#33006 Cloud: no subscription login on cmux servers; the Mac-to-machine login copy never runs in Release

Leo (2026-11-02), approving it: "yeah that should be fine right? cuz man i dont wanna be liable for peoples' subscription tokns". cmux keeps no Claude or ChatGPT subscription login on its servers. "Sign in once per user" now rides the person's own machine snapshot instead (cmux-platform, separate PR), with one-click sign-in on the machine as the fallback.

Anthropic's Claude Code terms: "developers may not collect, store, or intermediate Claude.ai credentials or session tokens — sign-in to a Claude account must complete through Anthropic's own flow."

What changes

cmux-host: the harness login sync is gone (#30318). The cmux host run Cloud role no longer reads ~/.claude/.credentials.json / ~/.codex/auth.json and sends them to the platform's /v1/harness-credentials/machine, and no longer writes a saved login on a new machine. Removed: cloud/harness_login.rs, harness_login_thread.rs, harness_login_tests.rs, the worker's wiring, Env::harness_login_origin and CloudClient::forget_token (their only callers). The thread's old state file /var/lib/cmux/harness-login-sync.json (revisions and fingerprints, never a login) is removed at start. The login files themselves stay where Claude Code and Codex keep them. It was on only in development (harness_login_origin was None for staging and production).

The Mac-to-machine copy never runs in Release. passes_harness_login was setting.unwrap_or(dogfood), so defaults write ... cmux.cloud.passHarnessLogin -bool YES turned the copy on in a Release build. It is now dogfood && setting.unwrap_or(true): on in Debug and NIGHTLY (DevTools.isEnabled), the setting can turn it off there, and Release never passes a login. Rust tests updated. The app links the pinned CCmuxAppFFI build, so the Swift side (its doc comment and theDefaultsKeyIsTheSwitch's Release case) follows in a step-B PR that re-pins the FFI once app-ffi-release publishes this commit, as #32305 → #32403 did.

Rule written into leo-workspace design/cloud.md ("Subscription logins: never on cmux servers", teamleaderleo/leo-workspace#2679).

Server side (routes, Durable Object, its rows, and a test that fails on a new login store): manaflow-ai/cmux-platform#580.

Test

Fleet (cmux-ci test, Linux): cargo test -p cmux-host -p cmux-cloud-start-core, cargo test --manifest-path crates/cmux-layout-reducer-ffi/Cargo.toml --test cloud_harness_login, cargo clippy -p cmux-host -p cmux-cloud-start-core --all-targets -D warnings, cargo fmt --check: all green (run 41577093864).

Agent session: agent session

🤖 Generated with Claude Code