0.64.25 workspace.reorder with out-of-range index crashes app (unchecked Array.insert)

从 WorkspaceReorderCoordinator.reorderWorkspace(tabId:toIndex:isDragOperation:explicitGroupId:) 开始，跟踪 ControlCommandCoordinator.handle(_:) 如何将 control-socket index 传递给它。使用超出范围的 toIndex 执行 workspace.reorder，并验证应用仍在运行，同时请求会被安全地拒绝或作为 no-op 处理。

Confirmed customer report

An out-of-range toIndex sent to workspace.reorder over the control socket kills the app with EXC_BREAKPOINT / SIGTRAP on the main thread: Array._checkIndex -> Array.insert(_:at:) in WorkspaceReorderCoordinator.reorderWorkspace(tabId:toIndex:isDragOperation:explicitGroupId:) via ControlCommandCoordinator.handle(_:). No clamping or validation happens before the insert, so any client that computes a bad index (custom sidebar, CLI, extension) gets a guaranteed crash instead of an error.

The reporter was drag-reordering in a custom sidebar (fork of Examples/CustomSidebars/workspaces.js) with 5 workspaces in one window; the drop dispatched workspace.reorder with an index out of range for the internal array, and the whole app died, losing two workspaces from the window.

The reporter notes this is easy to hit from the documented data contract: a sidebar author only has workspaces[i].index to work from, and that value can disagree with the array reorderWorkspace indexes into. The shipped workspaces.js example computes its index the same way.

Evidence

Crash report: cmux-2026-09-21-143234.ips, incident 55593AFE-A396-4FB3-ACEE-2D69684271B4.

Workaround (reporter side): clamp the index to [0, count-1] before calling cmux("workspace.reorder").

• Reporter: florian.freudenberg@zenjob.com

Source report: Gmail 1a0c3fddfbb3944b

Environment:

• cmux 0.64.25 (build 106, commit b685a275c)
• macOS 26.6.2 (Build 25G83)
• Mac15,6, Apple M3 Pro, 36 GB

Expected

A control command arriving over the socket should never be able to terminate the app. reorderWorkspace should clamp or early-return on an out-of-range toIndex, making a bad index a no-op error rather than a crash.