[austinywang]

Fixes #26062

What

A Cloud toggle for cmux NEXT, function first (UI polish later):

• Settings > Machines > Cloud Workspaces > Run New Workspaces in Cloud (cloud.newWorkspacesInCloud, off by default). It is a plain toggle setting, so it is also in the palette's Toggle Setting and in cmux.json.
• New Cloud Workspaces Start In (cloud.newWorkspaceFolder): inherit (default) or empty.
• When the toggle is on, a person's New Workspace (Cmd-N, the sidebar's +) does not open on this Mac. It runs the existing New Cloud Workspace flow with a new Freestyle machine for every workspace. The window shows the progress steps at once, and a failure stays with Retry.
  • inherit: the git working copy around the focused terminal's or chat's folder is copied with cmux link sync push (the same transport Move to Cloud uses), under the machine's ~/work. If the image refuses that folder it falls back to /root/work. The workspace's terminal opens in the person's folder on the machine, and the workspace takes the project's name.
  • empty, or no folder, or a home folder (never copied): the workspace opens in the machine's own home, from the image's working snapshot.
• Agent chats started in that workspace run on its machine (existing cmux NEXT behavior for Cloud workspaces).
• Scripts, the CLI and MCP (cmux workspace new), and any invocation that names --machine, keep their current behavior. Only a person's gesture follows the toggle.

Research: how ChatGPT Work / Codex cloud run tasks

OpenAI documents Work's policy, not its mechanics. Its security page says Work "can reuse an environment across tasks or replace it while preserving eligible state" (Work cloud security). The concrete mechanics below come from Codex Cloud, the closest documented product:

Topic	ChatGPT Work / Codex Cloud	This PR
Start	Each task gets its own isolated VM, booted from a published environment snapshot. Setup scripts run once; dependency caches are kept (cloud environments).	One new Freestyle machine per new workspace, from the cmux image.
Choice	A per-task Local / Cloud selector at creation ("Work in → This computer / Cloud"; Work's composer toggle). A task cannot switch mid-turn (modes, cloud-local access).	One remembered toggle for new workspaces. The agent composer's existing environment picker remains the per-chat choice.
Files in	A git clone of the selected GitHub repo. Local files and uncommitted changes are not sent (modes).	Goes further: the local working copy, including uncommitted files, is synced (inherit), or nothing is synced (empty).
Files out	Diff review, then a PR or codex apply (git apply; fails cleanly on conflict) (CLI).	Existing Bring Back Local (cmux link sync pull, which reports conflicts) and the Cloud diff viewer (open PR #25696).
Resume	A task's VM state, including uncommitted work and installed tools, can be resumed for 7 days.	Existing idle auto-pause, with resume on attach (Freestyle pause keeps memory).
Network / secrets	Per-environment internet policy through a proxy. Secrets reach the agent only as proxy placeholders.	Not in this PR. The Freestyle firewall and secrets rows are tracked in plans/cmux-next/freestyle-parity.md.
Feels local	One thread on every device; keeps running while the laptop sleeps.	Same workspace and terminal UI as a local one, opened in the person's folder. The machine keeps running when the Mac sleeps.

Gaps left for follow-ups:

• Prebuilt per-project environment snapshots with setup scripts, so a second workspace on the same repo does not sync and install again.
• A per-workspace Local / Cloud choice on the New Tab page and in the composer.
• A network policy per environment.
• Proxy-held secrets.

Where the code lives

• CmuxNextSettings/CloudNewWorkspaceSetting.swift: the two keys, their Settings rows (Machines page, "Cloud Workspaces"), privacy-refused for agents.
• CmuxNextCloud/Move/CloudNewWorkspacePlan.swift: the decision (person only; no --machine/command; never a home folder) and the folder copy over cmux link sync push, with the ~/work → /root/work fallback.
• CmuxNextApp/Handlers/CloudHandlers+Account.swift startNewWorkspaceInCloud: runs the New Cloud Workspace flow with a new machine whose open copies the folder and creates the workspace with its terminal there. CloudMachineCreation keeps that open so Retry repeats the copy.
• No App growth (CmuxNext rule): CloudVmHostStore (Foundation + CmuxNextCloud only) moves to CmuxNextCloud unchanged apart from public, App −74 source lines.
• Cmd-N stays local while Cloud is signed out or unavailable. An app that can't copy (no bundled CLI, or the opt-in app-server link) starts the machine empty instead of failing after it exists.

Tests

• CmuxNextAppTests/CloudNewWorkspaceTests: the decision against real cmux.json values and a real git folder on disk (off by default; on copies the whole working copy and opens the nested folder; empty; a home folder is never copied; scripts, --machine and a command are not rerouted; an app that can't copy starts empty), and the copy's work-root fallback, stop on a real refusal and the outdated-machine case, with a stand-in for cmux link sync push.
• CmuxNextSettingsTests/CloudNewWorkspaceSettingTests: parsing, defaults, the toggle on the Settings page and in the palette, agents refused.
• Existing suites rerun for the touched code: CloudVmHostTests, SettingsPageSectionsTests, SettingsSchemaExportTests.

