Cloud: keep the terminal daemon running when sudo needs a password

AU
4d ago
+703-41

Problem

A Cloud machine whose owner requires a sudo password has no terminals, while cmux vm status and cmux vm wait still report it as running.

cmuxTuiLayoutSelector treats a failed sudo -n true as "use the root layout". That fallback was meant for images built before the work user existed. Current images install cmux-tui only in /home/cmux, so root has no binary to run and the daemon never starts. cmux vm shell then fails with the generic Cloud VM error.

Change

  • Selector: keep the work user when sudo needs a password and its home holds the only daemon binary. A sudo password is the owner's choice, so this does not change it. Machines with a root install, legacy images, and machines with no binary yet behave as before.
  • Selector copies: the same rule goes into cmux-devbox-boot, cmux-tui-upgrade.sh and cmux-prompt-sync.
  • Agent updates: run through root exec. They used sudo -n as the work user, so these machines never received them.
  • Fleet upgrade: upgrade-fleet-cmux-tui.ts runs through root exec instead of sudo -n.
  • Image verification: verify-devbox-image.ts requires a sudo password on a throwaway machine, stops the daemon, and requires it to return as the work user.
  • New images: 12 Freestyle defaults (6 sizes, desktop and base) baked from e0721a9f4b with bun run devbox:promote. Merging this is what promotes them to every new machine. They also move cmux-tui from a6d89d443f to the current pin 6da40f7e59.
  • Upgrade guard: root exec can now reach these machines, so cmux-tui-upgrade.sh skips one whose baked supervisor would re-select the missing root install. Stopping its daemon would otherwise take a working machine down.

Rollout limits

  • cmux-devbox-boot and cmux-prompt-sync only ship at bake time (docs/cloud-guest-upgrades.md), so running machines keep their current supervisor.
  • cmux-tui-upgrade.sh still exits SKIP no-daemon, so the fleet upgrade cannot revive a machine that is already down. Those machines need a per-machine repair through root exec.
  • Running machines with a sudo password and an older supervisor report SKIP supervisor-would-select-missing-root-install, so they don't get cmux-tui upgrades until they move to a new image or get that repair.

Testing

Ran locally with bun test on macOS. tests/vm-cmux-tui-upgrade.test.ts passes on the current head (14 pass).

On the first commit, vm-cmux-tui, vm-agent-updates-workflow, vm-agent-updates and vm-guest-prompt gave 78 pass, 1 fail. The failure is the OSC 7 test in vm-guest-prompt.test.ts, which reads the prompt script this PR does not change. It still fails on the current head, where vm-guest-prompt and vm-cmux-tui were rerun.

New tests run the real shell selector with moved homes and a stubbed sudo refusal, load the real cmux-prompt-sync to check it picks the same layouts, assert agent updates use asRoot, and cover the upgrade guard's three states.

tests/vm-devbox-image.test.ts: 4 agent-config tests fail with or without this change (compared against base before the prompt-sync and agent-update edits).

tsc --noEmit reports nothing in the changed TypeScript files.

The bake ran under the production account. Verification booted two throwaway machines from it, all checks passed, and both were deleted. Each derived size was re-booted by derive-devbox-sizes.ts. devbox:manifest:check passes locally.

The sudo-password check in that bake run could not fail on its sudo step (see the review comment). After fixing it, I ran the fixed check on fresh throwaway machines from the promoted sm, md and lg images: sudo reported a password is required, and the daemon returned as cmux and listening on port 1337. lgx, xl and 2xl did not get this check. The check itself is not in the image source digest, so the fix needs no rebake.

Not tested: cmux vm shell from a Mac against the new image.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features
    • Added a new default virtual machine image family, with desktop and base options across multiple sizes.
  • Bug Fixes
    • Improved terminal daemon startup when passwordless sudo is unavailable, keeping the work-user layout when it contains the only usable daemon.
    • Guest agent updates now run with root access.
    • VM upgrades skip changes when they could leave a machine without terminal access.
    • Added checks to verify terminal access is preserved in cloned development environments.