Cloud: make New Machine creation optimistic

.github/scripts/install-app-store-provisioning-profile.sh

@@ -104,6 +104,7 @@ validate_extension_profile() {
   fi
   if ! python3 - "$plist_path" "$EXPECTED_CERT_SHA256" <<'PY'
 import hashlib
+import os
 import plistlib
 import sys
 from datetime import datetime, timezone
@@ -116,8 +117,18 @@ if entitlements.get("get-task-allow") is not False:
     raise SystemExit("profile is not an App Store distribution profile")
 if profile.get("ProvisionsAllDevices") or "ProvisionedDevices" in profile:
     raise SystemExit("profile is not an App Store distribution profile")
+# Tests inject a fixed instant so a fixture never depends on the real clock;
+# the release lanes leave it unset and validate against now.
+fixed_now = os.environ.get("IOS_APPSTORE_PROFILE_VALIDATION_TIME", "")
+if fixed_now:
+    now = datetime.fromisoformat(fixed_now.replace("Z", "+00:00"))
+    if now.tzinfo is None:
+        raise SystemExit("IOS_APPSTORE_PROFILE_VALIDATION_TIME must carry a timezone offset")
+    now = now.astimezone(timezone.utc)
+else:
+    now = datetime.now(timezone.utc)
 expiration = profile.get("ExpirationDate")
-if not isinstance(expiration, datetime) or expiration.astimezone(timezone.utc) <= datetime.now(timezone.utc):
+if not isinstance(expiration, datetime) or expiration.astimezone(timezone.utc) <= now:
     raise SystemExit("profile is expired")
 if expected_cert:
     fingerprints = {

.github/workflows/ci.yml

@@ -1874,6 +1874,7 @@ jobs:
             CMUXAuthCore
             CmuxBrowser
             CmuxCanvasUI
+            CmuxCloudMachines
             CmuxCore
             CmuxRemoteDaemon
             CmuxRemoteWorkspace
@@ -2710,6 +2711,10 @@ jobs:
           path: ghostty-cli-helper
 
       - name: Install universal Ghostty CLI helper
+        env:
+          # install-cmux-tui-client.sh verifies the manifest's build-provenance
+          # attestation with gh before trusting it.
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           /bin/bash ./tests/test_install_cmux_tui_client.sh

.github/workflows/cloud-machine-tests.yml

@@ -0,0 +1,39 @@
+name: Cloud machine lifecycle
+
+on:
+  pull_request:
+    paths:
+      - Packages/macOS/CmuxCloudMachines/**
+      - .github/workflows/cloud-machine-tests.yml
+  workflow_dispatch:
+    inputs:
+      runner:
+        description: Optional hosted macOS runner label
+        required: false
+        default: ""
+        type: string
+      ref:
+        description: Source ref to test
+        required: false
+        default: ""
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloud-machine-tests-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lifecycle:
+    runs-on: ${{ inputs.runner || vars.MACOS_RUNNER_15 || 'blacksmith-6vcpu-macos-15' }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - name: Select Xcode
+        run: ./scripts/select-ci-xcode.sh
+      - name: Test the package without launching the app
+        run: swift test --package-path Packages/macOS/CmuxCloudMachines -Xswiftc -warnings-as-errors

.github/workflows/nightly.yml

@@ -602,6 +602,10 @@ jobs:
       # Bundle once here, not per sign variant, so every variant carries the same
       # cmux-tui build and the download happens a single time.
       - name: Bundle the cmux-tui client
+        env:
+          # install-cmux-tui-client.sh verifies the manifest's build-provenance
+          # attestation with gh before trusting it.
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           app="build-universal/Build/Products/Release/cmux.app"

.github/workflows/release.yml

@@ -360,6 +360,10 @@ jobs:
 
       - name: Install universal Ghostty CLI helper
         if: steps.guard_release_assets.outputs.skip_all != 'true'
+        env:
+          # install-cmux-tui-client.sh verifies the manifest's build-provenance
+          # attestation with gh before trusting it.
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           ./scripts/install-prebuilt-ghostty-cli-helper.sh \

