[austinywang]

Fixes #25595

Cloud terminals and VM-port browser tabs recover after a link drop or a relaunch. Terminal input uses a separate link lane from bulk output and browser traffic, and terminal reattachment no longer waits for an echo that the daemon does not send.

What changed

• Use --lanes auto for the Cloud link, retaining the transport's single-link fallback.
• Count the replay grid as announced when reattaching a terminal, so a claim of that size needs no further echo.
• Retry failed machine-list reads with the existing capped retry policy; reset the budget when the account changes. Preserve the base's connection/read ordering fences.
• Reload remote-localhost pages that received “not connected” when their machine reconnects. Restore Cloud proxy tabs lazily and refresh stale routes with backoff.
• Require a connected daemon before automatic route refetch. Cached running/paused records can lag, so background page traffic must not resume a disconnected VM.
• Keep a blocked proxied tab blank when its proxy cannot start, preventing fallback to this Mac's localhost.
• Move shared browser-route validation into CmuxNextRemoteLocalhostService, preserving limits, refusal codes, hashing and page-origin authorization while reducing app-layer code.

App-link proxy routing remains opt-in with CMUX_NEXT_CLOUD_LINK=app.

No capture: no visible UI change. This changes link arguments, attachment bookkeeping, retries and routing; a still image does not demonstrate recovery.

Defaults chosen

• Lanes auto: the transport binds lanes to one link when parallel links are unavailable.
• List retry: 10 timed tries, starting at 1 s and capped at 30 s. After exhaustion, activation, wake or a mutation can trigger another read.
• Automatic browser-route refetch requires the app link and connected daemon; it does not rely on the cached machine status to authorize a resume.

Tests

The focused regression command is scripts/ci/package-test-lane.sh suite Packages/macOS/CmuxNext CloudBrowserRefetchGateTests, run through cmux-ci run --class light with Xcode 26.6. Test-only commit 51bccc95bf368559b264dff9b985587bee9bff63 failed for a stale running record with a disconnected daemon (fleet step 662a03f5779f567f9b32b362: four parameter cases, one behavioral failure). Repair c1803e2cb76d93c87a68fd226f02c44456203f37 requires the connection; the same regression and ten related Cloud/terminal suites passed at b69a7dddee72f01c0d7452c2ce31a44dc79b4788 (step fb7653d89227a00b41cd66b6). Both connected-daemon cases remain allowed even when the cached record says paused.

Observed / Not run

• Current head: adaeb284f15c9e39805ec168fa3dea53cd415e1b, including merged base 9b6c218145c02320c5edb61a8b92cbb0911a2d66. The PR's own 21-file diff is unchanged, and git show --remerge-diff is empty.
• Passed on this head: the static prepush gate, fleet Debug app compile 96b3afb97acc7f9efe2faf52 (58 s), Release recipe-v2 app compile ffbac7dfb75b5e01be698f3f (120 s; unrelated Rust check omitted), and fresh independent correctness-first review.
• The release-notary guard failure is inherited. The repository base-red classifier confirms the same two signing-runner fallback failures on feat-cmux-next run 41168976072 at 0b855de498. The workflow and those tests are outside this PR's diff.
• Passed on this head: all 13 focused test filters in fleet step 2b1a5e4f9f3b046cf51278bf (exit 0, completed 2026-10-31 05:47 UTC). Each filter actually executed Swift Testing cases, covering terminal reattachment, Cloud link lanes/reconnection, machine-list retry, browser route/refetch/restore, idle pause, session start and browser-open security.
• Earlier terminal regression: test-only e5019c1a7991d failed TerminalReattachEchoTests.theReplaysGridCountsSoAClaimOfThatSizeWaitsForNoEcho with echoesDue == [120x40] and announcedSize == nil; affected suites passed at 8a1e4ee0b7392588656dfbfa13c0c1b8ce99b41d (step 102c386d9a1caef97d42dc43).
• Not run: live Cloud VM dogfood for resize, idle pause, link loss or relaunch with a VM-port tab open. AppServices.configureBrowser and the StrandedPageReload observation loop have not been exercised end to end. No current-head tagged dogfood build has been produced; this pass used fleet compile and focused test jobs.

Changelog

• Fixed: Cloud terminals stay responsive while browser tabs load machine ports, resize promptly after reconnecting, and Cloud workspaces and machine-port tabs recover after a relaunch or a dropped link.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 4bbf795: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr25668 -f ref=25595-cloud-terminals-browsers -f platform=macos -f backend_mode=local

Passes: CI passes on 4bbf795bf0.

