#26791 cmux NEXT: cloud.startChat, a new chat's first send runs in Cloud

What

A new host method, cloud.startChat {task, cwd?, harness?, model?, key}. It is how a new chat's first send runs in cmux Cloud when Cloud is where the chat runs. The composer's Cloud row comes in the next PR. On that send the App does all of this, with no machine, size or environment prompt:

1. Machine. It takes a Cloud machine in Move to Cloud's reuse order: a connected one, else any, else a new one. A new one is sized for the chat by CloudChatPick (#26740).
2. Folder. It copies the chat's folder there with Move to Cloud's own sync. CloudMove.machine and CloudMove.sync are shared now (no longer private), not duplicated.
3. Chat. It opens a new chat on that machine in the copied folder. The prompt is seeded as the person's, so it goes out once with the Send's gesture, the way onboarding's first task does.
4. Cleanup. It closes this Mac's tab, which never started a chat.

Progress and failures are Move to Cloud's toasts (no new strings). The page gets the failure's message.

On the pane side, cloud.startChat takes Sandboxed's exact guards:

• a new chat only;
• the Send's own gesture;
• the send line drained;
• the replacements held, so no local chat starts meanwhile;
• one at a time.

Both now go through AgentPaneHandOff. That also moves the sandbox case's body out of AgentPaneModel (a god type), which shrinks it.

Why

Leo, 2026-10-28: "whatever's convenient for cloud, like that can be productionized, operationalized, we ought to just put out there"

Leo, 2026-10-28: "You can just say ... where should this chat run and stuff, and that's just about it ... it's somewhere in the cloud, and then it gets managed for you. You don't have to select an environment, you don't have to create an environment, you don't have to do all that nonsense".

Risk

• Behind Labs preview features. The method refuses with labs_off otherwise, and nothing calls it until the composer's Cloud row lands (next PR).
• The Sandboxed path is moved, not changed. Its guards, order and replies are the same, and AgentPaneSandboxRunTests covers them.
• Only a chat on this Mac can start one. The pane refuses a chat on another machine (chatIsElsewhere), and the App also checks that the tab's daemon is local before it touches the folder.
• The folder must exist as a directory, and the home folder and the disk's root are refused, as in Move to Cloud.
• The model is not carried to the machine's start yet: a remote start takes the agent only. The chat starts on the agent's default model there.
• Attachments are refused on the page for now.

Tests

AgentPaneCloudStartTests covers:

• a new chat with a gesture reaches the runner with its prompt, folder, agent and model;
• the hold is taken during the run and kept after a start, so this pane never starts a second chat; a refused start releases it;
• nothing reaches the runner with no gesture, a started chat, a chat starting, a chat on another machine, or a bad request (empty prompt, relative folder, bad key, a non-string or oversized agent);
• with no runner, the method is unsupported.

Fleet package tests (AgentPaneCloudStartTests, AgentPaneSandboxRunTests, CloudWorkPickTests, CloudMoveTests) are queued at this head. The fleet controller is stalled, so there is no result yet. This lands only after a real compile and test result.

Review: an independent Codex (gpt-6-astra, high) review took three rounds and returned SHIP at 4f11ea7a02626123428fe6cbba7d5381bb6a4f5d. Round 1's isolation, folder and duplicate-chat findings and round 2's remote-page finding are fixed in this head.

Stacked on #26740 (CloudChatPick). It is retargeted to feat-cmux-next once that lands.

No capture: no UI changes; nothing calls the method until the composer's Cloud row (next PR), which is captured by its gallery run.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds cloud.startChat, a host method that runs a new chat's first send in cmux Cloud when Cloud is picked as where the chat runs, with no machine, size, or environment prompt.

On send

• Takes a Cloud machine in Move to Cloud's reuse order (connected, else any, else a new one sized by CloudChatPick) and copies the chat's folder there with Move to Cloud's sync, now shared rather than duplicated.
• Opens a new chat on that machine with the prompt seeded as the person's, then closes this Mac's tab. Progress and failures reuse Move to Cloud's toasts.

Guards and risk

• The Sandboxed path's guards move into AgentPaneHandOff and are shared: a new chat only, the Send's own gesture, the send line drained, replacements held, one at a time.
• Behind Labs preview features; the method refuses with labs_off otherwise, and nothing calls it until the composer's Cloud row lands.
• The model is not carried to the machine's start yet; a remote start takes the agent only, so the chat starts on the agent's default model there.