fix: honor team defaults when publishing Cloud VM ports

AU
1mo ago
+1917-118

Summary

cmux cloud domains publish <vm> <port> leaves --access unset when omitted, so the service applies team access for team-owned VMs and personal access for personal VMs. Explicit personal, team, and public modes remain unchanged.

Remote Cloud port rows now show a visible share icon on hover. It reuses an existing publication or creates one with the service default, then copies the HTTPS URL. The action refuses to copy a URL while its publication is still provisioning, so users do not receive a dead edge URL.

A publication with team access is protected by sign-in and current team membership. A teammate opens the HTTPS URL, signs in if needed, and is admitted when they belong to the VM's owning team.

Codex fork monitor claims now belong to an injectable CodexMonitorOwner, instantiated at CLI launch and used when detached monitor arguments are assembled.

Testing

  • python3 scripts/verify-local.py --repo . passes all 6 selected checks.
  • Added coverage for scope-aware publication defaults and Codex monitor ownership.
  • Hosted CI caught and fixed optional Cloud client unwrapping in the share action (dcbc8287cac).
  • Exact-head fleet build 1e69aa3de21be2324fa392be succeeded for dcbc8287cac.
  • The current dev backend is missing protected-publication auth configuration. Its publication remains provisioning and returns forward_auth_not_configured; this is a deployment configuration blocker, not a client URL-generation issue.

Changelog

Fixed: Cloud VM port publishing now uses team-aware access defaults and exposes a visible authenticated share action.

Checklist

  • Behavior changes have added or updated tests.
  • User-facing docs updated in docs/cli-contract.md and skills/cmux-cloud-vm/references/commands.md.
  • Review comment about injectable Codex monitor ownership addressed in 92e689d0ceb.

Summary by CodeRabbit

  • New Features

    • Added a “Copy Share URL” option for forwarded ports on non-local machines, available from the context menu and row hover controls.
    • Cloud domain publishing now uses defaults appropriate to whether the VM is team-owned or personal when --access is omitted.

  • Bug Fixes

    • Publishing without an explicit access mode no longer forces personal access or triggers public-access confirmation. Explicit access modes remain validated.