PR #28687 - manaflow-ai/cmux

Folds #26940 and #26941 (the two halves of the #26151 fold) into one PR, with their original commits kept. It stacks on the Cloud composer fold (#28686), whose commits are in this branch until it lands; after that, an update-branch leaves about 1,100 lines.

Leo: "a lot of this stuff shouldn't require so much deliberation" / "why dont we work on a big ol' branch".

What it does

#26940: the environment picker gets an Auto row and a scope line ("Auto · destination" by default; the auto-scope-look experiment holds the other two looks). Auto shows checked, and a machine row picked under Auto counts as an explicit pick.
#26941: on New Tab, Auto is the folder's run location (runLocationDefault.ts), and only a prompt that asks for a destination moves it (autoEnvironment.ts). Auto reads the chip's folder, chooses Cloud only while Cloud is offered, and holds every send while a start is out.

Why not split

#26940 is the picker row and #26941 is the behavior behind it. Either one alone ships an Auto row that does nothing or behavior with no row. It's a separate PR from the Cloud row because it is the next seam: the Cloud row works without Auto.

Conflicts resolved against current base and the Cloud fold

App.tsx: cloudStarting is set in the new keyed sendToCloud (with #26921's progress card). cloudOffered and cloudStarting were ported to the NewTabScreen block's new place.
ComposerContext.tsx: autoFace comes first, then the Sandboxed/Cloud face, then base's waiting-machine face. A pick clears waiting and also ends Auto.
NewTabScreen.tsx: base's auth gate and command intercept come first, then cloudStarting, then the Auto/Cloud routing. The Cloud progress card shows when Auto routes to Cloud as well as when Cloud is picked. const t is declared once.
experiments/registry.ts, Localizable.xcstrings and new-tab-saved-environments.test.tsx: union of both sides.

Design spec

leo-workspace design/composer.md and design/environment-picker.md.

Screenshots

Before/after screenshots are in #26940 and #26941.

Agent session: agent session

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Folds the two halves of the Auto environment work into one change: the picker's Auto row and the New Tab behavior behind it. Auto runs a new chat in the folder's run location — Cloud when the folder's newest chat went to Cloud, this Mac otherwise — and only an explicit destination request moves it.

New Features

The environment picker gets an Auto row at the top with a scope line ("Auto · destination" by default; the auto-scope-look experiment holds the other looks).
Auto stays picked until an explicit machine, Cloud, or local pick; a machine picked under Auto counts as explicit and ends Auto.
Auto reads the chip's folder at send time, chooses Cloud only while Cloud is offered, and holds all sends while a Cloud start is in flight.
A Cloud send calls cloud.startChat: the host takes this person's free Cloud machine, copies the folder there, opens the chat seeded with the prompt, and closes this Mac's tab.
Cloud progress (folder, machine, secrets, network) shows as metadata under the message, never a modal; the cloud-start-look experiment holds three layouts.
Attachments are refused on Cloud for now.

Reliability

Each send copies into its own folder on the machine; a retry reuses the same machine, tab, and copy, so the prompt is never sent twice.
Only folders inside the pane's roots can be copied, and a send whose copy already finished is not pushed again.
The sign-in check asks about the machine Auto sends the prompt to, not just this Mac.
A first send that a revoked OAuth token fails goes again once, 2 seconds later.