[austinywang]

Summary

Chief can use the user's cmux Cloud machines from the Mac through the cmux CLI, the app shows a machine's desktop over its own Cloud tunnel, and the tunnel only serves cmux's own processes.

Size: one integration PR by request (the Chief skill, Pro gating, the hub token and Open Desktop share the Cloud tunnel and land together); most of the diff is tests, localization and the design note.

• Chief and Cloud machines. A shipped chief-cloud-machines skill (and one prompt line): list machines (cmux cloud list-machines), create one (cmux cloud new-machine, the Create card still asks the person), run commands and the machine's own cmux (cmux cloud exec), and drive its Linux desktop with cua-driver, pulling screenshots back with cloud file-read. The skill forbids building tunnels, bridges or local ports, and says older notes that do are out of date.
• cmux Pro. A create refusal that names cmux Pro (upgradeRequired on /api/vm, or the app server's plan_required) is a typed CloudAPIError.planRequired, and the person sees one "Cloud machines need cmux Pro" dialog whoever asked (click, CLI, Chief).
• Open Desktop (cmux cloud open-desktop --target machine:<id>, palette and the machine menu's Connection submenu): the machine's noVNC page in a Chromium tab at http://<machine>.cloud-desktop.localhost:6901/…. RemoteLocalhostProxy (peer-checked) routes that address by its URL to the machine's private address over the app's WireGuard hub, so no port opens on this Mac; the shim store guard reroutes a desktop URL typed into another tab, and WebKit refuses one.
• Tunnel hardening (VPN parity, plans/cmux-next/cloud-tunnel-protection.md). wg hub --client-token-stdin serves only SOCKS5 clients that present a per-launch token (RFC 1929, constant-time compare); link sidecars get it on stdin (remote connect --wireguard-hub-token-stdin). The hub's config (--config -) and the WireGuard key never touch disk: the key is made per app launch and held in memory, each start enrolls its public key and the server rotates the device's peer. Found live: a Chief subagent had copied the key file into a second hub and a 127.0.0.1:16901 bridge; the two hubs knocked each other off and the desktop's mouse froze. Classic's cmux vpn up Network Extension is not ported (a product decision; see the note). The one tokenless lane is port 22, for base's cmux wg dial ssh route (cloud enroll-machine).
• Development-build viewers (the remote view pane is DEBUG-only): --viewer native, the app's VNC client over RFB-in-WebSocket (WebSocketRFBTransport) on the same tunnel; --viewer rd, Lawrence's cmux-rd host (H.264 via Cisco's OpenH264, XTest input) over the machine's daemon link (loopback-forward-v1). The rd host is not in the VM image yet.

Testing

• Fleet Swift suites at 5777e8c (step 23952-cloud-5777e8c1, all 9 green): CloudHubLoopbackTests, CloudLinkReconnectingTests, CloudAPIClientPlanRequiredTests, CloudCreationProOfferTests, CloudCLITargetTests, ActionSurfaceParityTests, ActionSurfaceExportTests, RemoteViewTabPolicyTests, RemoteViewVNCTests. CmuxVNC WebSocketTransportTests and EndToEndTests green (step d0261167).
• Rust on rbx at 6a36de6: cmux-remote wireguard_hub_e2e 3/3 (a tokenless and a forged client are refused at the real hub), socks 4/4, cmux-tui hub/stdin flags 6/6, optchat-chief all green.
• Dev build 23952-chief-cloud-machines (jobs 1aceaabc at 5f8b8bb and the 5777e8c build) dogfooded on a Freestyle machine: Chief creates and drives a machine; Open Desktop connects through the tunnel; the page moved the VM's pointer to the aimed pixel (xdotool reported 359,222 for 25% of 1440x900); with the key in memory a Chief subagent's attempt at its own SOCKS bridge was refused ("the app's hub refuses no-auth SOCKS").

Observed / Not run

• Not observed: a --viewer rd frame on screen (the host runs on one hand-set-up machine; one live Connect ended with the app exiting and no crash report, under investigation). --viewer native was not seen streaming on a VM.
• Not run: the Chief first-turn cost guard.

No capture: the visible changes are a standard CmuxDialogSpec dialog (Pro) and an Open Desktop workspace that needs a signed-in Cloud account with a running machine; the capture minis have neither, so a real capture cannot show them. The dogfood above is on a live machine.