CI passes on 4bbf795bf0 (run 41773757624 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

Default changes

No defaults change at 4bbf795bf09a.

[teamleaderleo]

Bead cx-o4qiv created for this PR by the cmux coordinator.

[austinywang]

Correctness review (independent subagent) of 41e6c74 and the commits before it; findings fixed in 6b626c7

1. HIGH (security, existing bug): AppServices.configureBrowser turned a nil "stay blank" answer into the unproxied base config (?? base). A blocked proxied tab, or a remote-localhost proxy that failed to start, could load this Mac's localhost. Fixed: nil now reaches chromiumConfiguration, which blanks the page with .noLoopback.
2. HIGH: a route refetch could start a paused machine (cloud.browser.open connects the link, which runs ensure_running), and nothing spaced out repeated refetches. Fixed: a refetch only asks a machine that is listed, linked and running. Refetches are spaced by a capped backoff until a request goes through, and the spacing resets when the machine reconnects. The answer must name the same machine.
3. MEDIUM: a restored tab got no store when it loaded before the machine list. Fixed: the lazy store is always made, and its route is fetched on the first request once the machine runs. Until then the page shows "not connected" and reloads on reconnect.
4. LOW, all fixed:
   • Stranded reload missed app-link Cloud store keys; it now covers them.
   • StrandedPageReload held the service strongly (retain cycle); it now holds it weakly.
   • The list-retry budget carried across accounts; it now resets when the account's machines are dropped.

Checked and found fine: the terminal echo fix, --lanes auto with invite enrollment and the WireGuard hub, CloudBrowserRoute actor reentrancy, route version 0 never replacing a live route, the 407 mapping, and file-size rules.

[austinywang]

Review (correctness subagent) of ce29114..41e6c74, with resolutions (fixed in 6b626c7):

1. HIGH: AppServices.configureBrowser turned a nil "stay blank" answer into the unproxied base config, so a blocked proxied tab, or a remote-localhost proxy that failed to start, could load this Mac's localhost. Fixed: nil now reaches TabContentCache, which blanks the page.
2. HIGH: a route refetch (cloud.browser.open) could start a paused machine, and refetches had no spacing. Fixed:
   • The refetch only asks a machine that is listed, linked and running.
   • Refetches are spaced by a capped backoff that resets when a request goes through or the machine reconnects.
   • The answer must name the same machine.
3. MEDIUM: a restored tab's store needed the machine session, which doesn't exist before the first machine list. Fixed: the store is created lazily, and the liveness check happens at fetch time.
4. LOW items, all fixed:
   • Stranded reload now also covers Cloud proxy store keys.
   • StrandedPageReload holds the service weakly, removing the retain cycle.
   • The list-retry budget resets when an account's machines are dropped.

Fleet run at 985413c (step 73f8dd0d075daca0415b2ee2, aws-m4pro-2, Xcode 26.6), all passed: TerminalReattachEchoTests, CloudLinkLanesTests, CloudListRetryTests, RemoteLocalhostStrandedTests, CloudBrowserRouteTests, ProxiedBrowserTabsRestoreTests.

Tagged build 25595-cloud-terminals-browsers-come-back (job de91e0b82b7bc8ace57ce56c) is published. A re-review of the fix range is in progress.

[austinywang]

Re-review (independent subagent) of 41e6c74..985413c: the four earlier findings are verified fixed.

New HIGH finding: when a click resumed a paused app-link machine, the daemon connected but the machine record still read paused. The refetch gate refused, so the stranded page's reload showed "not connected" again. Fixed in 56d5d6b: a connected daemon now counts as running (BrowserTabOpen.mayRefetch), covered by CloudBrowserRefetchGateTests.

LOW, accepted: a route lost while the daemon stays connected recovers on the page's next request after the backoff spacing, or on a manual reload.

My own check: read the diff at 56d5d6b. No file over 400 lines grew. Fleet suites are green at this head (step a3462e24e37be34a597f5183), and the red was observed on e5019c1.

cmux-next fast tier and Release compile were refused by the runner hook (a fleet build was waiting for the host; 26 GiB free of 30 GiB required) before any code ran. Those jobs were rerun at the same SHA.

Review (claude-subagent): SHIP at 56d5d6b

[austinywang]

Re-review (independent subagent, correctness first) of 41e6c74..56d5d6b at head 56d5d6b: SHIP.

