fix(web): allow signed NEXT DEV auth callbacks

Merged
TE
5d ago
+40-1

Signed NEXT DEV uses cmux-next-dev to return from the staging Stack sign-in page to its Release app. The deployed after-sign-in handler previously rejected that scheme because it only allowed the classic, NIGHTLY, RC, and NEXT schemes.

This feat-cmux-next web change adds the exact signed NEXT DEV scheme to the deployed native callback allowlist, scoped to the canonical staging host cmux-staging.vercel.app. The production host cmux.com rejects this scheme, so a production Stack token cannot be handed to the staging-only app. Existing cmux-dev-* schemes remain local-only and other channels are unchanged. This PR does not edit CloudConfiguration.swift.

Leo: “you need to do all that stuff we do not care about classic we care about our new cloud”. This is the web prerequisite for #28899, whose signed NEXT DEV config targets staging cmux-staging.vercel.app and the development Worker. #28899 remains held by its owner for its own native verification.

Validation:

  • git diff --check passes.
  • web/tests/after-sign-in-route.test.ts covers staging acceptance and production rejection through the real handler path.
  • Local Bun execution could not load next/server because this checkout has no installed web dependencies.
  • A correctly routed focused fleet dispatch (run 41173218262, exact head 0e8d436652d1fce5efa2ef47aecce22a950e3ed8) queued without starting steps and was cancelled by the runner system; it is not evidence of a test assertion failure.
  • The head release-notary check has the same two workflow-guard failures as feat-cmux-next base; test_reds.py classify reports own:false with both failures shared by base.
  • Independent Sol review shipped at the exact head: https://github.com/manaflow-ai/cmux/pull/28909#issuecomment-6539411105

Normal NEXT landing was requested once at head 0e8d436652d1fce5efa2ef47aecce22a950e3ed8; next-autoland owns the remaining landing checks. No staging deployment or signed-flow dogfood has been claimed yet. The staging workflow can deploy this ref with cloud-vm-dogfood.yml when the integration lane schedules it.

Agent session: agent session