#24837 [rd-biz-chief] Resume Cloud setup through sign-in and auto-open the machine

Draft from R&D, not for merge yet.

This branch contains two related Cloud setup handoff fixes: a442414e098 resumes
the original New Cloud Machine/Workspace action after hosted sign-in, and
da83188de84 adds opt-in cmux setup cloud-machine --open to attach the resulting
machine without a second target command.

The Swift change is app-facing Cloud setup code; it does not touch Chief-internal
hosts or memory.

Hosted sign-in continuation

A signed-out person's click on New Cloud Machine or New Cloud Workspace now opens
the existing hosted sign-in flow and calls the same creation/workspace closure after
the callback. Script/agent origins still receive signInFirst; Cloud outages and
managed policy remain gated. The changed handlers are
Packages/macOS/CmuxNext/Sources/CmuxNextApp/Handlers/CloudHandlers.swift:23-28
and CloudHandlers+Account.swift:13-65.

cmux setup cloud-machine already asks for paid Cloud creation, persists its idempotency state, follows slow creations, and avoids duplicate machines. The remaining setup break is the handoff: after creation, the agent has to print a target and the person or agent must run cmux cloud open-machine --target machine:<id> separately. This prototype adds opt-in --open, which invokes the existing cloudOpenMachine app action with the known target and focus: true, so provisioning and attaching are one setup flow.

Before/after flow counts from the setup harness:

• New machine: before = 1 cmux setup cloud-machine command + 1 cmux approval click, then 1 separate cmux cloud open-machine --target machine:<id> command and a target copy/paste; after = 1 cmux setup cloud-machine --open command + the same 1 approval click, with 0 target copy/paste and no second command. The attach action still waits for the app's bounded action deadline.
• Existing machine: before = 1 separate open-machine command; after = 1 cmux setup cloud-machine --open command, with the target detected from cloud.machines.
• Slow creation: the suggested rerun preserves --open; when the creation becomes a machine, setup attaches it without creating another machine.

Implementation evidence:

• cmux-tui/crates/cmux-tui/src/cli/setup/cloud_machine.rs:60-154 parses --open, reports an attach result, and applies it to discovered or newly-created machines.
• cmux-tui/crates/cmux-tui/src/cli/setup/cloud_machine.rs:347-447 keeps the existing creation/idempotency path and composes attach after a successful machine result; pending creation reruns keep the open intent.
• cmux-tui/crates/cmux-tui/src/cli/setup/cloud_machine.rs:484-527 calls the existing public cloudOpenMachine action, records opened/failed/planned, and gives a safe cmux setup cloud-machine --open retry when attach fails.
• cmux-tui/crates/cmux-tui/tests/setup/cloud_machine.rs:317-356 verifies one approval, one created machine, focus-enabled attach, idempotent rerun, and slow-provision handoff.
• cmux-tui/crates/cmux-tui/src/cli/setup.rs:32,180-184 and cmux-tui/crates/cmux-tui/src/cli/docs.rs:141-150 document the option.

Validation: cargo fmt --all -- --check; ZIG=/home/cmux/tools/zig-x86_64-linux-0.16.0/zig cargo test -p cmux-tui --test setup cloud_machine -- --nocapture (9 passed). git diff --check passes. This is a Linux Rust/TUI check; native macOS app builds were not run on this VM. The test uses a Unix-socket fake app, so it does not exercise a live Cloud backend or real macOS workspace rendering.

Scope is the public cmux setup/CLI and the existing app action contract. No Chief-internal code, auth policy, IAM, firewall, tailnet ACL, or GCP resources were changed.

---

biz-chief: draft from R&D, not for landing yet.

🤖 Generated with Claude Code

Agent session: big-red

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Resumes the Cloud machine/workspace setup flow after hosted sign-in so a signed-out person's click on New Cloud Machine or New Cloud Workspace continues into creation after the callback. Also adds an opt-in --open flag to cmux setup cloud-machine that attaches the resulting machine in the same flow, removing the separate open-machine command and target copy/paste.

New Features

• Signed-out people's New Cloud Machine and New Cloud Workspace clicks now run hosted sign-in first and continue into the same creation/workspace closure; agent/script origins still get signInFirst.
• cmux setup cloud-machine --open calls the existing cloudOpenMachine action with the discovered or created machine target, preserves the open intent across slow-provision reruns, and reports a safe cmux setup cloud-machine --open retry command if attach fails.