#31106 Cloud start: a copy of a folder this Mac trusts is trusted on the machine

What

A Cloud start copies the person's folder to their machine and opens the chat there. The machine's acpmux had no trust answer for the copy, so the chat showed "Trust the cloud-proof-2025f5 repo?". The first message sat in the composer and was never sent, even though the person had sent it from a folder this Mac trusts.

Evidence: a DEV capture of build ff3f8c9b on 2026-11-01, Cloud fixture, existing machine "cloud-chats". For 5 minutes after the send, debug.surfaces showed the machine's agent pane with "kind": "agent", "phase": "restoring". The still shows the trust card ("Not now: The agent won't run here until you trust it.") above the unsent message.

Policy change: this narrows cx-1bhjj

Under cx-1bhjj, only the person's own click on a machine trusts a folder there. With this PR, the person's existing trust answer on this Mac also counts for their own copy of that same folder, made by this start, on their own Cloud machine. Nothing else changes:

• Only the copied folder. The answer is recorded for the chat's folder inside the copy this start made. No other folder on the machine gets it.
• Only when this Mac already trusts it. "Trusts" means this Mac's acpmux reads the chat's folder as level: "trusted" (the same acp.trust.get read its own pane uses). That covers the person's decision, their auto-trust rules, or the agents' own levels.
  • An unknown, untrusted or unreadable answer still asks on the machine.
  • So does a run with no --acpmux-home given.
• Only on the caller's own machine. The call is agent-session-trust on the chat's tab and is sent only on the link's owner answer (vm_kind: "owner"). The machine daemon's own checks still apply: the machine kind gate, its own agent tab, and the home-folder rule.
• Not a teammate's or SSH machine. Those never get it: there is no ownerLink, so nothing is sent.

How

• Rust (cmux link start-chat copy):
  • New --acpmux-home H flag.
  • A successful copy now answers source_trusted, read from that acpmux home's trust record by acpmux::trust::get for the chat's folder (local plus subpath).
  • A failed copy answers nothing.
  • The App passes its own acpmux home (QuitAgents.environment), so a DEV build reads its own record.
• Swift package (CmuxNextDaemon): new AgentSessionAttachClient.trustCopiedFolder. It sends agent-session-trust at level trusted only when sourceTrusted is true and an owner link exists. A failure is quiet: the page then asks as before.
• App (CloudStartChat.open): calls it after the tab exists and before the workspace is shown.
  • CmuxNextApp lines are unchanged (+17/−17; arch-ratchet: "no architecture count rises").

Tests

• New Rust test a_copy_answers_whether_this_macs_acpmux_trusts_the_chats_folder. It covers:
  • no answer, trusted, untrusted and unreadable records;
  • the subpath folder;
  • no acpmux home given;
  • a failed copy answering no trust.
• Run: cmux-ci test -- cargo test -p cmux-tui --lib link::start_chat_cli. Fleet app compile: cmux-ci compile-check --app at the head.

Related: #31087 (the second copy after a machine update uses the machine's new link socket) touches the same CloudStartChat lines.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes Cloud start so a folder this Mac trusts no longer prompts to trust its copy on the person's own Cloud machine. This narrows cx-1bhjj: the person's existing trust answer on this Mac also counts for their own copy of the same folder on their own Cloud machine, so their first message is no longer held behind a second prompt.

How it works

• cmux link start-chat copy takes --acpmux-home and answers source_trusted, read from that acpmux home's trust record the same way acp.trust.get reads it.
• The App records trusted for the copied folder on the machine (agent-session-trust) before the chat shows, only when source_trusted is true and an owner link exists; failures stay quiet and the page asks as before.
• A failed copy answers no trust, and a copy with no --acpmux-home never answers trusted.
• Only the copied folder on the caller's own Cloud machine gets this; unknown, untrusted, or unreadable answers still ask there, and teammate or SSH machines are never touched.
• Tests cover trusted, untrusted, unknown, and unreadable records, the subpath folder, a missing acpmux home, and a failed copy.