Promote Cloud images with the latest agents and the Codex hook-trust fix
Summary
New cmux Cloud machines get the cmux-tui that fixes Codex's "Hooks need review: 11 hooks are new or changed" prompt (#20482), and the latest coding agents. Merging this is the image promotion: every default create (the Mac and iOS New Machine sheets, cmux vm new, POST /api/vm, vm base open/reset) resolves through these defaultForKind manifest rows.
Stacked on #20524, which adds the verifier check this bake passed. Review and merge that first; this PR's own diff is the pin bump and the manifest.
Old default (f9d8ad69 bake) | This bake | |
|---|---|---|
| cmux-tui | f9d8ad69 (before #20482) | 28e864017f (includes #20482) |
| Claude Code | 2.1.267 | 2.1.299 |
| Codex | 0.154.0 | 0.162.1 |
| OpenCode | 1.18.30 | 1.19.0 |
| pi | 0.85.1 | 1.2.0 |
| agent-browser | 0.37.1 | 0.39.1 |
Pins are npm latest (devbox:pins:check --write); epoch 2026-10-14-r1.
New snapshots (desktop and base share each size): sm sh-ab014406eece40d49716f044c0880c85, md sh-5deafe1e0ff741649ebea308d215671a, lg sh-4827326f9dac4db9be5e85b72ccfb96b, lgx sh-982bfc25df67499f878d3340387d71eb, xl sh-9c49530ebf994b508677ffb0b850654e, 2xl sh-7ab2d629dc9347e097eb1ea764f53db3.
Running machines, and machines from fork/restore/templates, keep their own cmux-tui. They take the fix through bun scripts/upgrade-fleet-cmux-tui.ts, which defaults to the build this manifest bakes. The maintainer's five running machines are already upgraded (all OK upgraded, terminal counts unchanged). The rest of the fleet hasn't been touched.
The chatmux devbox template (chatmux:infra/sandbox-images/Dockerfile) keeps its pins in its own repo and still needs the same bump by hand.
Testing
bun run devbox:promote -- freestylefrom this branch (CMUX_BAKE_ALLOW_BRANCH=1, cmux-tui pinned to28e864017f): bake →verify-devbox-image.tsALL CHECKS PASSED, includingcodex-pane-hooks-trusted-ok 22(Codex 0.162.1 through the cmux-tui pane wrapper: every hook trusted, no review) → sizes sm…2xl derived and re-booted → manifest written.bun run devbox:manifest:check: 12 validated defaults, all baked from this checkout's devbox sources.- End to end on a tagged dev build (
cmux DEV pr-20532-cloud-agents-v2, fleet jobf2fd21de39faa5343c0d41fb, dev backend serving this branch's manifest):cmux vm new --focus false, the default path with no image, kind or size, createdvm-3b1eefe1…onsh-5deafe1e0ff741649ebea308d215671a, this ladder's md row.- Inside it:
/etc/cmux/image-stampreads2026-10-14-r1; cmux-tui is28e864017f; Claude Code is 2.1.299, Codex 0.162.1, OpenCode 1.19.0, pi 1.2.0 and agent-browser 0.39.1. - The pane hook-trust probe reports
codex-hooks-trusted-ok 22. - In the machine's own cmux terminal,
codexstarted through the cmux wrapper (--enable hooks -c hooks…, team mode). It sat at the composer for 20 s with no "Hooks need review". In own-sign-in mode it stops at Codex's ChatGPT sign-in first, which is unrelated to hooks.
- Still open: the same check on production after merge and deploy.
Changelog
Fixed: Codex on new cmux Cloud machines starts without asking to review cmux's hooks, and new machines ship the latest Claude Code, Codex, OpenCode, pi and agent-browser
Proof
Verifier output above; no Mac UI change.
🤖 Generated with Claude Code