Changelog

Added: Chief can create and use your cmux Cloud machines, including their desktop; Open Desktop shows a machine's screen over the app's own Cloud tunnel; a Cloud create on a plan without Cloud offers cmux Pro.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Chief can now create and use the user's cmux Cloud machines from the Mac through the cmux CLI, and a Cloud create on a plan without Cloud offers an Upgrade to cmux Pro dialog instead of a bare refusal.

• Ships a chief-cloud-machines skill and one prompt line: find machines with cmux cloud list-machines, create with cmux cloud new-machine (the app's Create card still asks the person), run commands and the machine's own cmux via cmux cloud exec, and drive the Linux desktop with cua-driver. The desktop helper makes its folder with exec (cloud file-mkdir makes a root-owned folder the daemon cannot write) and fails when no screenshot was saved. After a create refused for cmux Pro, the skill defers to the base's paid-plans skill: a checkout (a billing checkout link) starts only when the user asks or no dialog could show. The skill forbids its own tunnel or port bridge (a second hub on the app's key knocks the app's link off the machine; a local port hands the machine's unprotected VNC to every program on this Mac).
• New Open Desktop action (cloud open-desktop, palette and machine menu) shows a machine's desktop over the app's own WireGuard tunnel: SOCKS5 on the Cloud hub socket to the machine's private address, with no port opened on this Mac and only cmux's own Chromium allowed through. The default web viewer loads the machine's noVNC page in a cmux browser tab; --viewer native and --viewer rd (both DEBUG-only, refused without the remote view pane) show it in the app's own pane — native through RFB inside websockify's WebSocket on the machine's 6901, rd through the machine's Rust cmux-rd host (H.264) on its private address — with no sign-in sheet and no listener on this Mac; a reader drains the tunnel as it comes, so a burst never drops the session. The pane's card names the machine, says "Connecting through your Cloud tunnel," keeps its session for two minutes after a hidden tab, and reconnects by itself after a lost path (1 s up to 10). A via=cloud record connects for a person's open within 15 seconds and asks first otherwise. The desktop route serves only this Mac's tabs (a remote workspace's tab never dials this Mac's hub), and the page's URL names its machine, so remote localhost routes it by URL through relaunches, moves and hibernation with no stored state; following that URL in any other tab of this Mac reroutes to the machine's store over the app's tunnel (a shim guard keeps the page out of this Mac's store; WebKit tabs cancel the URL, which would load this Mac's loopback), and a route that cannot start leaves the page blank, never this Mac's localhost. The badge matches the machine without case. The hub now requires a per-launch token of every client — one per app launch, made in memory so a restarted hub keeps its running links (SOCKS5 username/password, constant-time compare) — and reads its config on stdin, an earlier build's file copy removed, so the private key never lands on disk and another program of this user that finds the socket gets nothing. The one tokenless exception is ssh: cmux wg dial (used by cloud enroll-machine) reaches port 22, which authenticates both ends itself, and lets a same-user program with the user's ssh key carry ssh -L to the machine's loopback services.
• A create refusal that names cmux Pro is now a typed CloudAPIError.planRequired: upgradeRequired on /api/vm with no other plan named (not a credits top-up), or the app server's plan_required, which shows the dialog's own localized copy instead of the server's English text. Only a person's own create shows the dialog, whose body is the server's reason; Upgrade opens the refusal's cmux.com link and one offer shows at a time. A CLI or Chief create gets no dialog: its answer has code cloud.plan.required and ends with (plan: …), and Chief offers the checkout. Refusals naming another plan (Max) stay plain HTTP, and a free-plan gate refusal maps to a Pro refusal already marked offered.
• The shipped skill list now holds five in install order, cmux-adoption and paid-plans beside the new skill.

Testing

• CloudAPIClientPlanRequiredTests stubs the server's own free-plan 402 body and checks .planRequired; a Pro budget naming Max and a paid plan's limit stay .http.
• CloudCreationProOfferTests checks the flow offers Pro once for a Pro refusal or the app-server plan_required, never for an ordinary refusal or an agent's create.
• CloudHubLoopbackTests checks the SOCKS5 CONNECT to the machine's address and port, the client token (a wrong token gets an auth failure), byte echoing, a refused or non-loopback connection, and an unroutable desktop address opening blank, not a reroute loop (the stand-in hub now runs off the main actor).
• WebSocketTransportTests checks the native viewer's RFB-over-WebSocket stream under a time limit: masked client frames, split server frames, a ping, and a refused or wrong handshake.
• Rust wireguard_hub_e2e checks that a tokenless and a forged client are refused and ssh's tokenless exception works.
• The desktop loop was walked on a dev Cloud machine through the tagged build's CLI: diagnostics, exec, the machine's own cmux, the helper install, launching Chrome, a click that navigated, and the screenshot round trip.
• The shipped-skill test now expects the new skill; not run yet are the full CmuxNext and optchat-chief suites and the tagged dogfood.