.github/workflows/reload-build.yml

@@ -113,56 +113,41 @@ jobs:
             echo "cmux-cua build script absent in source ref; skipping Rust provisioning"
           fi
 
-      # The app's Cloud machine path requires the wireguard-hub cmux-tui
-      # capability. Do this before Xcode or cache work, and pass the exact
-      # source-built binary into reload.sh. A rolling download can lag the app
-      # source and otherwise fails only after the full macOS build completes.
-      - name: Install Zig for bundled cmux-tui (macOS)
+      # Reuse an immutable client built from the exact cmux-tui/Ghostty inputs.
+      # App-only changes do not require recompiling cmux-tui on a Mac.
+      # The artifact host is not trusted: the manifest must carry the Sigstore
+      # build-provenance attestation that cmux-tui-artifacts.yml signs for this
+      # exact source commit before the installer reads a hash from it or the
+      # client runs (`remote-probe` inside the installer, then below).
+      - name: Install and validate matching published cmux-tui client (macOS)
         if: ${{ inputs.platform == 'macos' && hashFiles('cmux-tui/Cargo.toml') != '' }}
-        run: ./scripts/install-zig-ci.sh
-
-      - name: Build and validate exact cmux-tui client (macOS)
-        if: ${{ inputs.platform == 'macos' && hashFiles('cmux-tui/Cargo.toml') != '' }}
-        working-directory: cmux-tui
         env:
-          CARGO_TARGET_DIR: ${{ runner.temp }}/cmux-tui-target
-          CMUX_TUI_DISTRIBUTION_VERSION: 0.0.0-dev-${{ inputs.tag }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          export PATH="$HOME/.cargo/bin:$PATH"
-          source_sha="$(git -C .. rev-parse HEAD)"
-          ghostty_sha="$(git -C ../ghostty rev-parse HEAD)"
-          export CMUX_TUI_BUILD_COMMIT="$source_sha"
-          export CMUX_TUI_GHOSTTY_COMMIT="$ghostty_sha"
-          target="$(rustc -vV | awk '/^host: / { print $2 }')"
-          case "$target" in
-            aarch64-apple-darwin|x86_64-apple-darwin) ;;
-            *) echo "unsupported macOS Rust host target: $target" >&2; exit 1 ;;
-          esac
-          cargo build -p cmux-tui --bin cmux-tui --release --locked --target "$target"
-          client="$CARGO_TARGET_DIR/$target/release/cmux-tui"
-          test -x "$client"
+          client_commit="$(scripts/ci/resolve-cmux-tui-client-commit.sh)"
+          git diff --exit-code "$client_commit" HEAD -- cmux-tui ghostty
+          client_bundle="$RUNNER_TEMP/cmux-tui-prebuilt"
+          mkdir -p "$client_bundle/Contents"
+          env -u CMUX_TUI_CLIENT_LOCAL scripts/install-cmux-tui-client.sh "$client_bundle" \
+            --manifest-url "https://files.cmux.com/cmux-tui/$client_commit/manifest.json" \
+            --expected-commit "$client_commit" --require-capability wireguard-hub \
+            --attest-signer-workflow "$GITHUB_REPOSITORY/.github/workflows/cmux-tui-artifacts.yml"
+          client="$client_bundle/Contents/Resources/bin/cmux-tui"
           probe="$($client remote-probe --json)"
           version="$($client --version)"
-          PROBE="$probe" VERSION="$version" EXPECTED_COMMIT="$source_sha" EXPECTED_GHOSTTY="$ghostty_sha" python3 - <<'PY'
+          ghostty_sha="$(git -C ghostty rev-parse HEAD)"
+          PROBE="$probe" VERSION="$version" EXPECTED_COMMIT="$client_commit" EXPECTED_GHOSTTY="$ghostty_sha" python3 - <<'PYVERIFY'
           import json
           import os
 
