cloud-setup: keep Codex refresh credentials in one local holder
Codex credentials cannot be reused by copying one rotating refresh credential to every cloud workspace. Add a private-pipe auth-owner process that signs in once into a dedicated Codex home, lets Codex maintain that home, and returns only an access token, account ID and expiry.
The process holds an exclusive lock through its owned Codex child, serializes requests, rejects an existing CLI credential seed, pins the account, bounds replies, and terminates its child on cancellation. The refresh credential stays in the private local home. Device-code login returns the code and official verification URL for cmux to show.
This is the local-holder prerequisite. It does not yet enable the wizard's broker option or claim that VM refresh works; authenticated VM delivery and startup integration are separate changes.
Relevant setup notes: “New cloud workspace”, “Figure out what you want to transfer into the api key from current machine to new machine.. claude setup-token”, and “Always need new claude credentials, that kind of suck”.
The official CI/CD authentication rules say: “Use one auth.json per runner or per serialized workflow stream.” and “Do not share the same file across concurrent jobs or multiple machines.” Codex's refreshed file is retained; an original seed never overwrites it, it stays out of logs/artifacts, and failed refresh requires a new sign-in. Those managed-auth rules cover the holder; VM clients use the separate external-token app-server contract.
Validation: all eight focused broker tests passed on head cbd2256447e025be4085c12094e2ea194e8c12bb in cmux-ci run 40497950319. The tests cover private-cache validation, rotating-token persistence, account pinning, fresh device login, cancellable private pipes, closed-reply cleanup and the child-held lock. The independent xhigh review found a SIGPIPE cleanup issue; this head fixes it and adds an isolated subprocess regression.
Review (codex gpt-6-astra xhigh, review-26142b): SHIP at 09e2b9c8179525bfae54965331b5d147808b02df
Current reviewed head 09e2b9c8179525bfae54965331b5d147808b02df merges NEXT parent 2457dc6ae8022a6ece92dda9e315b040b190555d; the holder implementation and focused tests are unchanged from the tested head above. The state-root check fails on the existing prompt_uploads.rs:345 fixture in current checks. The same check failed in comparison run 40513802390; the fixture, checker and baseline file are byte-identical across that source, the current NEXT parent and this head. The package-convention comparison also fails on existing source; its diagnostic differs and is not claimed identical.
Changelog
- Add the private local Codex auth-holder process needed for cloud credential brokering.
Agent session: agent session