#26585 Fixes #26539: start the Computer Use helper on an agent's tool call instead of waiting out backoff

Summary

Fixes #26539.

Agents intermittently failed every Computer Use call with "cmux-owned Computer Use daemon stayed unavailable during initial connection", most often after an app update, until the user toggled Computer Use off and on in Settings.

The cmux-cua proxy never launches a cmux-owned daemon; it polls the app's socket for about 10 s and then fails the call. The app restarts a down daemon from its 2 s health loop, but every failed start doubled a launch backoff (5 s, 10 s … 300 s), and recovery inside that window was silently refused. So one failed start (for example a slow first launch of the freshly re-staged helper after an update, which the old 5 s readiness bound killed mid-launch) could leave the daemon down for minutes. Toggling the setting was the only path that reset the backoff, which is why it worked around the bug.

Now:

• An agent's Computer Use tool call (the PreToolUse hook event Claude and Codex already send to cmux) starts a down helper immediately, bypassing the backoff the way the toggle did, at most once every 5 s. Concurrent calls share one attempt, a call while both daemons answer costs two local socket probes, and a failed on-demand attempt still feeds the backoff so background recovery doesn't turn a broken helper into a launch loop.
• The launch readiness bound grows from 5 s to 15 s. Readiness is event driven (PID file), so healthy launches return as soon as the socket binds; only a slow launch is no longer killed and re-queued behind the backoff.
• Each failed start logs its stage (launch, socket readiness, host authority, …) under the ComputerUse log category, so the next report can say which step failed. Nothing was logged before.

The launch and the LaunchServices registration go through injectable seams (helperLauncher, helperRegistrar), so tests count launches without starting or registering a synthetic bundle. The on-demand start honors the Computer Use feature flag.

Testing

ComputerUseHelperDemandRecoveryTests (CmuxComputerUse package) arms the launch backoff with a failed start, then checks that a tool invocation launches again, that background reconciliation inside the window still doesn't, that a disabled runtime starts nothing, that two concurrent calls share one attempt, that repeated calls skip the backoff at most once per 5 s, and that disabling during an on-demand recovery launches nothing.

• Base path (69d89a19, the entry point routed through the existing backoff-bound recovery): cmux-ci run --class light --script scripts/ci/run-swift-testing-suites.sh --arg Packages/macOS/CmuxComputerUse --red, step ff20c1f8e76224425e74fcd9 on aws-m4pro-1, fails 2 of 3 (launches.count → 1, expected 2).
• Fix (652fc57d): same command, whole package, step c971781926d7eb64bcdf6fec on aws-m4pro-4, exit 0, new suite 3/3.
• After review fixes (2c7f8cf1): same command, whole package, step c68bdc87c701c358355f056f on aws-m4pro-5, exit 0, new suite 5/5.

Observed / Not run

Observed:

• Red and green fleet runs above (exact SHAs).
• Tagged build 26539-cua-daemon of 2c7f8cf1 (job 715f1e782bd730a9a9d1426c) built, installed and listed by the Tag Opener; the tagged dev backend is healthy.
• Correctness review subagent: no blocking findings. Its medium and low findings are fixed in 2c7f8cf1, resolution posted on this PR.

Not run:

• No live reproduction of the after-update failure in a GUI app. Launching the helper on the agent host would raise real permission prompts there, so the root cause comes from reading the cmux-cua proxy (pinned e0f73880, ensure_daemon_available_with, 10 s poll, no launch) and the runtime's backoff path.
• The proxy's 10 s wait itself is unchanged: a launch slower than 10 s still fails that first call, and the next one succeeds.

Changelog

Fixed: Computer Use no longer stays unavailable to agents after a failed helper start (often right after an update) until it is toggled off and on in Settings

Proof

No visible UI change; the behavior is in the helper lifecycle. Tests and a tagged build are listed above.

Checklist

• Behavior changes have added or updated tests, or Testing says why not
• Reviewed with a subagent before merge (cmux-review), and all bot and human review comments resolved

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes #26539: an agent's Computer Use tool call now starts a down helper immediately, bypassing the launch backoff that could keep the daemon unavailable for minutes after a failed start.

• A failed helper start armed a 5–300 s launch backoff, while the cmux-cua proxy only polls the app socket for ~10 s, so calls failed until Computer Use was toggled off and on in Settings, the only backoff reset. A PreToolUse event now launches a down helper immediately, at most once per 5 s, with concurrent calls sharing one attempt and failures still pacing background recovery.
• The start runs before check_permissions too, so every tool works even when the menu/onboarding feature is hidden.
• The readiness bound grows from 5 s to 15 s, start failures are logged with their stage, and launches go through injectable seams (helperLauncher, helperRegistrar) so tests never touch LaunchServices.
• New tests cover backoff-bypassed relaunch, shared concurrent attempts, call pacing, disable-during-recovery, and recovery with the menu feature hidden.

Summary by CodeRabbit

• New Features
  • Cloud VMs can automatically pause after a configurable period of inactivity.
  • The Plus plan is now $15/month and includes one saved VM, expanded machine sizes, and no monthly runtime-hour cap. Paused VMs count toward the saved-machine limit.
  • Cloud CLI documentation now includes an updated quick start, command reference, and troubleshooting guidance.
• Bug Fixes
  • Computer Use now attempts helper recovery when a local tool invocation arrives and the helper is unavailable, including during permission checks. Simultaneous requests share a recovery attempt.
  • Completed Claude background work now correctly returns panes to idle.
  • Terminal history works with shell no-clobber settings.
  • SSH connections better preserve configured agent and X11 forwarding behavior.