Fix Computer Use onboarding readiness after permissions are granted

[austinywang]

Fixes #14048. When the standalone helper reports both required TCC grants, promote a stale persisted onboarding phase to ready so the daemon publishes external permission readiness and MCP startup succeeds. Direct screen-capture consent remains separate. Added a regression test for the phase transition.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes #14048. When the standalone helper reports both accessibility and screen-recording TCC grants, promote a stale persisted onboarding phase to ready so the daemon publishes external permission readiness and MCP startup succeeds. Direct screen-capture consent remains separate.

Stops serializing the CUA socket auth token into Claude's argv-visible MCP config; the bundled client now inherits it from the environment so same-user processes can't read it via ps.

• Adds a regression test for the .onboarding → .ready phase transition.

^{Written for commit 4a1ea33. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 441699d1-817c-4658-b579-4e052016b499

📥 Commits

Reviewing files that changed from the base of the PR and between ae5c960 and 4a1ea33.

📒 Files selected for processing (2)

• Resources/bin/cmux-claude-wrapper
• tests/test_claude_wrapper_hooks.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Automatic catch-up: main is green again and this branch needed it.

I tried to catch this branch up with main (e0e635e38fbb), but these files need a person:

• Packages/macOS/CmuxComputerUse/Sources/CmuxComputerUse/ComputerUseRuntimeService.swift: not a generated file; needs a person

Nothing was pushed. Merge main locally, fix those, and push; /catch-up is there again whenever you want it.

Automatic catch-up will not try this head again; a new push or /catch-up does.
Label the pull request no-auto-catch-up to opt out.

_{Catch-up run}

[github-actions]

Automatic catch-up: main is green again and this branch needed it.

I tried to catch this branch up with main (e0e635e38fbb), but these files need a person:

• Packages/macOS/CmuxComputerUse/Sources/CmuxComputerUse/ComputerUseRuntimeService.swift: not a generated file; needs a person

Nothing was pushed. Merge main locally, fix those, and push; /catch-up is there again whenever you want it.

Automatic catch-up will not try this head again; a new push or /catch-up does.
Label the pull request no-auto-catch-up to opt out.

_{Catch-up run}

[github-actions]

Merge receipt for 4a1ea33ad5: every check was green at merge (10 verified; 13 skipped by policy). Full suite runs on main after merge.