^{Written for commit 3634d90. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 3634d90: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr23952 -f ref=feat-cmux-next-chief-cloud-vms -f platform=macos -f backend_mode=local

Not verified: macOS jobs did not run: compile and app tests were skipped on 3634d902d6; ci-status is green without them.

CI passes on 3634d902d6 (run 40636433224 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

[blacksmith-sh]

Found 5 test failures on Blacksmith runners:

Failures

Test	View Logs
nightly must build and hand off the macOS 26 helper and Xcode 26.5 app before publishin g/ nightly must build and hand off the macOS 26 helper and Xcode 26.5 app before publishin g	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_only_restore_workloads_take_linux_and_fresh_builds_keep_macos (main.WorkflowRo utingTests.test_only_restore_workloads_take_linux_and_fresh_builds_keep_macos) (name='b uild-nightly-ghostty-cli-helper')/ test_only_restore_workloads_take_linux_and_fresh_builds_keep_macos (main.WorkflowRo utingTests.test_only_restore_workloads_take_linux_and_fresh_builds_keep_macos) (name='b uild-nightly-ghostty-cli-helper')	View Logs
test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)/ test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[austinywang]

Review and verification

The review is a correctness-first subagent review, run twice: on e5d3fea, and again on the current head fb4f2b85329ced42fa297da06aaaadcbba6136a0. The second pass's verdict is SHIP.

First pass (e5d3fea): FIX, all resolved in fb4f2b8

1. Blocker: cmux machine list prints machine_… resource ids, but --target resolves Cloud VM ids, and the list leaves out paused machines.
   • The skill now lists machines with cmux --json cloud diagnostics (every Cloud machine, by VM id).
   • CloudHandlers.machine also accepts the resource id.
2. The Pro offer covered too many refusals. upgradeRequired alone also matched Pro→Max budgets and credit top-ups.
   • It now requires no upgradePlanId other than pro, and excludes vm_create_credits_insufficient.
   • The dialog body is the server's localized reason, and Upgrade opens the refusal's cmux.com link.
3. The skill read fields at the top level. It now reads them under .result.
4. The machine's own cmux was run without HOME=/home/cmux. Added.
5. "One offer at a time" was not enforced. There is now a MainActor guard, and no dialog is shown when no window is open.
6. Nits:
   • The skill now notes that a --command can't start with --.
   • The job-log directory is created before a detached job.
   • A failed upgrade open is now logged.
   • A test now covers the creation-flow hook: CloudCreationProOfferTests.
7. The bounded 10 s wait loop in the VM-side helper is kept. The reviewer agreed it isn't blocking: it runs in the guest shell, inside the 25 s exec cap.

Second pass (fb4f2b8): SHIP, nits held for after dogfood

• The dialog title is too specific for Go-plan limits.
• The app-server plan_required path shows the backend's internal English text instead of the localized fallback.
• fromjson fails if diagnostics' details is empty.

Checks

• optchat-chief at fb4f2b8 (rbx): cargo fmt --check, every test target (75 library tests plus all integration tests), and cargo clippy --all-targets -D warnings all pass.
• CmuxNext suites at c8ff24d (cmux-ci step 5e4cc4836f23dda9b4c795b5, aws-m4pro-2, Xcode 26.6): all passed.
  • Suites: CloudAPIClientPlanRequiredTests, CloudCreationProOfferTests, CloudAPIClientSnapshotIdempotencyTests, CloudLegacyCreateConfirmTests, CloudMachineRequestCardTests, CloudRequestAskerGoneTests, CloudCLITargetTests.
  • c8ff24d is this head plus only the one-line base fix from cmux NEXT: fleet app builds pass the web step again (agent pane bundles ContextSection.css) #23939. The base is red (ContextSection.css is missing from the agent pane build since cmux NEXT Inspector: Context opens to Claude's breakdown; Connectors says N to reconnect #23789), and every step that builds the web bundles fails on it, including the first Swift step at e5d3fea (842e0595e8d711221f6569c4).
• Dogfood build: fleet job 22bdae23d12a33ec7b51eff9 at c8ff24d, tag 23952-chief-cloud-machines, sha256 d1bd83d5…, against dev backend https://cmux-dev-backend-1.tail137216.ts.net:4799/. The tag's backend is set to Pro with free provisioning.
• Not run yet:
  • the Chief first-turn cost guard (runs at landing);
  • the dogfood itself (Chief creating a machine, running a cua-driver step and posting a screenshot), which is with Austin;
  • the native capture of the dialog.

