Whether the actor a request names is the agent that sent it — identity
M4a-2 (docs/specs/SPEC_AGENT_IDENTITY_CARRIED_NOT_DERIVED_2026_09_23.md
§6.5.3, §6.5.6).
An agent’s browser pane asking the human for something: a hand-off
(sign in, a CAPTCHA, anything the agent mustn’t do) or approval of a
committing action (submit, send, pay, delete)
(docs/specs/SPEC_AGENT_DRIVEN_BROWSER_PANES_2026_10_07.md §5.2, §5.4).
The host’s copy of srv’s browser-pane records: which panes an agent owns
(native-popups spec §3) and the sites each limited pane may go to
(SPEC_BROWSER_PANE_ALLOWED_ORIGINS_2026_10_09.md §6). The host reads both
inside CEF callbacks that can’t wait for srv.
Which cookie jar a browser tab browses as: its block’s browser:identity
(docs/specs/SPEC_BROWSER_PANE_PROFILES_MENU_2026_10_09.md §5–§6). Absent
for Personal; incognito:<jar> for an in-memory jar of its own, which the
CEF host makes on first use. Set when the tab is opened and never changed:
to browse as someone else, open another tab.
New windows a browser pane’s page opens
(docs/specs/SPEC_BROWSER_PANE_POPUPS_ADOPTED_2026_10_08.md,
docs/specs/SPEC_BROWSER_PANE_NATIVE_POPUPS_AGENT_DRIVEN_2026_10_08.md).
Which files an agent may upload into a browser pane
(docs/specs/SPEC_AGENT_DRIVEN_BROWSER_PANES_2026_10_07.md §5.3): only
files inside its own workspace, so a page (or a tricked agent) can’t use
an upload field to carry off anything else on the machine.
HTTP adapters over app_api: memory, global memory, fleet stop and stop forwarding.
Split out of server/mod.rs unchanged (SPEC_LARGE_FILE_MODULE_ANALYSIS_2026_09_30.md §4.1).
GET /agentmux/fleet and GET /agentmux/fleet/events: this instance’s
agent names for a LAN peer holding the lan_key, as a snapshot and as a
Server-Sent Events stream (backend::fleet_feed,
docs/specs/SPEC_LAN_FLEET_FEED_2026_10_03.md). Names plus instance
metadata a LAN peer already sees in the mDNS record; nothing else about an
agent.
The viewer routes a paired device calls, served only on the viewer
listener (TLS, backend::lan_listeners), never on the loopback or LAN
routers (agentmux-mobile’s SPEC_AGENT_STATUS_AND_LIVE_PANE_FEED_2026_10_07
§13.2, §13.3):
GET /agentmux/viewer/terminals/:block_id/feed: one terminal’s output,
live and read-only, for a paired device
(agentmux-mobile/docs/reports/REPORT_PANE_LIST_TERMINALS_AND_FROZEN_FEED_2026_10_12.md
§2.4, §2.5 phase B). Served beside the other viewer routes, on the viewer
listener only, for the viewer token only.
Replay of jekts held for an absent agent —
SPEC_DURABLE_JEKT_DELIVERY_2026_09_24.md §2.3. The hold itself is in
reactive::deliver; this delivers what was held once the agent is back.
The endpoints Claude Code’s SessionStart hook calls to deliver an agent’s
memory (docs/specs/SPEC_GLOBAL_MEMORY_DELIVERY_2026_09_27.md §7 P2). The
composition and the part rules are backend::memory_delivery.
HTTP handlers backing the muxspect CLI — Phase 1 of
docs/specs/SPEC_MUXSPECT_LIVE_INTROSPECTION_TOOL_2026_08_01.md, plus
the dock/dock clear extension from
docs/specs/SPEC_MUXSPECT_DOCK_DIAGNOSIS_AND_REMEDIATION_2026_08_06.md.
POST /agentmux/agents/resolve — the HTTP face of the one place a typed
agent name is interpreted (identity M3, spec §5). Called by agentmux-mcp
before WorkEnqueue and CronCreate so those tools can store a UID at
authoring time (§5.4) and hand an ambiguous name back to the model with
the candidates (§5.2) instead of enqueueing something that can never be
delivered unambiguously.
Native memory RPCs — read/write the agent’s ~/.claude/projects/<sanitized>/memory/
folder that Claude Code uses for autonomous, cross-session fact storage.
toolchain.resolve_install_command / toolchain.install_system_tool —
one-click install of git/Node/npm/Python through the platform’s own
package manager, streamed via the exact same install_chunk wire
shape install.start already uses.
Agent-facing UI automation (UIScreenshot / UIClick / UIQuery, and
the browser-pane deep-control tools BrowserNavigate / BrowserBack /
BrowserForward / BrowserReload / BrowserEval / BrowserDispatchKey
/ BrowserFocusElement / BrowserFocusInfo) — proxies to the paired CEF
host’s /agentmux/browser/* CDP routes (crates/cef/src/browser_api/).
See docs/specs/SPEC_AGENT_BROWSER_PANE_DEEP_CONTROL_2026_09_20.md for the
browser-pane tools’ own design (they additionally require the caller’s
own pane to be a dedicated browser pane — enforced host-side, not here).
Agent-facing shortcuts (ListShortcuts / RunCommand / PressKeys),
docs/specs/PLAN_SHORTCUTS_VERIFIED_AND_APP_API_2026_10_10.md §4. Same
identity model as the rest of ui_handlers: the caller’s own pane is
derived from its verified identity, never taken from the request.
The RPCs a sandboxed widget’s pane host makes for it
(docs/specs/SPEC_USER_WIDGETS_AND_WIDGET_API_2026_10_09.md §6.3, §11):
widgets.session when the pane opens, widgets.endsession when it
closes, and widgets.call for each bridge method srv answers (storage,
net, agents). Every call is checked here again against the session’s
package and its grants (backend/widget_access.rs).
What agents can do with widgets
(docs/specs/SPEC_USER_WIDGETS_AND_WIDGET_API_2026_10_09.md §10), for
agentmux-mcp’s WidgetList, WidgetInstall and OpenWidget: list the
packages, and install one and wait for the user’s answer. An agent never
approves: the prompt is the user’s, and only the host carries the answer.
The widget packages’ RPCs and routes
(docs/specs/SPEC_USER_WIDGETS_AND_WIDGET_API_2026_10_09.md §5.2, §8):
listing and managing packages, serving an approved package’s files, and
the user’s approval, which only the host can carry.