Observed / Not run

• Display run at the current head e00f45e (added by the ready-queue unblocker): compile-check 300826d8c0eb1fe660435d17 (CmuxNext with test targets, app, cmux-tui: passed), then fleet step a7db046948c6f3ca2395a28b on a gui-session-v1 worker (cmux8s-Mac-mini) in cmux's console session, CMUX_TEST_REQUIRE_GUI=1 (a skip fails the step): CloudNewWorkspaceTests, CloudNewWorkspaceEntryTests, CloudNewWorkspaceLateStartTests, CloudNewWorkspaceSettingTests, CreationInputHoldTests and CmdNThenNewTerminalTabTests: all 6 suites passed, 30 tests, exit 0.
• Current published head: a4e2b9b40ae45cd350bed6ee6faef01856cf6eed, normally merged with latest fetched base f06d9bd0736cc1af17a455eed1da63153ee7dead. GitHub reports MERGEABLE and zero unresolved review threads. The remote head was checked immediately before the plain push. Manual and hook prepush gates, the scoped web-lint wrapper, and syntax verification of all 18 changed Swift files passed. No builds or tests ran on the local Mac.
• Exact-head fleet job 4de25f3cff892ca14fe0b6e4 compiled package/test targets and passed all 20 selected filters, with 153 reported Swift Testing tests and no failures (some filters overlap). This includes the Cloud/settings/late-reply coverage below plus CmdNThenNewTerminalTabTests and CreationInputHoldTests for the incoming base integration. The job exited 0 and confirmed workspace cleanup.
• Caller-attribution red/green: CloudNewWorkspaceEntryTests at b62559281f5c250704627076f06bbbb789b47e58 (fleet 9f074c4e5cd57b551d01cafa) compiled and executed seven tests, failing only the four intended line-95 assertions for socket, app, agent and terminal callers claiming origin=user; exit 1, cleanup confirmed. The same filter passed all seven tests and all four parameter cases on the current head. The repair uses the shared ActionInvocation.isPersonsOwnRun predicate so these callers keep their requested route.
• The late-reply repair uses the shared WorkspaceCreation.create / firstTerminal paths. CloudNewWorkspaceLateStartTests exercises the actual stored toggle opener over the JSON-lines transport, requiring one workspace, one terminal, stable IDs across retry, and no cleanup close. Canonical red-before at 969a0c69f0a54a157624e171b23313c3627fef79 (fleet 9965fe37e9fe81696e414ac8, exit 1, cleanup confirmed) executed one test and failed four intended assertions. It passed in the preceding 18-filter run and is selected again on the current head.
• Canonical settings regeneration: fleet job 4713e214e53f8a26b315dbf9 at e0e3fac4670f41cadd10f05c89fef4e7226ec238 compiled package/test targets and passed all 4 managed-preference and 6 schema-export tests, then returned artifact SHA-256 9bb05acf2b62ec0dc2fa4bcf76dda10f00c78ea629c5bb82def61709aa0f8bc7. The unedited complete web reference was applied; the bot-owned defaults snapshot was excluded. The generation inputs are semantically unchanged at the current head. Independent byte and semantic audits confirm all 606 schema rows, 536 web-reference rows and 599 MDM properties from the current base are preserved, with only the two Cloud settings added. The four native exports also match the prior CI-generated artifact 13065934303.
• Fresh independent correctness-first SHIP review covers the complete current-head diff, incoming base integrations, defaults, canonical exports, localization and executed red/green evidence. The review found and this head fixes the attributed-user-origin route. The two earlier human findings are also fixed: no window creates no Cloud machine, and local fallback displays its reason.
• The current Windows check is a base finding: unchanged cmux-tui sources fail on libc::kill / libc::SIGKILL in meta_save.rs:273. An unrelated branch reproduces both errors. Matching logs and base attribution. The defaults guard passed on attempt 3, accepting the exact-head SHIP receipt after its installation API permission lookup recovered from the rate limit.
• Localization audit: all 1,492 Settings and 89 Cloud base entries preserved; seven Settings keys and two Cloud keys added across 21 locales. English/Japanese are translated; other locales retain needs_review. No full strict localization audit is claimed.

Focused commands, with exact failing and passing commit references where available above:

cmux-ci run --class light --script scripts/ci/package-test-lane.sh \
  --arg=suite --arg=Packages/macOS/CmuxNext --arg=CloudNewWorkspaceLateStartTests \
  --ref <exact-sha> --key pr26078-<before-or-after>-<sha8> \
  --env CMUX_CI_XCODE_APP=/Applications/Xcode_26.6.app

cmux-ci run --class light --script scripts/ci/package-test-lane.sh \
  --arg=suite --arg=Packages/macOS/CmuxNext --arg=CloudNewWorkspaceEntryTests \
  --ref <exact-sha> --key pr26078-origin-<before-or-after>-<sha8> \
  --env CMUX_CI_XCODE_APP=/Applications/Xcode_26.6.app

The 18-filter selection is CloudNewWorkspaceLateStartTests, CreateTerminalLateStartTests, WorkspaceWithTerminalLateCreateTests, CloudNewWorkspaceTests, CloudNewWorkspaceEntryTests, CloudNewWorkspaceSettingTests, CloudWorkspaceSetupLifecycleTests, CloudSignedOutCreationContinuationTests, CloudVmHostTests, SettingsPageSectionsTests, CloudSignInRecoveryTests, CloudMachineChangeStateTests, CloudMachineChangesPollingTests, CloudStartChatMachineTests, AgentPaneCloudStartTests, AgentPaneNewChatsInSettingTests, ManagedPreferencesManifestTests and SettingsSchemaExportTests.

Not run: live signed-in Cloud creation/folder sync, a new tagged app, a current native capture, optimized Xcode Release compilation, or input-to-frame measurements. Package compilation does not establish optimized Xcode Release coverage. The historical capture below shows the toggle-off workspace view, not the new Settings rows or signed-in creation. No skipped test is claimed as coverage.

Performance

No perf numbers: verification covered opt-in Cloud workspace routing, generated settings, and late-reply correctness. Input-to-frame and live provisioning latency were not measured, so this PR makes no measured latency claim.

Changelog

Added: Run New Workspaces in Cloud (Settings > Machines) gives each new workspace its own Cloud machine, starting in a copy of your current folder or in an empty folder.

Capture

Existing real-app after image from 296d7f0115cc95695c5406e59cd3da3d4adbffff (core tour run); subsequent repair merged the base and refreshed generated exports. This image shows the default-off workspace view, not a signed-in Cloud create or the new Settings rows.

Viewed after image: yes
Visual verdict: The captured default-off layout is clear enough to sit beside ChatGPT or Claude, with readable navigation and no clipped controls.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review a4e2b9b: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26078 -f ref=feat-cmux-next-26062-cloud-toggle -f platform=macos -f backend_mode=local

Seen on other PRs too (likely flaky): next-docs.test.ts also failed on other PRs before this one; check whether it is this PR's before re-running.

CI failed on e00f45e1e0 (run 41276903965 attempt 1): 1 code.

Job	Verdict	Why
web / Web tests (1/4)	code	a web test failed

Failures:

• seen on other PRs next-docs.test.ts cmux-next docs > the settings reference is fresh against the settings schema: failed (job)

A web test can import code this PR changes without being one of its files: python3 scripts/ci/web_test_verdict.py --pr 26078 --file web/tests/next-docs.test.ts checks its import graph (on Linux, in a sandbox) and its failures on other branches.

