#12285 cloud: Try Again and cmux.sh buttons on failed port panes, Copy/Open Proxy URL with auto sign-in

Follow-up to https://github.com/manaflow-ai/cmux/pull/12100, which moved Cloud ports off the packet-tunnel extension. This PR adds the way out when a port pane still fails, and the public route.

Failure page buttons. SurfaceBrowserPlaceholder.failed gains Try Again (re-runs materializeBrowserPane in place) and, for ports, Open through cmux.sh instead. Buttons post {token, action} to SurfaceBrowserPlaceholderBridge, one WKScriptMessageHandler installed on every browser configuration that accepts only main-frame about: documents carrying a per-pane token registered by the provider (browserPaneRetryTokens, released on navigate, pane end, or replacement). The desktop pane never gets the proxy button.

Proxy URL. Port row context menu gains Copy Proxy URL (cmux.sh) and Open Proxy URL (cmux.sh). Both use POST /api/vm/publications with the server defaults (idempotent; access mode team for a team-billed account, else personal), hostname <vm>--<org>--<port>.cmux.sh.

Auto sign-in. BrowserAppSessionController.request(externalDestinationURL:) reuses the native→web cookie handoff and navigates the primed isolated store to the publication URL, so the forward-auth bounce to /cloud/access finds the account signed in. SurfacePaneFactory.makeAuthenticatedBrowserPane opens such a pane at a catalog destination; it falls back to a plain pane when no session can be handed off.

Tests: bridge acceptance rules, failed page with and without token, node-action fixtures.

Socket/CLI entrypoint. cmux vm open <m>:port/<n> --proxy (vm.port_open {proxy: true}) opens the publication through the same path as the menu and the failure-page button, so the flow is scriptable.

Web. CMUX_VM_PUBLICATION_FORWARD_AUTH_URL (optional) names the URL Freestyle's edge calls for forward auth when the browser origin is not publicly reachable; sign-in stays on CMUX_VM_PUBLICATION_AUTH_ORIGIN. Defaults unchanged. Test added.

End-to-end, verified on tag portux (dev stack, browser origin = the stack's .ts.net URL, edge callback through a Cloudflare quick tunnel, zone style.dev): vm open kind-pink-lizard:port/8000 --proxy → pane created with the account's session handed off to its isolated store → edge 302 to /cloud/access on the app origin → authorized, callback set the publication cookie → pane URL https://kind-pink-lizard--lawrence-chen-s-tea--8000.style.dev/, title "Directory listing for /", 3 s, no sign-in card. Prod uses one origin for both, so the same path applies with the default env.

Supersedes https://github.com/manaflow-ai/cmux/pull/12148.

https://claude.ai/code/session_01PTHiBBEfb9pBWWCfPsapL4

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
Medium Risk
Adds authenticated WebKit navigation to external cmux.sh URLs and a script-message bridge; rules are constrained but auth handoff and publication creation are user-facing and security-sensitive.

Overview
When a cloud port browser pane fails to open on the private/loopback route, the failure placeholder can now show Try Again (re-runs materialization in place) and, for browser ports (not desktop/VNC), Open through cmux.sh instead. Actions use a new SurfaceBrowserPlaceholderBridge on browser webviews: main-frame about: pages post {token, action} to handlers registered per pane by the TUI provider.

The cloud tree adds Copy Proxy URL (cmux.sh) and Open Proxy URL (cmux.sh) on forwarded port rows. CloudPortProxy creates or reuses a personal cmux.sh publication via the VM API and returns the public URL.

Opening the proxy in-app uses makeAuthenticatedBrowserPane, which calls BrowserAppSessionController.request(externalDestinationURL:) so session cookies are exchanged on the cmux web origin while WebKit navigates the isolated store to the publication URL (supporting forward-auth bounce). Menu open and failure-page proxy both use this path; copy puts the URL on the pasteboard.

New localized strings cover the buttons, menu labels, and “Publishing on cmux.sh…” progress text. Tests cover placeholder HTML with tokens and bridge message acceptance rules.

^{Reviewed by Cursor Bugbot for commit 0fdc7eed25b751ecc91fc21232aae3a23b05fc63. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Failed cloud port panes now offer Try Again or Open through cmux.sh instead of requiring users to close and reopen them. Port menus and vm open <m>:port/<n> --proxy use the same authenticated public route.

Details

• Creates or reuses an idempotent managed publication for Copy Proxy URL and Open Proxy URL.
• Opens proxy URLs in an isolated browser store with the cmux session handed off, falling back to a normal sign-in flow when no session is available.
• Restricts placeholder actions to live per-pane tokens from main-frame about: documents.
• Adds CMUX_VM_PUBLICATION_FORWARD_AUTH_URL for deployments whose browser origin is not reachable by the publication edge; sign-in remains on CMUX_VM_PUBLICATION_AUTH_ORIGIN.
• Adds coverage for proxy opening, placeholder actions, bridge validation, and forward-auth configuration.

Summary by CodeRabbit

• New Features
  • Added retry actions to browser-pane error pages.
  • Added an option to open supported remote browser ports through cmux.sh.
  • Added context-menu actions to copy or open cmux.sh proxy URLs.
  • Opened proxy destinations in authenticated browser panes.
• Improvements
  • Browser panes now preserve cmux authentication when navigating to external destinations.
  • Added English and Japanese text for the new actions and statuses.