Cloud NEXT: route rename and idle policy through CloudDO (HQ brief 09)

Draft
TE
2d ago
+132-6

HQ brief 09: complete the safe CloudDO settings routes

Source inspection at cmux feat-cmux-next@6c3fe3648ba4b44e7bf38c4982a665ec2d5d5712 and cmux-platform main@794483e7aaee755341c8cbfaf334a7b2148111df. Follow-up to cmux#32866, which already moved app-server Pause/Resume to CloudDO.

Problem

CloudService.renameMachine and CloudService.setIdlePause still unconditionally call the classic CloudAPIClient (PATCH /api/vm/{id} and PUT /api/vm/{id}/idle-pause). NEXT app-server creates/listing use cloud.machine.create/list with CloudDO vm_<20> IDs; these classic routes require the older registry.

Change

  • In .appServer mode route rename to cloud.machine.rename {machine,name} and idle policy to cloud.machine.idle_policy.set {machine,idle_seconds}, each with one mutation key and verified app user origin. Classic mode keeps its original API calls.
  • Validate the machine ID and resulting name/policy in CloudDO's acknowledgement before mutating the app's local record. Errors continue to surface to the calling action. Empty names on CloudDO follow the server's MachineName contract (1–80 characters).
  • Decode idle_policy.idle_seconds from CloudDO records into the existing app minute field, so a list refresh preserves a setting. Fractional-minute policies remain unspecified in the app's minute-only display.
  • Add four transport contract tests (op/ID/argument unit/answer/fail-closed) and one CloudDO record-decoding test.

Explicit exclusions

deleteMachine still requires a separate G8 person-approved cloud.machine.delete flow. It must preserve the native destructive confirmation, team pin, same-key retries across approval.pending and mutation.indeterminate, and tombstone/list reconciliation. This draft intentionally leaves deletion for its owning issue. Also, the app-server create currently rejects nondefault requests, including --persistent (CloudMachineRequest.isDefault); this PR changes the existing idle-policy set operation only.

Validation / review

  • Source contracts cross-checked: cmux-platform/src/server/cloud/domain/Cloud.ts handles both settings as update with mayManage; the vendored protocol requires idle_seconds and returns {machine}.
  • GitHub compare from the pinned base shows exactly five files, 5 commits. No live VMs, owner tokens, production requests, deployments, or merges.
  • Swift tests and macOS app runtime unverified in this environment; request macOS focused tests CloudMachineSettingsTests and CloudIdlePauseTests plus a genuine app-server machine check before shipping. Kept draft deliberately.

Refs: HQ #6236 brief 09, cmux-platform #510, cmux #32866.

🤖 Investigated and proposed via ChatGPT.

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Routes machine rename and idle-pause settings through CloudDO for app-server machines, which the classic CloudAPIClient routes can't handle because they require older registry IDs.

  • App-server mode now calls cloud.machine.rename and cloud.machine.idle_policy.set; classic mode keeps the original API calls.
  • Each operation verifies the machine ID and returned value in CloudDO's acknowledgement before updating the local record; mismatches fail closed.
  • Idle policy is exchanged as seconds and decoded into the app's existing minute field; fractional-minute policies remain unspecified in the minute-only display.
  • Added transport contract tests (op, arguments, acknowledgement checks, invalid input) and CloudDO record-decoding tests.