[teamleaderleo]

Bead cx-iclbe created for this PR by the cmux coordinator.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[austinywang]

Review of 0263369 (independent subagent, correctness first): FIX, with one blocker.

1. Blocker, fixed in 61265ff. The CEF shim's store guard (IsCloudDesktopHost) refuses any *.cloud-desktop.localhost host in the ordinary store. Swift's routing only routes one DNS label, from this Mac's tabs. For any other desktop host (a_b., x.y., a trailing dot, or a remote tab whose localhost is this Mac on purpose), Swift gave the page the ordinary store again, and TabContentCache.reroute rebuilt the browser forever. A web page could trigger this.
   • The fix adds RemoteLocalhostStorePlan.blank: such an address opens blank.
   • isCloudDesktop now drops a trailing dot, as the shim does.
   • Regression test: CloudHubLoopbackTests.aDesktopAddressThatCannotRouteOpensBlankNotAReroute. It is red at c3da2a8 (RemoteLocalhostStorePlan has no member blank) and green at 61265ff (5 suites passed on the fleet).

Lows (not fixed here, none blocking):

• A trailing-dot desktop URL for a real machine opens blank. It fails closed.
• A Max refusal shows the failure text but no upgrade card; Chief and the CLI still get cloud.plan.required with the plan.
• If Open Desktop's tab never appears, the person-open mark keeps its 15 s window.
• The first Open Desktop after launch can time out while the hub is still starting.
• A Cloud VNC tab retries every 10 s while it stays open.

Re-review of 61265ff: SHIP at 61265ff. It checked every Chromium configuration path: creation, reroute, hibernated wake, duplicate, history, popups and ChromiumNewTabNow. Each ends blank or in the right store, and the Swift and shim host checks now agree.

Then I merged origin/feat-cmux-next (8711a8c), giving head ea69bc6. The one conflict was CloudMachineCreateFlow: base's new rule (the upgrade card only for creates a person started) is kept, together with this PR's Failure.upgradeRequired(reason). Base's new test now expects .upgradeRequired(.freePlan). The fleet build and the focused suites are running on ea69bc6.

[austinywang]

Review (claude subagent, independent): SHIP at 8f8e081

Review history

• ea69bc6 (a merge of origin/feat-cmux-next 8711a8c): FIX, one blocker. Base made the upgrade card person-only, but this PR's planRequired hook still opened the Pro dialog for a Chief or CLI create that the server refused.
• Fix: CloudCreationFlow.startedByPerson gates the hook. The agent still gets cloud.plan.required with the plan.
• Regression test: CloudCreationProOfferTests.anAgentsServerRefusedCreateOffersNothing. It is red at d0a17c7 (no startedByPerson) and green at 8f8e081.
• The re-review of 8f8e081 checked every flow caller (New Cloud Machine and Workspace: person vs CLI/MCP/page; Retry and Dismiss) and gave SHIP.

Lows (follow-ups, not blocking)

• A person's Retry builds the flow as not person-started, as it did before this PR, so Retry shows no second Pro card.
• Base's own legacy 402 path still shows the card to agents. This is the same on 8711a8c and is asserted by base's aServerPlanRefusalBecomesTheUpgradeCard.

Checks on 8f8e081

• Fleet suites: 11 of 12 passed (CloudHubLoopback, CloudLinkReconnecting, CloudAPIClientPlanRequired, CloudCreationProOffer, CloudCreateWithoutAsking, CloudCLITarget, CloudErrorText, ActionSurfaceExport, RemoteViewTabPolicy, RemoteViewVNC, OmnibarFilePathDisplay).
• ActionSurfaceParityTests.everyMenuKeepsAShortTopLevel fails (.sidebarBackground has 14 top-level rows). This is a base finding: the same failure occurs on 8711a8c, and this PR places nothing in that menu.
• prepush gate: no new violations.
• Fleet build e0463fee87d5fe8321da242b is done and installed as tag 23952-chief-cloud-machines.
• optchat-chief: cargo fmt is clean. 121 of 122 tests pass. The failing test, memory_sync_state::detect_finds_…, needs the zip binary, which the rbx builder lacks; this PR does not touch that file.

