Cloud start: the creator's own team machine takes their Claude login (DEV builds)

Merged
TE
4d ago
+121-27

Leo settled the hold on 2026-11-01: "team or no team the thing should just work / you shouldn't be blocked by stuff if you bought the access to a machine / it's your machine / you can share machines with your team but like".

Why

A machine the app creates on a team account is billed to that team, and the classic backend records its guest kind as team (web/services/vms/vmKind.ts resolveVmGuestKind; the devbox image bakes team and its cmux-vm-kind-sync keeps it). So #29771's first-chat login was always skipped for its own creator. Seen in the item 14 capture (HQ runs 41349493808, 41345627356, staging): harness_login: skip (guest-not-owner) ... caller owns yes, guest team, and Claude never replied. The turn card's "Transfer and restart" ended the same way ("Personal credentials can only be transferred to a Cloud machine you own.").

Change

  • CloudHarnessLoginDecision (#31264): once the platform says the caller created the machine (callerOwns), a team guest takes the login like an owner one (guestTakesLogin). guest-not-owner now means only a missing or unknown kind. A teammate who did not create the machine still gets caller-not-owner, so a shared machine never gets someone else's login from the start.
  • CloudCredentialTransfer(allowsCreatorTeamGuest:), default false: the preflight and installer accept an owner or team guest. The caller's platform answer (vmKind == "owner") is still checked before and after the login, as are the launcher and work-user checks and the custom-endpoint guard. The start passes it for a team guest; the recovery dialog (CloudPresenter) passes it under the same gate.
  • Gate unchanged: passesHarnessLogin (DEV and dogfood builds, or the cmux.cloud.passHarnessLogin setting), as #29771 and #31183. Production builds are unchanged.
  • Merged with feat-cmux-next (#31183, #31264).

Risk

Teammates who can reach a team-account machine its creator signed in on share its Unix user, so they can read that login. Leo accepted this above. Production builds are unchanged.

Follow-up, not in this PR: the guest-wide kind stays team on classic team-account machines. Changing resolveVmGuestKind would ship to production through main and switch every production team-account machine's agents from the team model plane to own-login mode.

Tests

CloudStartChatLoginTests (a creator's team guest installs or asks once, a teammate's never does, the record line), CloudCredentialTransferTests.theCreatorAllowanceAcceptsATeamGuestOnlyWhenAsked, ownerAnswerOnATeamGuestStillNeedsTheAllowance, and the installer test runs the allowance on a team guest (installs; custom endpoints still refused).

Agent session: agent session

šŸ¤– Generated with Claude Code