PR #34032 - manaflow-ai/cmux

Fixes the tip panic-ratchet red acpmux: clippy::indexing_slicing 703 > baseline 686 (STATUS 9357; last green panic tip ab54fffeffb7). One commit per culprit:

Culprit	Sites	This PR's commit
b6e681e8df4 (MCP connect card that only the person approves)	10: `hub/mcp_connect.rs` `card["name"]` read and four `card[..] =` writes; `secret_mcp.rs` the three `connect_mcp_server` arguments and two `result["status"]` reads	4b17ef93be3
29b37816204 (connect_mcp_server listed only with the preview flag)	1: `secret_mcp.rs` `t["name"]` in the tool-list filter	bfd54ec0582
ccd085240dc (after approval the daemon connects once)	16: `hub/mcp_connect.rs` `first_connect` reads of the card (`transport`, `url`, `auth`, `keyName`, `keyOptional`, `name`) and two record writes; `secret_mcp.rs` the result's `connect`, `name`, `scope` reads	c3dddb9f868

Takes back #33811 and #33785: only the form of their JSON reads and writes changes; every value is the same.
Takes back b6e681e8df4, 29b37816204 and ccd085240dc (direct pushes): only the form of their JSON reads and writes changes; every value and decision is the same.

Fix

Reads go through a small field(value, key) in each file (get, else Null, the value a serde_json index gives for a missing key or a non-object). Writes go through cmux_json::JsonSet::set, as the rest of acpmux does; each target is an object (card_of builds the card with json!({..}), and the record is a copy of a json!({..}) result). No #[allow], no baseline change.

Security core files touched

This is the MCP connect consent path. The PR changes only cmux-tui/crates/acpmux/src/hub/mcp_connect.rs (the card, the person's answer, the first connect) and cmux-tui/crates/acpmux/src/secret_mcp.rs (the agent-side tool and the text it reads). It does not change who may answer the card (hub/person.rs), the resolver and URL/command rules (cmux-mcp-connect), or mcp_probe. The key still goes only into the server's own header: key_header is built from the same three values. risk_tier.py grades these files normal; the review was asked to check each consent decision against the base.

Red at the base, green at the head

Command (fleet): cmux-ci run --class light --script scripts/ci/cmux-tui-rust-check.sh --arg panic --os linux --ref SHA

Red at 201216c52796 (tip watcher, STATUS 9357): acpmux: clippy::indexing_slicing 703 > baseline 686. The current base 6eb610fd3c70 runs as step 4fe3906df73561ad36e3b597 (result in a comment).
Green at this head c3dddb9f868: step 4521d2536cd175ac20b07131, exit 0 (rust-panic-ratchet: 86 crates checked, 36 at deny, no row over its baseline).

Later culprits on the base (the count rose to 714 while this PR was open)

Culprit	Sites	This PR's commit
63381baf630 (#33811, workflow: dispatch durable agents to paired machines)	15: `hub/workflow_activity/remote.rs` four `request[..] =` writes; `server/requests/workflow_dispatch.rs` brief, title, from and briefId reads; `server/workflow_activity.rs` the owner call's `hello["_meta"]` writes	7cb3b326b03
a965813492b (#33785, workflow: expose daemon runs through the CLI)	1: `hub/workflow_runs.rs` `spec["name"]`	a54af9dda29

Reads use field() or get; writes use JsonSet::set and set_path (the hello has no _meta, so set_path builds the same {_meta:{acpmux:{callerSession:..}}}). Green at the head a54af9dda29 merged with the tip 649cebc7ca2: panic step a555ef647ddc57ef2d522e56 exit 0; clippy step b03745b31215f89b2c6b87f1 exit 0; test workflow step ee6eeac74b809ad9f1957b64 122 of 122 passed.

Changelog

none

Observed / Not run

Observed on the fleet (Linux) at this head: panic step green (above); clippy step ad64ec83d77ad1926bb18c6c exit 0; cmux-tui-rust-check.sh test mcp step ccff63d97be06ad6bfb0b8e2: 342 of 342 passed. rustfmt and prepush-gate.py passed.
Not run: no local cargo (rule); the live end-to-end test (CMUX_MCP_CONNECT_LIVE=1) needs the network servers.

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Replaces indexed JSON reads and writes in the MCP connect and workflow dispatch paths to satisfy the panic-ratchet baseline without changing behavior.

Missing fields still resolve to Null; existing request, consent, caller-proof, and receipt-token values are preserved.
Uses JsonSet::set and set_path for JSON writes, with no baseline changes or lint suppressions.
Extends the coverage to workflow dispatch: remote request writes, durable brief reads, the owner call's hello _meta, and the workflow-spec name read.