PR #29556 - manaflow-ai/cmux

Leo: "whenever i start a chat it should be able to send me to cloud automatically".

What was wrong

Once #29107 and #29497 got a fresh Cloud machine past the team gate, the creator's first chat was still refused, in two steps.

Folder. A new chat with no folder of the person's own takes the workspace's first terminal folder (remoteFolder). cmux cloud start-session opens a terminal on the machine first, and a first send in a machine workspace uses the same terminal folder. On a fresh machine that terminal sits in $HOME, so agent-session-start refused it as agent_session.home_unconfirmed. The app reads that code as "needs a folder on that machine to start in". The nightly signed-in capture showed this on a fresh machine (hq run 41224623701).
Trust. The machine's own ~/work would be refused next with agent_session.untrusted_folder. acpmux's auto-trust is off by default (agents.trust.autoTrust), so nothing trusts it. Leo's VM reached this step after the owner gate.

Neither step depends on the image: every image puts a fresh terminal in $HOME.

What changes

The changes are in cmux-tui (Rust), and they ship to machines through the app's own update of the machine's cmux-tui (#29497).

They apply only on the caller's own Cloud VM. That means the machine kind gate reads a Cloud VM (a team VM included) and the caller's vm_kind is exactly owner, the Cloud API's answer for the machine's creator.

agent-session-start: a start in an unconfirmed home folder starts in the machine's work folder instead ($HOME/work, made if missing).
Trust: acpmux's trust answer for exactly $HOME/work reads trusted, with decided and auto: "cloud_work", mirroring how acpmux answers a folder cmux made. This applies at the start and in agent-session-trust's read, so the app's page asks nothing either.
What still wins: the person's "Don't trust" (an acpmux decision) and an agent's own untrusted level.
Unchanged: any other folder on that machine, a home folder the person chose (Use Home Folder), any machine that isn't a Cloud VM, and any caller without the owner word.

Tests

a_first_chat_on_the_callers_own_cloud_vm_starts_in_its_trusted_work_folder (cmux-tui tests/cli/agent_session_start.rs):

On an owner VM, and on a team VM with the creator's word:
- the trust read for ~/work answers trusted / cloud_work;
- without the owner word it is refused;
- a start at $HOME starts, and makes ~/work;
- another folder still answers untrusted_folder.
The person's "Don't trust" on ~/work still refuses.
A machine that isn't a Cloud VM still answers home_unconfirmed for its home.

Risk

This decides folder trust for one folder on one kind of machine: the work folder of the caller's own Cloud VM, which is a disposable sandbox the person owns. The daemon already lets any agent family run there (#28613). It records nothing in acpmux; the person's own answers still override it.

Agent session: agent session

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Fixes a creator's first chat on their own Cloud VM so it starts in the machine's work folder with no trust question.

On a fresh Cloud machine, a new chat with no folder of the person's own starts in the workspace's first terminal folder ($HOME), which agent-session-start refused as agent_session.home_unconfirmed; the machine's own ~/work was refused next as agent_session.untrusted_folder because acpmux's auto-trust is off by default.

Changes

On the caller's own Cloud VM, an unconfirmed home folder becomes $HOME/work, made if missing, and that folder reads trusted with auto: "cloud_work" at start and in the trust page, so no question is asked.
On a team VM, a start passes the folder and its trust, then asks for an agent that asks before acting (agent_session.not_asking).
A person's "Don't trust" and an agent's own untrusted level still win.
Any other folder, a home folder the person chose, any non-Cloud VM, and callers without the owner word keep today's rules.