Puts back the red test unasked_detect_never_lists_downloads_or_desktop (Native/OptChat/optchat-chief/src/memory_sync_state.rs, first added in aec7054d44b) by reverting #28811.
  2. Fixes it (Lawrence's commit bc8b414147a from a-lazy-permissions, cherry-picked with no conflicts and no changes):
    • detect now reads only the agents' own folders (Claude Code, Claude memory, Codex).
    • The new detect_with_exports (CLI detect --exports) also lists the export zips.
    • In Swift, only the Import Memories action that the person runs passes --exports (MemoryImportCommand.detect(exports: true)). The launch-time offer calls detect() and does not pass it.
    • The offer still finds Claude Code and Codex memory.

Takes back #28811: it removed the red test only until this fix lands.

Risk: risk:high, because it changes which user data the app reads.

Testing

Focused command (fleet, macOS):

cmux-ci run --class isolated --script scripts/ci/cmux-tui-rust-check.sh --ref SHA --arg optchat-chief --arg unasked_detect_never_lists_downloads_or_desktop
  • Red at commit 1, ee4ed733452b7cfc4d4e195228ee5a30e672e55a (test only, no fix): FAIL on its own assertion, step 6ff896f6fa46488400b42f66 (aws-m4pro-8): panicked at src/memory_sync_state.rs:461:9: detect listed a protected folder: [... zip:.../Downloads/data-2026.zip ..., zip:.../Desktop/claude-export.zip ...].
  • Green at the head, 3c94857e859896ef966cd5cba1d4983b27aac620 (--arg optchat-chief with no filter: all optchat-chief tests, clippy -D warnings and fmt): step 52751e3eef0eaaade0c87d33 (aws-m4pro-4): lib tests 154 passed, 0 failed, including unasked_detect_never_lists_downloads_or_desktop ... ok and detect_with_exports_finds_claude_code_notes_codex_and_export_zips ... ok; clippy and fmt pass. The step is red on 3 integration tests in files this PR does not touch: tests/acpmux_peer_moved.rs:187 (CMS signature status 4), tests/eval_upsell.rs:37 (skill lacks the billing checkout line), tests/toolpack_mcp.rs:219 (unwrap on None). A base run of the same mode at dff319646ae (step 791a2c4095b9f21b801a1d9b) is queued to confirm them as base reds.
  • Swift ChiefMemoryImportTests at the head (scripts/ci/package-test-lane.sh --arg=suite --arg=Packages/macOS/CmuxNext --arg=ChiefMemoryImportTests): step 004f0362b68ecae05f93dc15 at the head stopped before any test ran: generated file is stale ... Native/OptChat/optchat-chief/inspector/index.html (a base red; this PR does not touch that file; open fix #28817). Rerun on proof-only branch proof/cmdp-swift-with-28817 (d064fc03265: this head plus only the #28817 page) is queued as step 3eb65e3eb41152fcc129469f; base check step b9079fb1b1db3bf15738764d queued.
  • Compile at the head (cmux-ci compile-check --package CmuxNext --app --recipe-version 2): passed, job 3be590d91044f7623578aa4c: CmuxNext 291 s, app 75 s, cmux-tui 37 s.

Observed / Not run

Observed:

  • git revert 74b40b70e02 applied cleanly. The restored test is the same as the one in aec7054d44b, line for line.
  • git cherry-pick bc8b414147a applied cleanly. Its patch-id is the same as the original commit's, so nothing changed in the patch.
  • I read the Swift changes. detect(exports: Bool = false) is a nonisolated method on a Sendable struct. Runner.detect() is @MainActor and already awaits the off-main run helper, so isolation does not change.
  • I read the Rust flag parsing. --exports is changed to --exports=1 before Flags::parse, the same as --stop-host. No other optchat-chief command uses --exports.
  • scripts/cmux-next/prepush-gate.py: no new violations.
  • Fleet jobs: see Testing above.
  • Independent review: SHIP at the head (https://github.com/manaflow-ai/cmux/pull/28820#issuecomment-6538219053).

Not run:

  • No live app check of the macOS TCC prompt at launch (that needs a fresh TCC state on a GUI host).
  • I did not check if chief-evals.yml or other suites call detect and expect zips. A search found no other Rust caller of detect.

Proof

No capture: the offer looks the same; this change only stops a folder read at launch, which no still can show.

Changelog

  • Fixed: the Home memory offer no longer lists files in Downloads or Desktop.