HOLD build-only: golden cmux-tui 8c00572a + the desktop link service (#36519)

Draft
TE
17h ago
+426-31

HOLD: a build-only branch, never to merge. It exists so cmux-tui artifacts publishes this commit for the Cloud VM image lock (the golden-image slices of manaflow-ai/cmuxterm-hq#7086).

Leo, 2026-11-05 21:39Z: "If you're, like basing it off the golden image and just doing it bit by bit, slice by slice, sure. And you can preserve multiple copies, can't you?"

What it contains: cmux-tui 8c00572a, which is the lock's current pin (#36832): cbbeec18 from the approved image cloud-native-cbbeec1, plus only #36739. On top of that, only the cmux-tui part of #36519 (5e3d2300): cmux-host, cmux-link and the generated cloud-wire Desktop service. With it, the image's Cloud host reports link-desktop-v1 when the image has cmux-agent-rd.socket, and the receiver admits the creator's desktop dial.

Why: the desktop-agent-production probe (hq run 42112615671) failed at open-desktop with "no desktop capability advertised". Every pinned cmux-tui (cbbeec18, 8c00572a) predates #36519, so no image has ever reported the capability. The app and platform side shipped in #36848 and cmux-platform#903.

Next:

  1. A separate PR pins images/cmux-vm/inputs.lock.json to this commit's publish.
  2. A bake with the agent tools probe.
  3. The cmux-vm approval, with older images kept.
  4. The CLOUD_VM_API_IMAGE and CLOUD_DESKTOP_IMAGE_IDS flip.

Changelog

  • none

🤖 Generated with Claude Code

Agent session: agent session

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

HOLD, build-only: never merges. Publishes cmux-tui 8c00572a so the Cloud VM image lock can pin it, adding the desktop link service that no prior image has ever shipped.

  • The Cloud host now advertises link-desktop-v1 when cmux-agent-rd.socket is installed; a baked daemon.json never decides it.
  • The receiver admits a creator-only desktop dial: owner-kind token, desktop in the peer's policy, and up to one each of daemon, ssh, desktop in a token.
  • cmux link dial --service desktop now splices to the agent display's /run/cmux-rd/desktop.sock, refusing with desktop_unavailable when the socket is missing.
  • Also carries #36739, which stops the relay's backoff wait from panicking its thread and ending the relay for good.

Next steps are the separate images/cmux-vm/inputs.lock.json pin, a bake with the agent tools probe, the cmux-vm approval, and the CLOUD_VM_API_IMAGE / CLOUD_DESKTOP_IMAGE_IDS flip.