Fix Cloud VM creation, access, resizing, and routing

AU
1mo ago
+435-147

Summary

The 50-machine allowance and removal of shared CPU/memory/storage pool enforcement are already on main through #12024. Team resume allowance propagation and Base conflict handling are already on main through #12006. This PR fixes the remaining failures found while verifying Cloud machines:

  • Make the pinned cmux-tui client executable by ubuntu. Older snapshots linked /usr/local/bin/cmux-tui into /root (0700). Publish an atomic executable copy, repair it during create/restore/attach/recovery, and verify it as ubuntu during image baking. Isolate the readiness helper's shell exit so healthy attach cannot skip publication.
  • Serialize first-use network persistence per owner in Postgres. Concurrent creates can otherwise collide on the provider-network unique index before the owner/provider upsert handles its conflict. Cross-owner conflicts still fail closed.
  • Read Freestyle provisioned-resource statistics so disk resize can proceed instead of returning 501. Statistics reads do not wake a sleeping guest.
  • Share canonical terminal-ID resolution between the CLI and native app through CmuxFoundation. A stale key can no longer override an exact resource ID; malformed or foreign canonical IDs fail closed.
  • Use one IPv6 host formatter for browser, desktop, and port URLs. Accept bracketed loopback URLs, and preserve scheme, port, path, query, and fragment when replacing the host.
  • Preserve cancellation when the socket waiter resumes without a value, rather than reporting a canceled connection as a timeout.

Complete five native pricing keys across 20 locales and use 50 machines per paid Team seat consistently in native and English/Japanese web pricing. Correct stale native fixtures to match the current graph and persisted identifier format, and replace the connect-cancellation test's polling with an explicit child-start signal.

Pulled origin/main at c49e5af397 and merged it cleanly in 69083b695b, including main's snapshot-parser crash fix from #12034. Image IDs, binary pins, and private-home permissions are unchanged by this PR.

Validation

  • 824 VM/pricing/environment tests passed with Bun 1.3.14 and real Postgres during the backend verification. The merged main revision subsequently passed 106 focused VM/pricing tests, typecheck, focused ESLint, and the complexity gate.
  • Live staging verified three simultaneous Base/Desktop creates from a cold four-seat Team with maxActiveVms: 200, cmux-tui --version as ubuntu on all three machines, idempotent retry, guest execution, and disk resize to 65536 MB. All disposable machines, the Team, and user were deleted. Staging is refreshed to merged backend revision 69083b695b (dpl_HMLqqTEyszCkh572MYsafAUNZNQF).
  • Both reported user machines were repaired in place using their existing pinned binary, without restarting the daemon.
  • Regression-only commits precede the runtime fixes. Native coverage exercises canonical identity, IPv6 URL generation, cancellation cleanup, legacy persistence, reverse tab edges, and main's snapshot row ordering. Final revision 914242de57 passed all 70 selected native app tests and all 14 shared-package tests. The native app and bundled CLI build passed on that same revision.
  • Localization audit: all five native pricing keys have translated values in all 20 supported locales; English fallbacks match the catalog, and English/Japanese web pricing uses paid-seat wording. The native routing fixes add no display strings.
  • Tagged native dogfood build, refreshed after runtime changes. Backend behavior is verified separately on staging.

The five inline review findings on #12024 and three posted findings on this PR are addressed. The production follow-up has not been deployed or merged.

[!NOTE]
Medium Risk
Changes VM create/restore/attach paths, terminal routing, and network persistence under concurrency; failures roll back creates but incorrect routing or publication would break Cloud access.

Overview
Fixes Cloud VM access and routing so the work user can run cmux-tui, terminal opens use one identity policy, and backend operations stop failing on races or missing stats.

Guest cmux-tui access: The installer and Freestyle driver no longer symlink /usr/local/bin/cmux-tui into /root. They publish an atomic 755 copy of the pinned binary and re-run that repair on create, restore, attach, and daemon heal; create/restore roll back if publication fails. Devbox bake and verify steps assert ubuntu can run --version.

Terminal routing (CLI + app): Duplicate vmTerminalID logic is replaced by shared CmuxCloudTerminalIdentity in CmuxFoundation so a canonical id wins over a stale key, with fail-closed handling for foreign or path-like IDs.

URLs and links: CmuxInternalHostnames.urlHost centralizes IPv6 bracketing for direct port URLs and private browser URL rewriting (including [::1] loopback). CloudMachineLink calls Task.checkCancellation() so a canceled connect is not reported as a timeout.

Backend: Freestyle adds getStats (API read only, no guest exec) for resize flows. upsertNetwork uses a per-owner Postgres advisory lock to avoid concurrent first-insert collisions on the provider-network unique index.

Copy: Native and web (en/ja) pricing strings switch Team limits to 50 per paid seat and refresh related VM resource wording across locales.

Tests and fixtures were updated for the new contracts (public client attach, network race, stats, canonical terminal IDs, cancellation timing).

Reviewed by Cursor Bugbot for commit c8e6d3f84f62676bbfd8446b8cc859913375e789. Bugbot is set up for automated code reviews on this repo. Configure here.