PR #25367 - manaflow-ai/cmux

Summary

cmux Cloud now covers every Freestyle VM operation and CLI command, tenant-scoped, through cmux's own stack: cmux vm … → cmux-vm CLI → vm.cmux.dev → provider. The provider's team key stays on the Worker. Every resource is per tenant: another tenant's id answers 404. The clients never name the provider. Of the 88 provider operations, workers/cmux-vm/upstream/coverage.json now marks 79 wrapped, 9 denied, 0 planned. Before this PR it was 36 wrapped, 45 planned, 7 denied.

Tenant API, new routes

Files: exists, mkdir -p, rm, and resumable uploads (begin, chunk at an offset, status, commit, abort; up to 16 GiB). The upload id is sealed to its VM and never exposes the provider's id.
Updates: PATCH a VM (name, labels, idle, max run, auto delete) and PATCH a snapshot (name, labels, ttl, auto delete). cmux.* labels and service labels are protected, and both writes are compare-and-set.
Client sessions / identities: tenant-wide list, get, set the Linux user (exactly one user, never unscoped), and list, mint and revoke tokens. Token ids are derived (vct_); no migration.
Networking (behind the existing mesh experiment gate): rename a mesh, list mesh addresses, list tunnels, rename a device, list and get the compiled firewall rules, evaluate the ACL.
Domains and TLS (migration 0018, new domain:read / domain:write scopes): domain verifications (one claim per domain across tenants; unverified claims lapse after 7 days), domains, certificates and wildcard certificates for the tenant's own domains, TLS rules (only to the caller's VMs, only managed hostnames or verified domains), and forward auth (headers write-only).

CLI

cmux-vm gains: file (alias fs) ls/read/write/stat/mkdir/rm/exists; push/pull/scp (resumable above 64 MiB); ssh (session token only via askpass, revoked on exit); session and identity; terminal; update; snapshot update; vpc; tunnel; firewall get/set/rules/evaluate; https-proxy; domain; tls and tls forward-auth.
cmux vm forwards every verb.
plans/cmux-next/freestyle-parity.md maps each provider CLI command to its cmux verb or to a denied row.

Deliberately not exposed (reasons in the "Deliberately not exposed" table of the plan doc):

hardware power, placeholder branding, raw provider transport, and the provider account/auth/billing/tokens commands;
tunnel attach/detach to a second VPC (it would bridge two meshes outside both ACLs);
several Linux users on one session;
source.vpcId, socks5 egress and non-header transforms on TLS rules;
account-wide certificate and domain lists.

Built as one integration branch from five slices: identities, networking, domains and TLS, files and updates, and CLI in two rounds.

Testing

CI on the merged server tree (4ded550c97): cmux VM run 40262654831 passed all 8 jobs: typecheck, lint, openapi, breaking-change, upstream coverage, workerd tests (isolation table over every new route), PGlite store tests and bundle.
CLI: cmux VM clients rust job green on the CLI tree (runs 40262690951 and 40269736001). cmux-tui cli::vm:: tests green on linux (run 40275336737).
Live, against a preview Worker with the real provider (team testtest; one throwaway VM and snapshot, both deleted):
- 33 of 35 smoke checks passed: VM create, update, refusal of cmux.* labels, exec, mkdir/exists/write/read/ls/stat, a 3 MiB resumable upload in two chunks with status, commit, sha256 match and abort, recursive rm, client session create (ssh host, user, token), tenant list, get, extra token, token list (ids only), set Linux user, revoke, snapshot create and rename, pause, and stat while paused.
- The two failures were bugs in the smoke script (field state, token id). Re-checked live: token revoke 204.
- That preview is the integration branch minus domains/TLS (branch feat-cmux-vm-parity-live, test only, never merged): the preview database lacks migration 0018, and the Worker's schema check refuses to serve without it.

Observed / Not run

Observed: the CI runs and live smoke above.
Not run live: domains/TLS routes (need 0018 applied to the preview or staging database by its owner) and mesh routes (the mesh experiment is off on preview). Both are covered only by the fake-provider worker tests.
Not run live yet: the CLI binary against the preview. It needs the fleet vm-cli build mode from https://github.com/manaflow-ai/cmux/pull/25329 to land.
Base reds: the cmux VM clients sdk job is red on the base too; https://github.com/manaflow-ai/cmux/pull/25298 fixes it. The bundle budget rises from 440 to 456 KiB gzip (measured 447.0 KiB; no new dependency).

Before deploy

Migration: apply 0018_cmux_vm_domains_tls.sql to staging (then production) with the release rails (db-release.ts apply --tree cmux-vm) before this code reaches staging. The deploy gate refuses it otherwise. Grant the Worker SELECT, INSERT, UPDATE and DELETE on the four new tables.
Managed hostnames: they need CMUX_VM_MANAGED_DOMAIN_ZONE set to a zone with a wildcard certificate (optional: CMUX_VM_DOMAIN_EDGE_HOST, CMUX_VM_CERTIFICATE_NAMESERVER).

Changelog

Added: cmux Cloud VM API and cmux vm cover every provider VM operation: file ops and resumable uploads, VM and snapshot updates, ssh and client sessions, VPC, tunnel and firewall reads, domains, TLS rules and forward auth.

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}