Matched log lines

web / Web tests (1/4): (fail) cmux-next docs > the settings reference is fresh against the settings schema [2.70ms]

Not re-run automatically: web / Web tests (1/4) is not a machine failure.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

red: web / Web status; a job it gathers is red on this change (its line here); do not merge until green; see lane-rules
red: web / Web tests (1/4); no finished base run on 88dcb89 to compare; do not merge until green; see lane-rules

Tour of 296d7f0115 (run)

Path-selected interactions

Interaction

Changed paths

core

Packages/macOS/CmuxNext/Sources/CmuxNextApp/AppActions\+Workspaces.swift Packages/macOS/CmuxNext/Sources/CmuxNextApp/AppServices.swift Packages/macOS/CmuxNext/Sources/CmuxNextApp/Cloud/CloudMachineCreation.swift Packages/macOS/CmuxNext/Sources/CmuxNextApp/Handlers/CloudHandlers\+Account.swift Packages/macOS/CmuxNext/Sources/CmuxNextApp/SidebarBridge\+Intents.swift Packages/macOS/CmuxNext/Sources/CmuxNextCloud/API/CloudVmHostStore.swift Packages/macOS/CmuxNext/Sources/CmuxNextCloud/Move/CloudNewWorkspacePlan.swift Packages/macOS/CmuxNext/Sources/CmuxNextDaemonService/CloudStrings.swift Packages/macOS/CmuxNext/Sources/CmuxNextDaemonService/Resources/Cloud.xcstrings Packages/macOS/CmuxNext/Sources/CmuxNextSettings/CloudNewWorkspaceSetting.swift Packages/macOS/CmuxNext/Sources/CmuxNextSettings/Localizable.xcstrings Packages/macOS/CmuxNext/Sources/CmuxNextSettings/Schema/SettingsPageLayout.swift Packages/macOS/CmuxNext/Sources/CmuxNextSettings/Schema/SettingsSchema\+AgentPolicy.swift Packages/macOS/CmuxNext/Sources/CmuxNextSettings/Schema/SettingsSchema.swift Packages/macOS/CmuxNext/Tests/CmuxNextAppTests/CloudNewWorkspaceEntryTests.swift Packages/macOS/CmuxNext/Tests/CmuxNextAppTests/CloudNewWorkspaceTests.swift Packages/macOS/CmuxNext/Tests/CmuxNextAppTests/CloudWorkspaceSetupLifecycleTests.swift Packages/macOS/CmuxNext/Tests/CmuxNextSettingsTests/CloudNewWorkspaceSettingTests.swift Packages/macOS/CmuxNext/Tests/CmuxNextSettingsTests/PhoneAccessSettingTests.swift

Core UI (before): DEGRADED — 20 ok, 1 unavailable

Video (mp4)

#	Step	Result	Command
1	Launch	ok
2	New workspace	ok	cmux workspace new --name Tour
3	Show the Tour workspace (a new workspace takes no focus)	ok	cmux workspace name:Tour focus
4	Type in the terminal	ok	cmux workspace name:Tour screen current pane current tab current terminal current write --text "echo hello from the cmux-next tour\r"
5	A command reports progress: tab loading spinner	ok	cmux workspace name:Tour screen current pane current tab current terminal current write --text "clear; printf '\\033]9;4;3\\007'; sleep 900\r"
6	Split right	ok	cmux action run splitRight
7	Split down	ok	cmux action run splitDown
8	New terminal tab	ok	cmux action run newSurface
9	Browser tab	ok	cmux tab new-browser --url https://example.com
10	Hide the sidebar	ok	cmux action run toggleSidebar
11	Show the sidebar	ok	cmux action run toggleSidebar
12	Notification	ok	cmux notify --title Tour --body "Hello from CI"
13	Notifications panel	ok	cmux action run showNotifications
14	Agent chat	ok	cmux agent new-chat
15	Agent workspace	ok	cmux workspace new --name Agent
16	Agent starts	ok	cmux workspace name:Agent screen current pane current tab current terminal current write --text "clear; printf '\\033]7501;state=working\\033\\\\'; sleep 8; printf '\\033]7501;state=done\\033\\\\'; sleep 900\r"
17	An agent works: row working spinner	ok	cmux workspace new --name Notes
18	The agent finishes: done mark in the spinner's place	ok
19	Session tree: keycaps on the first rows	ok	cmux settings set sidebar.sessionTree true
20	Session tree back off for later tours	ok	cmux settings set sidebar.sessionTree false
21	Profile menu	unavailable: exited 1 (the menu shot needs a screen capture route)	cmux action run sidebar.profileMenu

Screenshots (15)

1. Launch


2. New workspace


4. Type in the terminal


5. A command reports progress: tab loading spinner


6. Split right


7. Split down


8. New terminal tab


9. Browser tab


10. Hide the sidebar


12. Notification


13. Notifications panel


14. Agent chat


17. An agent works: row working spinner


18. The agent finishes: done mark in the spinner's place


19. Session tree: keycaps on the first rows

### Core UI \(after\): DEGRADED — 20 ok, 1 unavailable

Video (mp4)

#	Step	Result	Command
1	Launch	ok
2	New workspace	ok	cmux workspace new --name Tour
3	Show the Tour workspace (a new workspace takes no focus)	ok	cmux workspace name:Tour focus
4	Type in the terminal	ok	cmux workspace name:Tour screen current pane current tab current terminal current write --text "echo hello from the cmux-next tour\r"
5	A command reports progress: tab loading spinner	ok	cmux workspace name:Tour screen current pane current tab current terminal current write --text "clear; printf '\\033]9;4;3\\007'; sleep 900\r"
6	Split right	ok	cmux action run splitRight
7	Split down	ok	cmux action run splitDown
8	New terminal tab	ok	cmux action run newSurface
9	Browser tab	ok	cmux tab new-browser --url https://example.com
10	Hide the sidebar	ok	cmux action run toggleSidebar
11	Show the sidebar	ok	cmux action run toggleSidebar
12	Notification	ok	cmux notify --title Tour --body "Hello from CI"
13	Notifications panel	ok	cmux action run showNotifications
14	Agent chat	ok	cmux agent new-chat
15	Agent workspace	ok	cmux workspace new --name Agent
16	Agent starts	ok	cmux workspace name:Agent screen current pane current tab current terminal current write --text "clear; printf '\\033]7501;state=working\\033\\\\'; sleep 8; printf '\\033]7501;state=done\\033\\\\'; sleep 900\r"
17	An agent works: row working spinner	ok	cmux workspace new --name Notes
18	The agent finishes: done mark in the spinner's place	ok
19	Session tree: keycaps on the first rows	ok	cmux settings set sidebar.sessionTree true
20	Session tree back off for later tours	ok	cmux settings set sidebar.sessionTree false
21	Profile menu	unavailable: exited 1 (the menu shot needs a screen capture route)	cmux action run sidebar.profileMenu

