#12373 Fix Cloud terminal browser opens

Related to https://github.com/manaflow-ai/cmux/issues/12346

This PR proposes automatic browser forwarding from a Cloud terminal: pressing Enter at gh auth login's browser prompt should open the device-login page on the Mac. Cmd-clicking the printed URL already works. The reported bug is that the automatic opener launches Chrome on the VM's hidden desktop instead.

The guest routes BROWSER, GH_BROWSER, xdg-open, x-www-browser, and sensible-browser through cmux open. Attached terminals send a request to the Mac's existing terminal-link handler; headless callers print the URL and exit 0. The intended Mac behavior honors the terminal-link browser setting and preserves focus. Explicit Chrome and computer-use launches retain the VM desktop.

Trade-off: the implementation reuses cmux-tui's notification stream instead of adding a daemon operation, but it requires compatible Mac handling. Full guest-to-Mac dogfood is still unverified. This PR is not ready to merge; first confirm that the automatic-open bug still reproduces on a fresh current Cloud machine.

Latest main was merged in f46b85482b. Resolution preserves main's deletion of the duplicate guest CLI and main's newer published image records. The branch's older test snapshot promotions were removed from the final diff so they cannot replace newer images. The combined image recipe needs a fresh validated bake if this fix proceeds.

Validation on the merged branch:

• bun test ./web/tests/vm-guest-cli.test.ts ./web/tests/vm-devbox-image.test.ts --test-name-pattern 'open|every shell file parses|template directory' — 9 passed.
• scripts/check-pbxproj.sh — passed.
• scripts/lint-pbxproj-test-wiring.sh — passed, 881 files.
• swiftc -parse Sources/TerminalLinkOpenCoordinator.swift — passed (syntax check only).
• python3 scripts/swift_file_length_budget.py — passed.
• git diff --check — passed.

Earlier disposable-VM checks established headless fallback behavior. They did not prove the full automatic Mac browser handoff.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
Medium Risk
Touches cloud notification delivery, VM guest CLI/image rollout, and workspace focus behavior; bounded by mirror attachment checks and existing link-open settings.

Overview
Cloud devbox shells no longer send human-facing browser opens to hidden VM Chrome. Guest side adds cmux open and a cmux-open-url shim wired to BROWSER/GH_BROWSER and common Linux opener names; when the caller terminal has a native Mac mirror, it posts a private cmux.open-url row on the existing notification stream (with attach-time heal and new devbox image entries for rollout).

Mac side extends CloudNotificationSync with an optional handler that consumes those control rows (ack/read without banner delivery) and opens the URL beside the source terminal via the existing terminal-link browser path. TerminalLinkOpenRequest and openTerminalBrowserLink gain a focus flag so cloud handoffs open embedded panes without stealing focus, while normal user link opens stay focused.

Headless or unattached callers still print Open this URL: … and exit 0. Explicit Chrome/agent-browser/CUA desktop flows are unchanged.

^{Reviewed by Cursor Bugbot for commit dde12bc8b601baaca40b476edb8a7e747d1c6351. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes #12346. Cloud devbox browser-opening commands now hand URLs to the attached Mac instead of launching the hidden VM Chrome through the inherited DISPLAY=:1; headless callers print the URL and exit 0.

Behavior

• Adds cmux open <url> and routes BROWSER, GH_BROWSER, xdg-open, x-www-browser, and sensible-browser through it.
• Forwards only http/https URLs; other schemes print in the guest and exit 0.
• Cloud-opened URLs open beside the source terminal without changing the selected workspace or stealing focus; normal terminal links keep their existing focus behavior.
• Explicit Chrome, agent-browser, xdotool, and CUA launches still use DISPLAY=:1.
• Cloud browser-open requests are consumed and acknowledged without becoming visible notifications, and stay pending until a single matching terminal mirror routes them; ambiguous projections are rejected.

Rollout

• Uses the daemon's existing durable notification stream; no new remote protocol operation is required.
• The attach-time guest CLI heals existing machines; the promoted devbox image, verifier, docs, and localization include the opener.
• Preserves current Xcode project and devbox template/test wiring.

Summary by CodeRabbit

• New Features

  • Added cmux open <url> support for cloud terminals.
  • Browser-opening commands can route URLs to an attached Mac browser pane or print the URL when no host is available.
  • Added support for common browser opener commands through cmux.
  • Added optional focus control when opening embedded browser panes.

• Bug Fixes

  • Cloud browser requests are handled and acknowledged without appearing as unread notifications.
  • Prevented ambiguous terminal projections from receiving browser-open requests.

• Documentation

  • Updated cloud terminal, CLI, and Japanese localization documentation.