           probe = json.loads(os.environ["PROBE"])
-          version = os.environ["VERSION"]
-          expected = os.environ["EXPECTED_COMMIT"]
-          expected_ghostty = os.environ["EXPECTED_GHOSTTY"]
-          if probe.get("build_identity") != expected:
-              raise SystemExit(
-                  f"cmux-tui build identity {probe.get('build_identity')!r} != {expected!r}"
-              )
-          if "wireguard-hub" not in probe.get("capabilities", []):
-              raise SystemExit("cmux-tui client lacks wireguard-hub capability")
-          if expected_ghostty not in version:
-              raise SystemExit("cmux-tui client does not carry the checked-out Ghostty identity")
-          PY
+          if probe.get("build_identity") != os.environ["EXPECTED_COMMIT"]:
+              raise SystemExit("published cmux-tui client has the wrong build identity")
+          if os.environ["EXPECTED_GHOSTTY"] not in os.environ["VERSION"]:
+              raise SystemExit("published cmux-tui client has the wrong Ghostty identity")
+          PYVERIFY
           echo "CMUX_TUI_CLIENT_LOCAL=$client" >> "$GITHUB_ENV"
-          echo "cmux-tui ready: $client"
 
       - name: Prepare macOS cache metadata
         if: ${{ inputs.platform == 'macos' }}
@@ -561,6 +546,11 @@ jobs:
           app_path="$(awk '/^App path:/{getline; sub(/^  /,""); print; exit}' "$log")"
           [ -n "$app_path" ] && [ -d "$app_path" ] || { echo "could not locate built app" >&2; exit 1; }
           echo "app_path=$app_path" >> "$GITHUB_OUTPUT"
+          if [ -f tests/test_cli_vm_create_name.py ]; then
+            CMUX_CLI_BIN="$app_path/Contents/Resources/bin/cmux" \
+              DYLD_FRAMEWORK_PATH="$app_path/Contents/Frameworks:$derived_data/Build/Products/Debug" \
+              python3 tests/test_cli_vm_create_name.py
+          fi
           mkdir -p artifact
           ( cd "$(dirname "$app_path")" && ditto -c -k --sequesterRsrc --keepParent "$(basename "$app_path")" "$GITHUB_WORKSPACE/artifact/app.zip" )
 

.github/workflows/test-depot.yml

@@ -3,6 +3,9 @@ name: Run tests on Depot
 on:
   workflow_call:
     inputs:
+      runner:
+        type: string
+        default: ""
       ref:
         type: string
         default: ""
@@ -23,6 +26,11 @@ on:
         default: "120"
   workflow_dispatch:
     inputs:
+      runner:
+        description: Optional hosted macOS runner label
+        required: false
+        default: ""
+        type: string
       ref:
         description: Branch or SHA to test
         required: false
@@ -52,7 +60,7 @@ on:
 
 jobs:
   tests:
-    runs-on: ${{ vars.MACOS_RUNNER_15 || 'blacksmith-6vcpu-macos-15' }}
+    runs-on: ${{ inputs.runner || vars.MACOS_RUNNER_15 || 'blacksmith-6vcpu-macos-15' }}
     timeout-minutes: ${{ inputs.unit_test_suites != '' && 35 || 20 }}
     steps:
       - name: Clear stale git locks (self-hosted reused workspace)

