0.64.25 workspace.reorder with out-of-range index crashes app (unchecked Array.insert)

Inizia da WorkspaceReorderCoordinator.reorderWorkspace(tabId:toIndex:isDragOperation:explicitGroupId:) e traccia come ControlCommandCoordinator.handle(_:) vi passa l'indice del control socket. Esegui workspace.reorder con un toIndex fuori intervallo e verifica che l'applicazione rimanga in esecuzione mentre la richiesta viene rifiutata in modo sicuro o trattata come un no-op.

Confirmed customer report

An out-of-range toIndex sent to workspace.reorder over the control socket kills the app with EXC_BREAKPOINT / SIGTRAP on the main thread: Array._checkIndex -> Array.insert(_:at:) in WorkspaceReorderCoordinator.reorderWorkspace(tabId:toIndex:isDragOperation:explicitGroupId:) via ControlCommandCoordinator.handle(_:). No clamping or validation happens before the insert, so any client that computes a bad index (custom sidebar, CLI, extension) gets a guaranteed crash instead of an error.

The reporter was drag-reordering in a custom sidebar (fork of Examples/CustomSidebars/workspaces.js) with 5 workspaces in one window; the drop dispatched workspace.reorder with an index out of range for the internal array, and the whole app died, losing two workspaces from the window.

The reporter notes this is easy to hit from the documented data contract: a sidebar author only has workspaces[i].index to work from, and that value can disagree with the array reorderWorkspace indexes into. The shipped workspaces.js example computes its index the same way.

Evidence

Crash report: cmux-2026-09-21-143234.ips, incident 55593AFE-A396-4FB3-ACEE-2D69684271B4.

Workaround (reporter side): clamp the index to [0, count-1] before calling cmux("workspace.reorder").

• Reporter: florian.freudenberg@zenjob.com

Source report: Gmail 1a0c3fddfbb3944b

Environment:

• cmux 0.64.25 (build 106, commit b685a275c)
• macOS 26.6.2 (Build 25G83)
• Mac15,6, Apple M3 Pro, 36 GB

Expected

A control command arriving over the socket should never be able to terminate the app. reorderWorkspace should clamp or early-return on an out-of-range toIndex, making a bad index a no-op error rather than a crash.