Screenshots (15)

1. Launch


2. New workspace


4. Type in the terminal


5. A command reports progress: tab loading spinner


6. Split right


7. Split down


8. New terminal tab


9. Browser tab


10. Hide the sidebar


12. Notification


13. Notifications panel


14. Agent chat


17. An agent works: row working spinner


18. The agent finishes: done mark in the spinner's place


19. Session tree: keycaps on the first rows

_{Tours are data in scripts/cmux-next/media/tours: add a step or a tour file to show your feature.}

Default changes

This pull request changes 27 defaults at e00f45e1e0f5 (what everyone gets without configuring anything):

• setting.cloud.newWorkspaceFolder: (none) -> "inherit"
• setting.cloud.newWorkspacesInCloud: (none) -> false (a new setting, off by default: passes on its own)
• tunable-source.CmuxNextApp/AppActions+Workspaces.swift:newWorkspace: "f4430f92ebebcf729d1809e41fc0a0f64617faebed75af547acca8c0e524fe32" -> "980fd5e1935e0d748560c4ad61718bbc57a944247976d2c9d32d04fd9ce5d821"
• tunable-source.CmuxNextApp/Cloud/CloudMachineCreation.swift:needsMachineConfig: (none) -> "24002f64e17a8e1651609dba6db9729bee7b05070da59c2a942aef5b4ef49779"
• tunable-source.CmuxNextApp/Cloud/CloudMachineCreation.swift:needsScript: (none) -> "6aeefc8435eec1fb5fe92a1e5274e7365dbf19744beb98eb5c74eb9e40d9a604"
• tunable-source.CmuxNextApp/Cloud/CloudMachineCreation.swift:startBootstrap: (none) -> "fafa23229b3dce9acccfeebf3ac9d4321cad64613b34a49283df944b00f487e7"
• tunable-source.CmuxNextApp/Cloud/CloudMoveStrings.swift:notConnected: (none) -> "c1d5cb5d68fe3e1f4ecda37d6015116af43be48bd7d5fa0182c979010a9e307f"
• tunable-source.CmuxNextApp/Cloud/CloudMoveStrings.swift:outdatedMachine: (none) -> "1e26a955f7e770a5943ef86f0a5de11af86932cf1b981a26a13f7fa50f1d4fd3"
• tunable-source.CmuxNextApp/Cloud/CloudMoveStrings.swift:syncFailed: (none) -> "60eee936b5e061b24800b6bd5c14cc4f4e0fa0e0773dcaa5cb2dacbee74dd7ed"
• tunable-source.CmuxNextApp/Cloud/CloudPresenter.swift:offerPro: (none) -> "789383279f31e23900edc2cb6152f1889309780e10025944b9f1c0ec7c683842"
• tunable-source.CmuxNextApp/Cloud/CloudStrings+CLI.swift:proRequiredBody: (none) -> "f0d0974b89244630a15a4dd48f27a9b85713a17a2345f70370bbcf7bb44e5e29"
• tunable-source.CmuxNextApp/Cloud/CloudStrings+CLI.swift:proRequiredTitle: (none) -> "c23091551d1b2ff86d2370913edafd298d2a60213c14d40d7f4e69b5fd12ce95"
• tunable-source.CmuxNextApp/Cloud/CloudStrings+CLI.swift:proRequiredUpgrade: (none) -> "b8debcb5978ce38ca26c3a3dafcc425de321a5713915f0540bc9535a1bb0c814"
• tunable-source.CmuxNextApp/Handlers/CloudHandlers+Account.swift:checkCreationScope: (none) -> "0dccfb542d81d221cf244866147a45dd4dfd4396080e7ca6cd46f28bd440e5f2"
• tunable-source.CmuxNextApp/Handlers/CloudHandlers+Account.swift:creationFlow: (none) -> "8baf34adbc2c024b8d6bfa921b62af61c9df39daf36a9d1980def76ba1d30b44"
• tunable-source.CmuxNextApp/Handlers/CloudHandlers+Account.swift:pendingNewWorkspaceCreation: (none) -> "eba143371fefd147bef5acac5d1cdc7d2e3d240f1bc92cba65062c9e48081d12"
• tunable-source.CmuxNextApp/Handlers/CloudHandlers+Account.swift:startNewWorkspaceInCloud: (none) -> "908613edabc9a53e9510a54c56fbdd1b630bebc36fcb3c715a9f135ce00f4f64"
• tunable-source.CmuxNextCloud/Move/CloudNewWorkspacePlan.swift:copy: (none) -> "54da52adccc1135a4bccf2e6be5e27c417c869d46e43cf244bd508318f7fdc09"
• tunable-source.CmuxNextCloud/Move/CloudNewWorkspacePlan.swift:route: (none) -> "b336d4ed527246fd827c2210c4c9bcdaf7dda6a84060bab9c774173f6efedcd2"
• tunable-source.CmuxNextDaemon/Requests/Profiles/PersonalPins.swift:command: (none) -> "32bd35256e19e3930b1b2d206c49e60d9fdf46b9177205a27f19d4447da8aa38"
• tunable-source.CmuxNextDaemon/Requests/Profiles/PersonalPins.swift:command#: (none) -> "5d39b3629bea10d10331c81018a3c4f3ce00938e1020e7ae31645b9e4c26f6bc"
• tunable-source.CmuxNextDaemonService/CloudStrings.swift:newWorkspaceNoWindow: (none) -> "915a4e6a51883fef3f80d7821bc6a40b7e5dcca268aa0501faf97a2373666421"
• tunable-source.CmuxNextDaemonService/CloudStrings.swift:newWorkspaceOpenedHere: (none) -> "2d17056f71beeb7486ae385a026198e6a49f178487561302dc9830721b388824"
• tunable-source.CmuxNextSettings/CloudNewWorkspaceSetting.swift:descriptors: (none) -> "1b13c912a9d53e2b2422f6ceb2b7b0634f1343959dec2ae3b11857173022a89e"
• tunable-source.CmuxNextSettings/CloudNewWorkspaceSetting.swift:folderPath: (none) -> "5d379e1b9ee83b13c695dce2d62b998a8f048342db03260e95576751d6729c5f"
• tunable-source.CmuxNextSettings/CloudNewWorkspaceSetting.swift:inCloudPath: (none) -> "159e7a24f8090df6a49b73083a112c7d3ab6d1ef017f21815c025263d77383e4"
• tunable-source.CmuxNextSettings/Schema/SettingsSchema.swift:all: "344387f9111d4466fdb973b714700af0be1cb31cf1f28efb7ad119f301061aaa" -> "25792af9e9b89277129fef87f1dda8bd231b91503509108fb445ef3155fa5545"