CLI/cmux.swift

@@ -70,7 +70,6 @@ private func agentHookDebugLogPath(socketPath: String?, env: [String: String]) -
     if let explicit = agentHookDebugNonEmpty(env["CMUX_DEBUG_LOG"]) {
         return NSString(string: explicit).expandingTildeInPath
     }
-
     if let socketPath {
         let socketName = URL(fileURLWithPath: socketPath).lastPathComponent
         if socketName.hasPrefix("cmux-debug-"), socketName.hasSuffix(".sock") {
@@ -4204,12 +4203,12 @@ struct CMUXCLI {
         return VMMachineKind.defaultKind
     }
     private static let cloudVMDesktopPort = 6901
-    /// `vm shell <id>` and `vm open <id>`: the shared cloud open path through the
-    /// machine's cmux-tui remote daemon. Desktop panes are opened explicitly.
+    /// Opens the machine shell through cmux-tui, honoring explicit background attachment.
     func openVMWorkspaceShell(
         vmId: String,
         windowRaw: String?,
         targetWorkspaceId: String?,
+        focus: Bool = true,
         client: SocketClient,
         jsonOutput: Bool,
         idFormat: CLIIDFormat
@@ -4220,7 +4219,7 @@ struct CMUXCLI {
             windowRaw: windowRaw,
             targetWorkspaceId: targetWorkspaceId,
             forceSSH: false,
-            shouldPinWorkspaceToTop: false,
+            shouldPinWorkspaceToTop: false, focus: focus,
             client: client,
             jsonOutput: jsonOutput,
             idFormat: idFormat
@@ -4452,14 +4451,17 @@ struct CMUXCLI {
         return directAgentKeys.contains { normalizedEnvValue(environment[$0]) != nil }
     }
 
-    private static func vmCreateIdempotencySignature(image: String?, provider: String?) -> String {
+    private static func vmCreateIdempotencySignature(image: String?, provider: String?, workspace: String?) -> String {
         let normalizedImage = image?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
         let normalizedProvider = provider?
             .trimmingCharacters(in: .whitespacesAndNewlines)
             .lowercased() ?? ""
-        return "image=\(normalizedImage)\u{1f}provider=\(normalizedProvider)"
+        let normalizedWorkspace = workspace?
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+            .lowercased() ?? ""
+        if normalizedWorkspace.isEmpty { return "image=\(normalizedImage)\u{1f}provider=\(normalizedProvider)" }
+        return "image=\(normalizedImage)\u{1f}provider=\(normalizedProvider)\u{1f}workspace=\(normalizedWorkspace)"
     }
-
     private static func normalizedVMProvider(_ provider: String?) throws -> String? {
         guard let trimmed = provider?.trimmingCharacters(in: .whitespacesAndNewlines),
               !trimmed.isEmpty else {
@@ -4474,11 +4476,8 @@ struct CMUXCLI {
         }
         return normalized
     }
-
     private static func isFlagToken(_ value: String) -> Bool { value.hasPrefix("-") && value != "-" }
-
     private static func isUnknownFlagToken(_ value: String, allowedShortFlags: Set<String> = []) -> Bool { isFlagToken(value) && !allowedShortFlags.contains(value) }
-
     private static func validatedVMSessionIdentifier(_ value: String?, flag: String) throws -> String? {
         guard let trimmed = value?.trimmingCharacters(in: .whitespacesAndNewlines),
               !trimmed.isEmpty else {
@@ -4517,9 +4516,9 @@ struct CMUXCLI {
         try? fileManager.setAttributes([.posixPermissions: 0o600], ofItemAtPath: url.path)
     }
 