It checked that each finding from the first review is fixed: no ?? base fallback for blocked tabs, the refetch gate and answer machine check, the actor-safe backoff, the lazy restored store, app-link keys in the stranded reload, weak captures, and listRetry.reset() on every account-change path. It found no new correctness issue.

Two low items, not blocking:

• L1 Tests: several review fixes have only unit-level tests, not an end-to-end regression. Missing: the AppServices nil-config blank path, a restore before the machine is listed, takeStranded(machineKey:) calling machineConnected(), and dropAllMachines() resetting the retry. Left for follow-up.
• L2 Paused machine: if a record still reads running after an idle pause, one cloud.browser.open per 1 to 30 s could resume the machine. This depends on how fresh the record is, which was not verified. The new connected-daemon gate in 56d5d6b only widens the gate for a machine that is already running, so it does not make this worse.

Evidence at this head: suites green (step a5af5726a855981c7a6ee9b6), app compile check passed (f57d4eef4ddcafa5e8279eff), tagged build published (ec9b81ab492c1e2ff45853a9). Red: TerminalReattachEchoTests fails at e5019c1 (step 3c41a35ead0a058cc917fd65).

[austinywang]

CI classification at 56d5d6b (run 40421329534, attempt 1). None of the reds come from this diff; attempt 2 is queued for the same SHA.

• cmux-next fast tier, cmux-next Release compile (Xcode 26): the runner hook refused both (a fleet build was waiting for the host; 26.0 GiB free, 30 GiB required). This is infrastructure. A compile-only Release build of this head passed separately (run 40426906036).
• cmux-next swift test (blacksmith-6vcpu-macos-26):
  • All seven suites this PR adds passed: CloudBrowserRouteTests, ProxiedBrowserTabsRestoreTests, CloudBrowserRefetchGateTests, CloudLinkLanesTests, CloudListRetryTests, RemoteLocalhostStrandedTests and TerminalReattachEchoTests.
  • The reds are in CmuxNextControlTests: BrowserTabMirrorTests (7), ActionRunCreatedTests and ActionBatchTests. They are all did not finish within 1999 ms deadline timeouts. That target depends on none of the modules this PR changes (Control, Actions, Daemon, DaemonService, Pages, Settings and Wakeups are unchanged).
  • The App reds are SidebarRowGutterTests and AgentCursorTagLinkTests hover, plus the test helper's exit() partway through the run. These are UI tests in files this PR doesn't touch, and they failed while unrelated tests were taking about 15 s each on the loaded runner.

[austinywang]

Review (independent correctness subagent): SHIP at 56d5d6b

Findings and resolutions: #25668 (comment). CI classification for this head: #25668 (comment).

[austinywang]

Base finding, not this PR's red: cmux-next swift test attempt 2 on 56d5d6b again shows the App test helper's mid-run exit and the ActionRunCreatedTests and ActionBatchTests deadline reds. Unrelated branch nx-mainhang-guards shows the same set, plus SidebarRowGutterTests and BrowserTabMirrorTests, and the same mid-run exit: https://github.com/manaflow-ai/cmux/actions/runs/40450092315/job/122010824392. All suites this PR adds passed. cmux-next fast tier is still refused by the runner hook for disk on cmux7s-mac-mini-glaeda-2 (25.1 GiB free, 30 GiB required).

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[austinywang]

Check classification for reviewed head 36caa149f9cbf77b012c90410b0fc9016f61ad8e:

• Fleet app compile passed: c0d8ca66098fefa880caca2a (57 s). This head includes the upstream Glass.swift compile repair.
• tooling-tests on this head fails the same two checks as merged base 8b3fa55ef585c369955e0dc19694046969272262: test_check_objc_selectors_step.py has no executing linux-guard workflow, and test_the_ten_first_party_gpl_crates_are_named_exactly omits cmux-chats-mirror from its expectation.
• release-notary on this head fails the same SigningHooksInStepWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check as the exact merged base: Glaeda hook f612f5a8… is missing from the signing hook list. Guard status wraps these roots.

These guard paths are outside the PR diff. The fresh exact-head SHIP review is posted, and ready-to-land was added afterward. The 13 focused fleet suites remain queued (154b5bdbef826f70e8cfbab0); live VM recovery is not verified.