Not run: a live Open Desktop --viewer rd click-through on this head.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[austinywang]

Review (claude subagent, independent): SHIP at 0f7afcc

What changed since 8f8e081

• The merge. b909146 merged origin/feat-cmux-next (a6c49db). Six conflicts, each resolved by keeping both sides:
  • CloudTunnelHub: base's hub restart and stable socket symlink, plus this PR's in-memory key and token;
  • CloudMachineLink: base's VM-kind arguments, plus the token on stdin;
  • CloudMachineCreation and CloudHandlers+Account: base's bootstrap hook, plus the Pro offer gated on startedByPerson;
  • CloudLinkReconnectingTests;
  • cmux-tui/spec/cli.md.
• The ssh lane. Base's cloud enroll-machine ssh ProxyCommand (cmux wg dial --hub) is a separate process with no token. The hub now admits a client without the token to port 22 only: wireguard_hub::OPEN_PORTS, and socks::Greeting returns Refused, Authenticated or Open. Every other port still needs the token.
• Docs. a89f79a states what the lane gives back: a same-user program that can use this Mac's ssh key can ssh -L through an enrolled machine's sshd to that machine's loopback services. It names the narrowing options (an open lane only for enrolled addresses, or restrict on the enrolled authorized_keys line) as a policy question for Design and product calls (gallery: #15427), plus CI admin #13742. That is not posted there yet.
• Compile fix. The fleet build of b909146 failed with CloudAPIError.swift:43: switch must be exhaustive, because base added CloudAPIError.code (job a0fbe73ed6b0f931568b8701). 0f7afcc adds .planRequired: "plan_required".

Reviews

• b909146: SHIP. The token can't be bypassed: offering both methods selects user/pass, and a tokenless client can't reach any port but 22. Hubs without a token behave as before. Base's restart keeps the token, the key and the socket path.
• 0f7afcc: SHIP. Every switch over CloudAPIError is exhaustive, and sandboxCode maps a plan refusal to unavailable, as base does for any code it doesn't list.

Checks on 0f7afcc

• Fleet build 4e401ed9e50d776345281d0f: done, installed as tag 23952-chief-cloud-machines.
• Focused suites: all 11 passed (CloudHubLoopback, CloudLinkReconnecting, CloudAPIClientPlanRequired, CloudCreationProOffer, CloudCreateWithoutAsking, CloudCLITarget, CloudErrorText, ActionSurfaceExport, RemoteViewTabPolicy, RemoteViewVNC, OmnibarFilePathDisplay).
• ActionSurfaceParityTests was left out. It fails on base 8711a8c with .sidebarBackground has 14 top-level rows, the same failure as on this PR, so it is a base finding.
• rbx at b909146: cmux-remote all green, including the wireguard_hub_e2e ssh-lane assertions; the 8 wg_ tests in cmux-tui green; cargo fmt clean.
• prepush gate: no new violations.

Not run: a live --viewer rd click-through on this head.

[github-actions]

Default changes

This pull request changes 7 defaults at 3634d902d6df (what everyone gets without configuring anything):

• tunable-source.CmuxNextActions/ActionSurfaceCatalog+MenusContent.swift:contentPlacements: "047202114c4c6cd393b7cf9cbd0f8e811d090ed92f1ecfe688d0b5204d0650db" -> "79a906ee164b61f61a7a235b1100bae5a09af3035dda1d0a78d2be2df8278b07"
• tunable-source.CmuxNextApp/Cloud/CloudStrings+Errors.swift:apiErrorText: "f10053d5a1b75379d156debd105868baf524fec409a8634705515b7fb366b56a" -> "e8bd7f1d699fb481a826021417278053a90563353dd06cd322580ea63d7a1199"
• tunable-source.CmuxNextApp/Control/AppControl+Cloud.swift:runError: "6b8df46136da12416fe87c24329263cebe6f77d7837365b4ad2eae6564dd8c52" -> "afba481aff824b1902dca59141e96b61fbb3556740e3a9ed54a5fe29eeb75752"
• tunable-source.CmuxNextApp/Handlers/CloudHandlers.swift:machine: "c1c7d7548f9f0e4ee339028cd9dc4453fd3c27c44a9f22552b28751041e7cc7d" -> "1f88adcd3d5d33f9162c228346cb8b2f76a206289ad801640297c04fcf130c9b"
• tunable-source.CmuxNextApp/Handlers/WorkspaceHandlers.swift:createAndShow#: "bbfdf603022d47aebcaf02796766a536e9a29dc2b876e6e6a1a22886ab1940ef" -> "a2535c5257a941ce9b1122b18a253ec2a3d1607decb445b0c120c279b9bc0b5f"
• tunable-source.CmuxNextRemoteViewSessions/RemoteViewPageSession.swift:cloudRFBTransport: (none) -> "334f18a0365c77e2cd35f507538a4989196ced49813c59b21d1baceb56406cbf"
• tunable-source.CmuxNextRemoteViewSessions/RemoteViewPageSession.swift:make: "6c65fc2109e7b0fd1f2c66d59eeba822d00018dd8b0cd8b9a08398627ece3af0" -> "896afa50147e8ca82ee9837a25fb4f9504db86320aa782a4bb1f89d4e0a9a9d6"