-    private static func activeVMCreateIdempotency(image: String?, provider: String?) throws -> ActiveVMCreateIdempotency {
+    private static func activeVMCreateIdempotency(image: String?, provider: String?, workspace: String? = nil) throws -> ActiveVMCreateIdempotency {
         let url = vmCreateIdempotencyStoreURL()
-        let signature = vmCreateIdempotencySignature(image: image, provider: provider)
+        let signature = vmCreateIdempotencySignature(image: image, provider: provider, workspace: workspace)
         let now = Date().timeIntervalSince1970
         var store = loadVMCreateIdempotencyStore(from: url)
         store.records = store.records.filter { _, record in
@@ -5634,7 +5633,7 @@ struct CMUXCLI {
                     try openVMWorkspaceShell(
                         vmId: vmId,
                         windowRaw: windowOpt ?? windowId,
-                        targetWorkspaceId: workspaceOpt,
+                        targetWorkspaceId: workspaceOpt, focus: focus ?? true,
                         client: client,
                         jsonOutput: jsonOutput,
                         idFormat: idFormat
@@ -5791,8 +5790,7 @@ struct CMUXCLI {
                     memoryMb = nil
                 }
                 let remaining = rem3.filter { !["--detach", "-d", "--desktop", "--base", "--no-desktop"].contains($0) }
-                // The kind is what the CLI asks for; the backend picks the image. The
-                // machine gets its screen streamed into a browser split beside the shell.
+                // The backend resolves the machine kind to its image.
                 let machineName = nameOpt?.trimmingCharacters(in: .whitespacesAndNewlines)
                 if let unknown = remaining.first(where: { Self.isUnknownFlagToken($0, allowedShortFlags: ["-d"]) }) {
                     throw CLIError(message: """
@@ -5841,14 +5839,16 @@ struct CMUXCLI {
                 // not expose sizing ignore this optional field; providers that do use it
                 // for runtime memory get it, and the backend applies the plan ceiling.
                 if let memoryMb { params["memory_mb"] = memoryMb }
+                if let machineName, !machineName.isEmpty { params["display_name"] = machineName }
                 // Freestyle is the default and only deployed provider. It does not support
                 // persistent home volumes, so leave both volume flags out of this request.
                 let targetWindow = try validatedWindowHandle(windowOpt ?? windowId, client: client)
                 // Store-based idempotency: retries of a failed create reuse the key; a
                 // successful create clears it, so the next `vm new` makes a new machine.
                 let idempotency = try Self.activeVMCreateIdempotency(
                     image: imageOptRaw ?? "kind=\(machineKind.rawValue)",
-                    provider: normalizedProvider
+                    provider: normalizedProvider,
+                    workspace: targetWorkspaceOpt
                 )
                 params["idempotency_key"] = idempotency.key
                 let vmCreateStartedAt = Date()
@@ -5885,8 +5885,8 @@ struct CMUXCLI {
                 let id = (response["id"] as? String) ?? "?"
                 let provider = (response["provider"] as? String) ?? "?"
                 let image = (response["image"] as? String) ?? "?"
-                // The label is display-only and best-effort: the machine exists either way.
-                if let machineName, !machineName.isEmpty {
+                // Older backends ignore create-time naming; preserve their rename behavior.
+                if let machineName, !machineName.isEmpty, response["displayName"] as? String != machineName {
                     _ = try? client.sendV2(
                         method: "vm.rename",
                         params: ["id": id, "display_name": machineName],

Packages/macOS/CmuxCloudMachines/README.md

@@ -27,3 +27,34 @@ let resources = CloudMachineResourcePresentation(
 )
 // resources.memory.percent == 50
 ```
+
+`CloudMachineCreateCoordinator` owns pending creates, retry fences, cancellation
+receipts, and adoption aliases. Reserve synchronously before launching I/O; feed
+progress and completion back with the returned `CloudMachineCreateAttempt`. Apply
+`CloudMachineCreateTransition` effects only after the state transition. The app
+adapter owns processes, redaction, localized labels, notifications, and workspaces.
+No package test needs to launch AppKit or a process:
+
+```swift
+let owner = CloudMachineCreateCoordinator(
+    output: CloudMachineCreateOutput(legacyCreatedFormat: "Created Cloud VM %@"),
+    now: { Date(timeIntervalSince1970: 123) }
+)
+let workspaceID = UUID()
+let request = CloudMachineCreateRequest(
+    arguments: ["vm", "new", "--workspace", workspaceID.uuidString],
+    isBaseSetup: false, presentationWorkspaceID: workspaceID,
+    retainsPendingProjection: true
+)
+let attempt = owner.reserve(request)
+// owner.projection already contains the pending row before starting the launcher.
+let teardown = owner.cancelPresentations([workspaceID])
+// teardown never requests another workspace close.
+```
+
+Adoption aliases persist for the account session, including after a successful
+operation retires. This uses one small mapping per created machine so coalesced,
+partial, and out-of-order panel refreshes cannot change row identity. Cancellation
+tombstones remain until process termination instead of evicting live receipts.
+Retries retain their original CLI idempotency scope; backend allocation durability
+and the CLI's idempotency store remain outside this package.