[austinywang]

Review (independent correctness subagent, carried over a clean base merge): SHIP at 36caa14

36caa14 only merges feat-cmux-next 8b3fa55 into the head that got SHIP above, d203887. git diff 397ab560253 d203887ebf2 and git diff 8b3fa55ef585 36caa149f9c are identical apart from index and hunk-header lines. The one file both sides touch is CloudService.swift, where the base adds the session's onPaneNotReady/paneNotReadyText wiring in a hunk this PR does not change. The fleet app compile red at d203887 was the base build skew in CmuxNextDesign/Glass.swift (keepsActiveLook), fixed on the base by a582ddf and now merged in.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[austinywang]

Review (pr25668_review): SHIP at 3652640

Independent correctness-first review of the full 21-file diff against merged base ef6f55f0e3f8ac76e286e482eb3902f1eff69eaf and relevant integration changes found no correctness blockers. The merge contains no conflict-resolution delta.

This is a fresh source review of the exact pushed head. The main agent ran its static prepush gate successfully and exact-head fleet app compile 709b2a25de53090e8a8547c4 passed (48 s). Focused fleet suites remain queued (2910ee70cba7b9fbb3f3698d). Live Cloud VM and GUI recovery behavior has not been verified.

[austinywang]

Current head 365264046f0c5279363dd59aa4c71de9fb380b38: the cmux-next checks failure is inherited from the base. The failing step reports a pointer cursor at webviews/src/agent-session/acpmux/conversation/LaneNoticeBatch.css:17, outside this PR's 21-file diff. scripts/ci/base_red_excuse.py confirms base run 41164280851 at db183fa3bf fails the same check.

Fresh exact-head independent review is posted. The defaults guard now passes. Exact-head fleet app compile passed (step 709b2a25de53090e8a8547c4, 48 s); all 13 focused test filters passed in step 2910ee70cba7b9fbb3f3698d (exit 0), with actual Swift Testing execution confirmed in the log.

The release-notary guard also fails on the base: the repository classifier confirms run 41165259243 at db78ca7e73 has the same two RunsOnFallbackTests failures (test_a_picked_signing_label_has_a_rerun_alternative and test_no_runs_on_chain_ends_on_the_reserved_side_label). The workflow and tests are outside this PR diff.

Release recipe-v2 app compile also passed on this exact head (step f14f6c1facd76e2e8645d7a4, app 148 s, unrelated Rust check omitted). The red CI app-compile job timed out on its controller request (exit 69); it did not report a compiler error. An individual rerun was refused while the workflow remains active. The Release receipt status handoff is still pending.

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)/ test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[austinywang]

Review (pr25668_review): SHIP at adaeb28

Independent correctness-first review of the full 21-file diff against merged base 9b6c218145c02320c5edb61a8b92cbb0911a2d66 and relevant base integrations found no correctness blockers. git show --remerge-diff is empty.

The reviewer performed source inspection only. The main agent verified exact-head fleet Debug app compile 96b3afb97acc7f9efe2faf52 (58 s) and Release recipe-v2 compile ffbac7dfb75b5e01be698f3f (120 s; unrelated Rust check omitted). Focused test job 2b1a5e4f9f3b046cf51278bf is still queued. Previous-head tests passed all 13 filters, but that is historical evidence. Live VM/GUI recovery was not exercised.

[austinywang]

Check classification for current head adaeb284f15c9e39805ec168fa3dea53cd415e1b:

• Release-notary failure: inherited. The repository base-red classifier confirms base run 41168976072 at 0b855de498 fails the same two RunsOnFallbackTests. Their workflow and tests are outside this PR's unchanged 21-file diff. Guard status is its wrapper.
• Fresh independent SHIP receipt is posted for this exact head. Defaults guard passed.
• Exact-head fleet Debug compile passed (step 96b3afb97acc7f9efe2faf52, app 58 s); Release recipe-v2 compile passed (step ffbac7dfb75b5e01be698f3f, app 120 s, unrelated Rust check omitted). All 13 focused filters actually executed and passed on this head in step 2b1a5e4f9f3b046cf51278bf, exit 0. Live VM/GUI recovery remains unverified.
• CI's public Release receipt timed out despite those passing compiles. Attempt 2 of the same workflow is running; no additional build was submitted. Controller diagnostics show the webhook spool full, about 21,000 pending events and repeated HTTP 503 responses. The canonical receipt is absent; this is distinct from a compiler failure. The current receipt status is pending.

ready-to-land was re-added after the fresh exact-head review and the completed focused verification. No source push, rebase or force-push was needed in this pass.