Needs a review. It passes with an independent review receipt on this commit: a comment or review whose first line is Review (<reviewer>): SHIP at e00f45e1e0f536e8543f40146e938bc699b6c41d, from a member, not a self-review (the newest verdict naming the head decides; a later BLOCK beats an earlier SHIP), or with an approving review on this commit from @lawrencecchen or @teamleaderleo (the call owners in .github/defaults-call-owners.json, never the author). A receipt posted as a review re-runs this check; after a plain comment, re-run it. The needs a call label alone does not pass, and a new push needs a new receipt.

Merge receipt: merged as d5b0293c714f with these defaults changed, WITHOUT a SHIP receipt or an approving call owner review on its head.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4130052256501 (28aa638015)

[austinywang]

Correctness review (subagent), first head ddf389f9aeb, and resolution

#	Severity	Finding	Resolution at 0b466436593
1	blocker	New keys had no agent policy (everyKeyHasAnExplicitAgentPolicy)	Both .privacy-refused in SettingsSchema+AgentPolicy.swift; test asserts it
2	blocker	settings.group.cloudWorkspaces had no home in SettingsPageLayout	Placed under Accounts; SettingsPageLayoutHomeTests rerun on the fleet
3	blocker	Retry from the progress view rebuilt the default flow, losing the folder copy	CloudMachineCreation.open keeps the toggle's open; run uses it on every Retry
4	major	Signed out / Cloud unavailable turned Cmd-N into a failure page	Cmd-N stays on this Mac then
5	major	CLI / app-link preconditions checked only after a VM existed	Checked before the create; an app that can't copy starts the machine empty
6	major	Generated settings exports stale	Left to the PR autofix (never hand-edited)
7	minor	Cmd-N with a command dropped it; new-row debug timer; name dropped	command now stays local; timer and name are follow-ups
8	minor	Only en/ja strings	All 21 locales (needs_review)
9	minor	Dotfiles .git in home makes subfolders start empty silently	Follow-up: say why nothing was copied
10	minor	No window open: workspace only revealed	Follow-up with the UI pass

Also, from the pre-push gate: the new App file was refused (no App growth). The plan and copy moved to CmuxNextCloud, and CloudVmHostStore moved there as the offset (App −74 source lines).

[teamleaderleo]

Bead cx-mpq8qa created for this PR by the cmux coordinator.

[blacksmith-sh]

Found 9 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpbhln7_d4/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpnd59quqb/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
convention violations found (ERROR lines above)./ convention violations found (ERROR lines above).	View Logs
test_cmux_next_follows_the_committed_target_graph (main.FocusedTestMap.test_cmux_ne xt_follows_the_committed_target_graph)/ test_cmux_next_follows_the_committed_target_graph (main.FocusedTestMap.test_cmux_ne xt_follows_the_committed_target_graph)	View Logs
test_every_part_of_bun_run_check_runs_in_the_warn_branch (main.WebviewsWarnSplitCov ersCheck.test_every_part_of_bun_run_check_runs_in_the_warn_branch)/ test_every_part_of_bun_run_check_runs_in_the_warn_branch (main.WebviewsWarnSplitCov ersCheck.test_every_part_of_bun_run_check_runs_in_the_warn_branch)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[austinywang]

Verification at f657bc54aa5828a0480105193cc0f95971ffb2f2

Fleet suites (cmux-ci step 26062-cloud-toggle-f657bc54, Xcode 26.6, package-test-lane.sh suite):

• ✔ CloudNewWorkspaceTests 8/8.
• ✔ CloudNewWorkspaceSettingTests 3/3.
• ✔ CloudVmHostTests 10/10 (the store moved into CmuxNextCloud).
• SettingsSchemaExportTests:
  • ✔ everyKeyHasAnExplicitAgentPolicy.
  • ✘ exportIsFresh: the generated settings export has not been regenerated yet. The PR autofix does that; it is never hand-edited.
• ✘ SettingsPageLayoutHomeTests.everyShownRowHasExactlyOneHome is red on the base. The only keys without a home are notifications.sounds.*, from base commit 6a981d0, which is a test committed red first. The new cloud.* keys do have a home.
• The first run, at 0b466436593, failed to compile because CloudVmHostStore's @Observable needed public import Observation. Fixed in f657bc54aa5.

Tagged dev build 26062-cloud-toggle:

• Job 7d44f8f8091828cfeb3fe93d is done and published to the HQ cache. It was built from the working tree at this head.
• Dev backend https://cmux-dev-backend-1.tail137216.ts.net:4315/ is healthy.

Dogfood

1. Open the 26062-cloud-toggle build from the Tag Opener and sign in to Cloud.
2. In Settings > Accounts > Cloud Workspaces, turn on Run New Workspaces in Cloud. The palette's Toggle Setting also works.
3. Focus a terminal inside a git project and press Cmd-N.
   • Expected: the New Cloud Workspace progress view appears at once. Then a workspace named after the project opens on a new VM, with its terminal in the same subfolder: pwd is under ~/work/<project>-<hash>/… and your uncommitted files are there.
   • Before this change, Cmd-N always opened on this Mac.
4. Press Cmd-N again: you get a second, separate machine. Then set New Cloud Workspaces Start In to Empty Folder: the next workspace opens in the machine's home with nothing copied.
5. Sign out of Cloud: Cmd-N opens locally again.

Not run: steps 3 to 5 against live Freestyle, so the end-to-end flow is UNVERIFIED.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[austinywang]

Review (Codex independent review): SHIP at 1388f60

Fresh correctness-first subagent review of the complete 26-file diff against base d43ee797c05542a2846a07502ded7da017a68ea2, including the merge, generated artifacts, and corrected regression. No correctness blocker found. The primary agent also inspected the diff, exact heads, check logs, and artifact preservation audit.