Needs a review. It passes with an independent review receipt on this commit: a comment or review whose first line is Review (<reviewer>): SHIP at 3634d902d6dffe6c02d89abf00d3248919642e54, from a member, not a self-review (the newest verdict naming the head decides; a later BLOCK beats an earlier SHIP), or with an approving review on this commit from @lawrencecchen or @teamleaderleo (the call owners in .github/defaults-call-owners.json, never the author). A receipt posted as a review re-runs this check; after a plain comment, re-run it. The needs a call label alone does not pass, and a new push needs a new receipt.

Merge receipt: merged as 0ab915d9442e with these defaults changed, WITHOUT a SHIP receipt or an approving call owner review on its head.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40626998043 at 0341883 failed: cmux-next generated files.
Those jobs last passed at 46c2c64. This pull request is one of 2 merged since: #26584, #23952.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40626020108 at 0ab915d failed: cmux-next checks (god files, concurrency, crash safety, l10n), cmux-next generated files.
Those jobs last passed at 46c2c64. This pull request is one of 2 merged since: #26584, #23952.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40627558915 at 47b4dbb failed: cmux-next checks (god files, concurrency, crash safety, l10n), cmux-next generated files.
Those jobs last passed at 46c2c64. This pull request is one of 3 merged since: #26584, #23952, #26596.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40628944074 at 18af98c failed: cmux-next generated files.
Those jobs last passed at 46c2c64. This pull request is one of 4 merged since: #26584, #23952, #26596, #26609.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[austinywang]

Review (claude subagent, independent): SHIP at 3634d90

This head

• 3634d90 merges origin/feat-cmux-next 46f5779 into 0f7afcc (SHIP at 0f7afcc) with no conflicts.
• It picks up base's own compile fix 3186450 (CuaSocketClient.send is nonisolated). That fix is what turned 0f7afcc's CI red: ComputerUseSetup.swift:236 was a base finding, a file this PR does not touch.

Review findings

• No blockers. Everything base brought in either doesn't overlap this PR or adds alongside it: CloudMachineLink.ownerPID, the newCloudWorkspace changes, and CloudMove --to-pid/--vm-kind.
• Nothing calls an API this PR replaced, and no new switch over CloudAPIError appeared.
• Advisory, for a follow-up: base's new Chief cloud_workspace tool hands Chief only the error's message, so a plan refusal reads "… (plan: pro)" without the cloud.plan.required code that the tool's description names. Its header comment also still says an agent's free-plan create shows an upgrade card.

Checks on 3634d90

• Fleet build 72e80d61e319a0c3cd1866ee: done.
• Focused suites, step ac1846d88656702fcb270625 on aws-m4pro-4: all 12 passed (CloudHubLoopback, CloudLinkReconnecting, CloudAPIClientPlanRequired, CloudCreationProOffer, CloudCreateWithoutAsking, CloudCLITarget, CloudErrorText, ActionSurfaceExport, ActionSurfaceParity, RemoteViewTabPolicy, RemoteViewVNC, OmnibarFilePathDisplay). The first run, step 32f0a4100f4aff18ef7e8899, timed out on cmux10s-Mac-mini (step exit 124), an infrastructure failure, so I reran the same SHA.
• prepush gate: no new violations.
• PR size: passes with the Size: line (one integration PR, by request).
• defaults guard: the 7 changed defaults are this PR's own Cloud error mapping, machine target, Open Desktop placement and remote view transports, all reviewed above.

Not run: a live --viewer rd click-through on this head.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4068813240101 (127a2705ef)

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4069035197201 (2645001cde)