[austinywang]

Check classification at head adaeb284f15c9e39805ec168fa3dea53cd415e1b. This head is a plain merge of feat-cmux-next 9b6c218145c0 (85 commits, no conflicts). The PR's 21 files are byte-identical to the previous head 365264046f0c.

• nightly-guards / workflow-guard-tests / release-notary (and its Guard status wrapper) is a base red. The PR job fails RunsOnFallbackTests.test_a_picked_signing_label_has_a_rerun_alternative and test_no_runs_on_chain_ends_on_the_reserved_side_label. The feat-cmux-next run at 5587de5f83 fails the same two tests, and so do the base runs at 230f2d6e5d and d685211fc7. This PR touches no workflow or test file.
• cmux-next fleet Release compile / cmux-next/compile is infrastructure. The gate reported "no result from the controller" after 40 minutes; nothing compiled. I ran an exact-head Release compile on the fleet and it passed: job 309b351cb71f16cdfd1c9d3a (120 s). I reran the failed jobs on the same SHA (attempt 2).
• cmux-next swift test and fast tier were cancelled while still queued, so there's no test verdict from CI yet. They are included in the attempt 2 rerun.
• cmux-next checks is green on this head; the base fixed the earlier LaneNoticeBatch.css cursor red. The namespace-lint red on AppsWireDecoding.swift comes from base commit 52842e02e2, and cmux NEXT apps: AppsWireDecoding is an instantiated value (base red) #28869 fixes it.

[austinywang]

Removed ready-to-land again. The person who owns this PR asked for it to be made ready for review but not merged, because they'll review it themselves first. Please don't re-add the label or merge it; they'll land it after their review. (To the codex lane watching this PR: this is the bounded status you asked for. I'm only following CI attempt 2 of run 41170749635 on adaeb284f15c, with no new submissions and no source pushes.)

[austinywang]

Ready for review at adaeb284f15c9e39805ec168fa3dea53cd415e1b (MERGEABLE). Not merged, and ready-to-land is left off, because the owner will review it themselves first.

Done

• Merged feat-cmux-next 9b6c218145c0 with a plain push, no force. There were no conflicts, and the PR's 21 files are unchanged from the reviewed 365264046f0c.
• Fleet, exact head:
  • App compile, Debug: passed (job 96b3afb97acc7f9efe2faf52).
  • App compile, Release: passed (job 309b351cb71f16cdfd1c9d3a).
  • The 13 focused suites: passed, 125 tests (step 2b1a5e4f9f3b046cf51278bf).
• Independent correctness review: SHIP, no blockers. Three low-severity follow-ups:
  1. A refetch can wake a VM in the gap between idle-pause and cloud.link.changed. A complete fix needs a server-side "do not resume" flag.
  2. StrandedPageReload.epochs is keyed by ObjectIdentifier and never pruned, so a recycled daemon address can skip one reload.
  3. Nothing tests isRunning's app-link and machine-match gate end to end.

Remaining reds: none come from this PR

• release-notary / Guard status: base red. The same two RunsOnFallbackTests fail on feat-cmux-next 5587de5f83, 230f2d6e5d and d685211fc7 (classification).
• cmux-next fleet Release compile / cmux-next/compile: infrastructure. In both attempts the gate got "no result from the controller", and nothing compiled. The exact-head fleet Release compile above passed.
• cmux-next swift test (attempt 2): 31 failing suites under the loaded full run. 24 of them also fail on unrelated PRs today, for example lane/fix-onboarding-b-4752-missing and fix/stall-chats-mirror-delete. I reran the other 7 in isolation on the fleet, at both base and head:
  • AcpmuxRestartStuckTests, AcpmuxSlowDaemonTests, ActionCatalogTests, ActionSurfaceParityTests, BrowserCloseHistoryTests, FileExplorerEditTests, ReduceMotionLoopTests.
  • All pass on head (step d778a690f09f1f0cdbc555c7) and on base (step 9863a7ec8492900bb8756fd4).
  • The Action export checks fail only because the generated exports are stale against 4 new base actions; the base autofix regenerates those. This PR touches no action code.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

For awareness: this PR has a SHIP review at its head, but GitHub reports it as conflicting with feat-cmux-next, so the lander's update-branch can't merge it and it can't land as is. Files that conflict in a test merge against the current base: Packages/macOS/CmuxNext/Sources/CmuxNextBridge/TerminalAttachMachine.swift. Once feat-cmux-next is merged into the branch and the conflicts resolved, it needs only a quick review of the resolution before it can land. (From the conflict sweep; no push was made to this PR.)