• No-window requests create no Cloud machine, and local fallback displays its reason. The toggle keeps automation and explicit machine/command requests on their existing routes.
• The canonical pre-fix regression at 969a0c69f0a54a157624e171b23313c3627fef79 (fleet 9965fe37e9fe81696e414ac8) executed one test and failed its four intended behavioral assertions: terminal timeout, failed opener, cleanup close, and no retry. On this exact head, fleet 52707752856866a17cd754a2 compiled all package/test targets and executed the same test successfully in 2.126 seconds. Stable mutation and terminal identities preserve one workspace and terminal through the deadline.
• Independent artifact audit preserves all 604 base schema rows, 534 web-reference rows, and 597 MDM properties/metadata. Only the two expected Cloud settings are added, with correct defaults and privacy refusals. The existing Cloud chat-routing settings remain intact. The exports came from successful fleet generator fe17b3f4da0aa8b91f678813, not hand edits.
• Localization preserves existing entries and adds the expected seven Settings and two Cloud keys across 21 locales; English/Japanese are translated and other locales retain needs_review.

Coverage limits: the other 15 selected suites are still running and will be recorded in the description. Live provider creation/folder sync, current tagged-app dogfood, current native capture, performance, and optimized Release compilation were not independently exercised. The red lane also reported a separate same-tree cmux-tui component-key infrastructure error; its fake-daemon regression nevertheless compiled and executed. No skipped test is claimed as coverage.

[austinywang]

Review (Codex independent review): SHIP at 3bece71

Fresh correctness-first subagent review of the complete 26-file diff for #26078 against base 19532c2e7e7959c2be3ed1700caac4115fa63b4f. No correctness blockers found. The main agent also checked the actual diff, remote head, artifacts, and executed-test receipts.

• Rechecked Cloud lifecycle moves, start-chat integration, late-terminal handling, and both prior human concerns. No window creates no Cloud machine; local fallback displays its reason.
• Independent generated-artifact audit preserves all 605 base settings, 535 web rows, and 598 MDM properties, adding only the two Cloud settings. Every base localization entry is preserved.
• Exact-head fleet job 9f396e8bc9efa435cbe3f2c1 compiled all package/test targets and passed all 16 selected filters: 132 test executions, exit 0, workspace cleanup confirmed. The real production-opener regression passed in 1.524 seconds, following the canonical behavioral failure at 969a0c69f0a54a157624e171b23313c3627fef79 (fleet 9965fe37e9fe81696e414ac8). Completed controller log SHA-256: 924ac22bf12a539ef5412d2bcb61e7a879f97322cdc4581645818d4192597ae0.

Not independently exercised: live Cloud provisioning/folder sync, a current tagged-app capture/dogfood session, performance measurements, or optimized Release compilation. These limits remain explicit in the description. The default Cloud toggle remains off.

[austinywang]

The compile reds on 0878faa079641283ee120624d30a4efef7b2adb6 are base findings. The exact merged base ade83c44a96ebcb4f1597be4c0f65b8e13a8888b fails with the same two Swift concurrency errors in CmuxNextDesign/Overlay/NativePopupHost.swift:235:46 and :239:46: sending 'menu' risks causing data races. This PR does not change that file.

• Exact-base underlying fleet log, fleet job 91d5fd7f4ac60532abe628f8: failed at the exact base with both errors. Its wrapper job completed successfully but explicitly reports the failed compiler verdict; no passing compile is claimed.
• Current-head app compile log, fleet job 7acd319386a5306f7b90fd73: identical two errors. The current-head fleet Release compile and cmux-next/compile status wrap this same base failure.

The Mac action-export job also fails in its settings-regeneration compile with only those same two unique Swift errors. This is the same base compiler failure, not an observed settings-output mismatch.

The separate focused Xcode 26.6 fleet job b9ef7efc02fe0ac9a89e90f3 on the exact head stopped at compilation with the same two errors; zero tests executed. Exit 1 and workspace reset are confirmed. Full worker/controller logs both hash to SHA-256 bbd674b90e925df1afb366997ebfc65d7554efc8ed1894071d8134fdbe69f3a7. No unrelated source repair is included.

Further completed current-head checks:

• Swift tests fail before execution with the same two NativePopupHost.swift errors. Generated files (shared build) is a wrapper: it reports swift-test (failure) gave no generated files verdict, not observed generated-output drift.
• Current-head release-notary workflow guard fails NightlyStepCoverageTests.test_the_nightly_is_covered (four missing signer-step coverage entries) and RunsOnFallbackTests.test_a_picked_signing_label_has_a_rerun_alternative (nightly.yml signer-build-macos lacks a rerun alternative). Both identical failures appear in the exact-base guard run. This PR changes no workflow, CI script, or guard test. Its aggregate Guard status wraps that base failure.

The current-head fast tier has now failed as well. Its only two unique Swift errors are the identical base NativePopupHost.swift:235/239 sending-menu errors; no new PR defect is shown.

The official next-autoland pass 41257127641, snapshot 2026-11-01T00:42:32+00:00, still attributes the app-compile wrapper as PR-owned and waits on running checks, while already warning for the base Release compile and compile status. The latest actual base tip 8922fc217e2be3a12c3c0df967fc65982a306e2e still contains both broken popup observer expressions. Existing base repairs are #29856 and #29871. This PR will pick up a landed repair through a normal base merge; its feature scope remains unchanged.

[austinywang]

Review (Codex independent review): SHIP at 0878faa

PR: #26078
Owner/login: austin / austin@manaflow.ai. Reviewer: independent Codex subagent review_cloud_toggle. Base: ade83c44a96ebcb4f1597be4c0f65b8e13a8888b. Head: 0878faa079641283ee120624d30a4efef7b2adb6.

Fresh correctness-first review of the complete head against that exact base found no PR-caused blocker. Rechecked new-base integration, production creation/retry handling, no-window behavior, visible local-fallback reasons, and account/scope cancellation. Independent artifact comparisons preserve all base schema, MDM, documentation, and localization entries, with only the expected Cloud additions. This proves base preservation, not fresh export generation from all current source.

