NEXT Cloud DEV integration: new Worker and app-server link

Merged
TE
18h ago
+5417-683

Lands as one PR: the pieces below were not all landing on their own, and the full diff has an exact-head SHIP.

Takeover and base merge (cloud-demo, 2026-10-31)

The cloud-newlink lane handed this PR over. At 1d89f03d410b:

  • Merged current feat-cmux-next. #28111 (cloud.startChat) and #28686 (Composer Cloud) are on base now, so their final versions win in the 23 conflicted files. On top of them the integration keeps #28687's Auto destination (New Tab, environment picker, ComposerContext), the Native receiver and link work, and role.rs's deferred close on end of stream, which now also keeps lines buffered before a read error (#28761). Base refuses cloud.startChat on the app-server link (unavailable, #28111); this build keeps that.
  • Fixed the two macOS cmux-tui artifact builds: an earlier merge had dropped mod sign_clone from cmux-link's lib.rs (E0433 in caller_macos.rs).
  • The Windows build red was base's (cmux-automations on Windows), and #29075 fixed it. It came in with the merge.
  • The Native link's bundle signature check (SecStaticCodeCheckValidity) now runs on the child's BackgroundWork lane, not the actor's executor. The pre-push concurrency gate flagged it.
  • Not changed: "Cloud NEXT new-link create E2E / create-and-link" fails because environment protection keeps lane/cloud-newlink-integration out of cmux-next-vm-image-dev. That is trust policy and is left as it is.

Verified on the fleet (cmux-ci test): cargo test -p cmux-link -p cmux-host passed (no failures) and cargo check -p cmux-server -p cmux-tui --all-targets built clean (run 41241504572). In webviews, bun run check reported 0 errors, the type check passed, and 173 tests in the touched New Tab, picker, Auto and Cloud suites passed with 0 failures (run 41241504684). Not run: the Swift suites; the DEV compile on this push covers the build.

Leo: "you need to do all that stuff we do not care about classic we care about our new cloud"

This combines the NEXT Cloud work into one build candidate against the development Worker. It is not yet an end-to-end success: Worker/network-client integration, deployment and the signed Release GUI recording remain outstanding.

Included sources:

  • Latest #28111 first-send fixes, including model forwarding, retry machine/tab identity, upload scope and completed-copy reuse.
  • Composer Cloud and Auto folds #28686 and #28687, preserved alongside current NEXT fixes.
  • #28899: exact signed NEXT DEV defaults to the development Worker/app-server link, with isolated staging auth storage. NIGHTLY remains unchanged until this path is proven.
  • #28909: staging-only native sign-in callback, now based on NEXT rather than main.
  • Worker-only creator-ownership changes from #28789; #28612 is already on base.
  • #28937: authenticated link-only credential resolver and Swift producer.
  • #28947: opt-in guest Native receiver, scoped authority, lifecycle/revocation and deadline handling, with its security suites.
  • #28948: explicit Native image opt-in that does not promote into the existing direct-image channel.

Integration conflicts preserve both newer NEXT behavior and the Cloud stack: upload streaming and restart-stuck operations, first-send error handling, composer fixtures, copy safety and progress events. The upload-root search uses checked off-main filesystem access.

Observed / Not run

  • #28899 Release frontend compile and both focused Swift suites passed; the old auth-storage regression reproduced with 10 expected assertion failures and no crash.
  • #28937 exact-head independent review and Release frontend compile passed at 56c433a5be2a8169003de2b3f85c7dde65c5c201. Nine focused Rust tests passed on its unchanged Rust input; Swift relay tests are pending.
  • Guest and image focused fleet tests and independent review are in progress. No whole-integration runtime pass is claimed.
  • The integration prepush gate passes with the existing narrowly reviewed App composition exception: exact +368 lines, no baseline increase, migration tracked in manaflow-ai/cmuxterm-hq#5534, expiry 2026-11-30. The app-size rule uses that documented exception; other checks remain active.
  • Local web lint reports the same unchanged-base failures: composer-draft-overflow frame-read check, apps stylesheet type-scale count, and nine settings formatting files. Those files and check scripts match base e04790aebdfe. Heavy web checks and tests go to the fleet.
  • Not run: fresh-machine chat, files, terminal, signed DEV identity/signature verification or private GUI recording. A presigned download URL alone is not an app-signing receipt.

Risk: integration of credential, network, guest lifecycle and first-send behavior. This large aggregate exists only to test one build; it is not a proposal to land the stack as one change. No classic API fallback is the acceptance target.

No capture: real end-to-end captures are pending and will remain private because they use the authorized account.

Agent session: agent session