fix(cmux-next): recover Cloud agent authentication safely
HOLD: Webview merges wait for the base react-apps-check suite to restore test signal.
Cloud authentication errors identify missing, expired/revoked, or rejected credentials and offer confirmed setup for the current chat's VM. Native machine context supplies the provider VM ID; daemon summaries and registry UUIDs are not used as VM IDs. Recovery restarts that chat's agent through the VM's installed CLI before retrying its failed prompt, and never sends the old prompt to a different chat after navigation. A failed or deferred restart leaves the prompt unsent and explains the next step. Provider login opens on this Mac, including when every open workspace is remote. The retry keeps the original click’s single-use ticket, bound to its session and prompt; it retains its expiry and cannot authorize another send.
"Claude failed to authenticate"
"Claude code is not set up in… steal credentials"
"Always need new claude credentials, that kind of suck"
Claude uses claude setup-token; Codex currently requires a fresh device login for each VM. The confirmation shows which provider, account, and VM receive credentials. Codex refresh credentials are never reused across VMs.
Official operational rule: “Use one auth.json per runner or per serialized workflow stream. Do not share the same file across concurrent jobs or multiple machines.” Codex CI/CD authentication.
Base: feat-cmux-next at 86ebb89edfcff8d398b0e44a91cbf06c277d5de5; credential transfer dependency #26139 is landed. The focused card suite passes on base (17 tests) and the repaired implementation (20 tests). Full type checking and lint pass with zero warnings or errors (focused run 40510618509). Full web check 40512041340 stops at the unchanged gallery font-size violation in SendScrollSetting.gallery.tsx:71, also reproduced on base in 40501809958. The focused checks run independently so this base failure does not hide the changed surface’s tests, type checking, or lint. The website shard also fails two generated CLI/settings documentation freshness assertions. Run 40518390276 executes the original web/tests/next-docs.test.ts against files archived from base f04356fe79a59de967ca1e4867ad96de8a7b76f0 and reproduces both failures (3 pass, 2 fail); all of that test’s inputs are unchanged by this PR. Native stack step 600a3db4af70c93d3965e4da passed the full package compile and four focused suites at earlier head 843112fa3591dc6139854a94c4bbae47c13fedcc. Current head additionally localizes the recovery confirmation and advertises availability in the gallery fixtures; the focused native verification is included in the final combined stack run.
The existing glass error card remains the selected presentation; gallery variants cover missing, expired, and rejected Cloud credentials. Before/after capture is attached below. Capture route: agent-pane.turn-error-card/cloud-missing, cloud-expired, and cloud-rejected at the exact head. Design references: cmux-design-references/apps/claude/live/first-run-sign-in.png and code-home-after-login.png.
Risk: recovery changes provider credentials for the owner VM and restarts the selected agent. Confirmation is mandatory and automation cannot approve it; team/shared images fail closed. App-server machines retain their error context but do not offer this legacy-backend transfer action. The restart targets one session, has a five-minute request deadline, and never restarts the daemon. The retry ticket expires after ten minutes; an expired ticket uses the existing unsent-prompt Retry action for a fresh click. Refused recovery or changed native context removes its reserved ticket. Older VM layouts without the installed work-user CLI require updating the machine before recovery can restart the chat.
Gallery: agent-pane.turn-error-card/agent-closed, agent-pane.turn-error-card/cloud-missing, agent-pane.turn-error-card/cloud-expired, agent-pane.turn-error-card/cloud-rejected
Agent session: agent session
Auth card replacement evidence for PR #26148.
Source: exact head 0aea78beb29419b5d8aee68ac922d25e353a9b70; gallery-advisory run 40544574436, artifact gallery-advisory-26148-0aea78beb29419b5d8aee68ac922d25e353a9b70. Renderer: Chromium gallery render with fallback fonts; not native macOS font evidence.
| Before (generic existing card) | After: missing cloud credential | After: expired cloud credential | After: provider rejected |
|---|---|---|---|
 |  |  |  |
Dark captures: before, missing, expired, rejected.
The three cloud variants now visibly include the one-click Setup Claude Code credentials action. Cloud variants have no base image because these states did not exist on the base. All replacement PNGs passed normal pr-media checks and returned HTTP 200.
Agent session: agent session