Current-head fleet b9ef7efc02fe0ac9a89e90f3 failed before executing tests. Its only two unique compiler errors are NativePopupHost.swift:235/239 sending-menu data races. The reviewer independently verified identical errors on the exact base, matching Xcode 26.6 routing, and no PR changes to that file. Receipt confirms the exact head, exit 1, and workspace reset. Controller log SHA-256: bbd674b90e925df1afb366997ebfc65d7554efc8ed1894071d8134fdbe69f3a7. Base/head failing-job evidence.

The earlier 132 passing test executions at 3bece713705c11ebf32d65054c1ce407405eb171 remain historical evidence; zero tests executed on this head. Live Cloud provisioning/folder sync, current tagged-app dogfood/capture, performance measurements, and successful optimized Xcode Release compilation remain unverified. Final reviewer API check confirmed this exact head/base and MERGEABLE.

Primary-agent audit independently rechecked the actual production/regression diff, current GitHub head and mergeability, complete check list, and generated/localization preservation; no additional PR-caused blocker found. The defaults guard needs this exact-head independent receipt; it will be rerun without changing source.

[austinywang]

Review (Codex independent review): SHIP at 58a6c97

Fresh correctness-first subagent review of the complete diff against ac5389c4d9333619d4536d78963b728881de5f78 found no PR-caused blockers. Reviewed local blobs match the exact-head API identities.

Rechecked Cloud creation/retry, cancellation and account fences, no-window fallback, sidebar routing, agent restrictions, and integration with the new base's size picker, harness-login, and handoff paths.

Independent artifact audit passed: all 605 base schema rows, 535 web-reference rows, 598 MDM properties, and metadata are preserved, with only the two expected settings added. All 1,492 Settings and 88 Cloud localization entries remain intact; additions cover 21 locales with placeholders preserved. This proves artifact preservation, not complete source-to-export freshness.

Exact-head fleet 2de680e3531e4c13e53bb47d compiled package/test targets successfully in 413.48 seconds. The reviewer independently verified the final receipt and all 16 filters: 133 actual Swift Testing executions, all passed, including the production-toggle late-terminal regression (1.676 seconds). Exit 0 and workspace_reset: true. Current-head cmux-next/compile is green. Downloaded full worker/controller log SHA-256: ed45d1b525150e556664d7ef7b58d1d4323d0703b05c68083c3ca55c77d002b4.

Live signed-in Cloud provisioning/folder sync, current tagged-app dogfood/capture, optimized Xcode Release compilation, and performance remain unverified. Earlier base compiler failures are historical. The primary agent independently checked the actual diff, artifact audit, test output, head and mergeability; no additional blocker found.

PR: #26078
Owner: austin@manaflow.ai; agent: Codex, with independent Codex review subagent.

[austinywang]

Current-head check classification at 58a6c971ccf9ed5e56ee74f85aa6a41c8e8f1d14: the release-notary red is inherited from the exact merged base ac5389c4d9333619d4536d78963b728881de5f78.

• Head job and base job both fail only DigestTests.test_the_repository_highlights_validate: priority-view-drag.md needs a tryIt action/deeplink or docs link. The reported failure dictionaries are identical.
• The failing highlight and scripts/whats-new/test_digest.py have identical blob IDs on base and head; this PR changes neither. Its own Cloud highlight is absent from the failure dictionary. The parent Guard status is a wrapper around the guard results.
• The exact-head defaults-guard rerun is now green after the independent SHIP receipt. Focused fleet verification passed all 16 filters with 133 actual test executions, exit 0 and workspace cleanup confirmed. Current-head cmux-next/compile is green.

No unrelated source repair or new check was added for the base finding.

Current-tip confirmation: base b85875a4be9a31f4d63f29382a2102ca24045d10 has now also failed the same test with the identical priority-view-drag.md failure dictionary (current base job). Its highlight blob is also unchanged. That base job additionally fails NightlyTrustedRouting.test_only_the_nightly_pickers_read_the_next_build_runner; this additional base failure is absent from this PR's guard log.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[austinywang]

Base finding for head a4e2b9b40ae45cd350bed6ee6faef01856cf6eed: the Windows check fails on upstream acpmux/src/hub/meta_save.rs:273 because Windows libc has neither kill nor SIGKILL.

• This head's failure log.
• The unrelated tab-bar-size branch has the same two E0425 diagnostics at the same line.
• The entire cmux-tui tree is identical between merged base f06d9bd0736cc1af17a455eed1da63153ee7dead and this PR head (0b1a0dd84a347532801fe9cf973635ed52c79d70); the Windows workflow is also unchanged. The failing line landed upstream in fix(acpmux): a chat's metadata saves are written in order; an acknowledged change survives kill -9 (fuzz g2) #29311 (2ddc1ec6b0e3adc465e2b65cebeb31d527c86726).

This is a base finding, so no unrelated Rust change is included in this Cloud toggle PR.

[austinywang]

Review (Codex independent review): SHIP at a4e2b9b

Fresh correctness-first subagent review covered all 26 changed files against base f06d9bd0736cc1af17a455eed1da63153ee7dead, including incoming base integrations. No remaining correctness blocker identified; immutable local head blobs match GitHub.

Independently inspected execution evidence:

• Exact-head fleet 4de25f3cff892ca14fe0b6e4: successful package/test compilation, exit 0, workspace cleanup confirmed. All 20 requested filters executed nonzero Swift Testing tests; 153 reported tests passed (some filters overlap), no skipped filters or failed-test lines. Includes late-first-terminal, all four attributed caller cases, all three Cmd-N/terminal handover tests and all five creation-input tests.
• Red-before fleet 9f074c4e5cd57b551d01cafa at b62559281f5c250704627076f06bbbb789b47e58: compilation succeeded; exit 1 exclusively from the four intended attribution assertions. The repair uses invocation.isPersonsOwnRun.

Defaults and behavior reviewed: Cloud creation defaults off; the folder mode defaults to inherit. All 606 existing setting rows/defaults remain unchanged. Native person actions honor the toggle; attributed automation retains its requested route. Local fallback displays its reason. Whole-working-copy upload and empty-folder behavior are distinct; Retry retains its custom opener and resets setup phases. Agent access remains refused. Deduplication, account cancellation, late-terminal repair and profile pinning were reviewed.

