fix(chief memory): a scripted Import Memories run never lists ~/Downloads or ~/Desktop

LA
6d ago
+73-25

Summary

Privacy bug (the independent review of #28820 found it): if a chief.importMemories run names no source, the action still runs optchat-chief memory import-from detect --exports, whatever the origin of the run. Thus a script, an agent or the CLI can make cmux list ~/Downloads and ~/Desktop (folders that macOS guards, which also shows the folder prompt) before the dialog opens, with no action from the person.

After this change, only the person's own run in the app sends --exports. That run must have the user origin, the control socket must not carry it, and it must name no caller app, agent chat or terminal. A run from any other caller lists only the agents' own folders. A script can still import a zip if it names the zip (source: zip:/path).

  • ChiefMemoryImportHandlers.detectArguments(muxHome:invocation:) and offerDetectArguments(muxHome:) are pure functions that the tests call.
  • The person predicate moves from ScreenshotHandlers.isPersonsRun to ActionInvocation.isPersonsOwnRun (CmuxNextActions). Thus the raw-pixel rule and this rule are one rule. The behavior of screenshots does not change.
  • New test ChiefMemoryImportExportsTests: the launch-time offer never sends --exports (the reviewer said that this test was missing). Only a person's own run sends it.

Testing

Focused command (fleet):

cmux-ci run --class light --script scripts/ci/package-test-lane.sh --ref SHA --arg=suite --arg=Packages/macOS/CmuxNext --arg=ChiefMemoryImportExportsTests --label suites
  • Red at commit 1, 5f4e4a2a33e7188762993b87f0b00d54cf07b900 (the seam with the old behavior, plus the test): step 3ad07bc5df4cbce1d136b6c1 (aws-m4pro-1) fails on its own assertions: onlyThePersonsOwnRunListsTheExportZips records 9 issues (5 non-user origins, the socket run that claims user, and the 3 named callers all get --exports). theLaunchTimeOfferNeverListsTheExportZips passes, because the offer was already fixed by #28820.
  • Green at the head, b661016ae4ff85e3752258f424be325424aaf29d (ChiefMemoryImportExportsTests, MaskedScreenshotTests, ChiefMemoryImportTests, ActionOriginTests): step 6fa3ae1b30565a39628ee9b8 (cmux10s-Mac-mini) passes, all 4 suites (32 tests).
  • Compile (cmux-ci compile-check --package CmuxNext --app --recipe-version 2): job 2cc884a8c56a0c6c096fcb46 passed: CmuxNext 202 s, app 53 s, cmux-tui 37 s.

Observed / Not run

Observed:

  • scripts/cmux-next/prepush-gate.py: no new violations. CmuxNextApp is 2 lines smaller (arch-ratchet app_lines -2).

Not run:

  • No live check with a script that sends action.run chief.importMemories to a tagged build.

Proof

No capture: the dialog does not change. Only the folders that a scripted run lists change.

Changelog

  • Fixed: Import Memories started by a script or an agent no longer lists files in Downloads or Desktop.