Canonical generated exports and localization audit pass; base entries are preserved. The Windows failure is base-owned: the Rust tree is unchanged and an unrelated PR has identical libc::kill/libc::SIGKILL errors (evidence). The defaults guard needs this exact-head receipt and a rerun.

Not verified: live signed-in Cloud provisioning/folder synchronization, a new tagged-app dogfood/capture, optimized Xcode Release compilation, or performance measurements. No builds or tests ran on the local Mac.

[lawrencecchen]

Merge service hold (P0 title rule in merge-batch.py, p0_missing_proof): the title matches "new workspace", so the batch leaves this PR out until the PR body names a fleet job that proves it.

The proof it reads:

• A job id (24 hex) in the PR body.
• The job state is done.
• The job ran on a display worker (label gui-session-v1, from cmux-ci run --display ...), or it is a smoke-gate build.
• The job ref is the PR head a4e2b9b40ae45cd350bed6ee6faef01856cf6eed (or the merge base with feat-cmux-next).

The body names 4de25f3cff892ca14fe0b6e4 (done, at the head), but it has no display label: it ran as a plain suites step. The other named jobs are at older commits. A display run of this PR's own tests at the head, for example cmux-ci run --display --class light --script scripts/ci/package-test-lane.sh --arg=suite --arg=Packages/macOS/CmuxNext --arg=<suites> --env CMUX_TEST_REQUIRE_GUI=1 --ref a4e2b9b40ae45cd350bed6ee6faef01856cf6eed, with its job id in the body, is the proof it needs. A new push changes the head, so the job must then be at the new head.

[austinywang]

The two newly completed guard failures at a4e2b9b40ae45cd350bed6ee6faef01856cf6eed also reproduce on feat-cmux-next:

• Checks job structure: head job 124731680247 and base 55361f16bf0ee608eebef6f035523eb7875bb083 job 124734666561 both fail WebviewsWarnSplitCoversCheck.test_every_part_of_bun_run_check_runs_in_the_warn_branch: bun run check:session-info-names does not run under CMUX_NEXT_STYLE_GUARDS=warn.
• nightly-guards / workflow-guard-tests / release-notary: head job 124731673580 and base 1d10c48b3549212f8becc0f0d0577654c457a7b5 job 124739719127 both fail NoHostedMacInNightlies.test_no_runner_picker_returns_a_hosted_mac on the same two scripts/ci/next_macos_cascade.py findings.

The workflow, test, package-script and runner-picker files involved are unchanged between this PR and its merged base f06d9bd0736cc1af17a455eed1da63153ee7dead. These are inherited failures; this PR does not modify their checks or implementations.

[austinywang]

Confirmed on the base itself: Windows control run 41270969207, dispatched from the existing unchanged workflow at feat-cmux-next commit 654a733e2a24043c25b43819eb9d4d5f92dfde9c, fails with the same two E0425 errors as this PR: libc::kill and libc::SIGKILL in crates/acpmux/src/hub/meta_save.rs:273.

This supplements the unrelated-PR reproduction and unchanged Rust-tree evidence. No Rust or CI source was changed for this control.

[austinywang]

Current head remains a4e2b9b40ae45cd350bed6ee6faef01856cf6eed: MERGEABLE, independently reviewed, and the exact-head focused Swift verification passed.

The official autoland verdict still rejects inherited failures despite the matching guard logs and matching base Windows control. A second Windows control at newer base 88115cb316a96724f5fff2bbc1e7e79b6262efc0 reproduces both E0425 errors.

Read-only independent diagnosis of the official evidence snapshot found stale unsigned workflow/bundle records overriding newer signed records of the matching base failures. The normalized head/base failure signatures match, but the classifier discards that evidence before comparison. Normal check reruns do not remove these preserved ancestor records. No PR source defect was found, and unrelated CI/classifier code has not been added to this PR. The official verdict has not accepted this head yet.

[teamleaderleo]

For awareness: this overlaps with work that just landed on feat-cmux-next.

#30020 makes cloud.startChat (cmux-tui, Rust) give each workspace its own new Cloud machine on its first Cloud send. A machine bound to one workspace is never picked for another. Leo, 2026-10-31: "austin/lawrence said indeed we wanted 1 workspace per vm for now".

The files don't overlap: this PR is the Swift Cmd-N path behind a toggle, and #30020 is the chat-start pick. The design is written up in Leo's Cloud design note, and the server-side version (binding, ownership, snapshots) is going into cmux-platform. Once the DEV builds switch over to cmux-platform, the client just asks the platform for its workspace's machine. If this PR lands, it may want to call that same path rather than keep its own pick.

[teamleaderleo]

For awareness: this overlaps with related Cloud work. Nothing here asks you to change this PR.

• cloud.startChat: one workspace per small Cloud machine #30020 (merged) makes a Cloud chat's first send from a workspace that has no machine create a new small machine for that workspace. It no longer reuses one of the person's other machines. It is Rust only, in cmux-tui's cloud.startChat pick, and it shares no files with this PR.
• The settled direction is one workspace per small, owner-kind machine for now, with server-side Cloud logic in cmux-platform. That server side has landed there: a workspace's own machine with a durable per-workspace binding, and resize that takes a snapshot first. Once the platform cutover (NEXT Cloud DEV integration: new Worker and app-server link #28950) lands, the client asks the platform for its workspace's machine (cmux-tui cloud.startChat: thin the machine pick down to asking the platform for its workspace's machine (after #28950) #30181). This PR's Cmd-N path could ask the same route then, instead of creating a machine itself.

[lawrencecchen]

A note on the Cloud route for new workspaces (CloudHandlers.startNewWorkspaceInCloud), found while merging this into #30071:

CloudNewWorkspacePlan gets byPerson: invocation.isPersonsOwnRun, which reads the handed invocation's origin. A handler's nested run is built with the default .user origin, so a script's, the CLI's or an agent's run whose handler performs newTab without its own focus arguments can pass as the person's own run. With the Cloud toggle on, that run can start a new paid Cloud machine through the person's route.

#30071 judges "the person's own run" by the run's own origin (ActionRunScope.current?.origin ?? invocation.origin) for the same reason (its review found the same nested-run case for the New Tab page hold).

Follow-up (lead decision): a separate PR into feat-cmux-next makes the Cloud route use the run's own origin too, with a red test first (a script's nested newTab with the default user origin reaches the Cloud route on the base), then the fix, a fleet green and an independent review. I will link it here when it is open. No change is needed in this PR.