cloud-setup: add native Codex refresh broker client
Adds the native Codex broker lifecycle used by Cloud setup: one scoped holder, device-code login, access-only delivery to owner VMs, serialized refresh and renewal across registered VMs. Refresh credentials remain in the dedicated local holder. cmux must stay running on the user's Mac to renew VM access.
The target transport/model prerequisite is #26269. This PR is now 846 lines, based on da68f64d0e81bafc60fa9a8898e8e58bb7ba703e; subsequent review repairs reconcile an uncertain commit by its unique installation receipt, unregister abandoned login polling, guard revocation against unowned auth modes, and retry recoverable renewal failures at most three times with bounded backoff. The private-pipe transport (#26191) and holder CLI (#26142) are already on NEXT. The daemon bridge provides the advertised capability and consumes the access-only file; the App adapter and wizard are separate dependents.
A paused VM stays paused: failed preflight does not issue cleanup file requests before staging. Foreground refresh leaves active renewal delivery intact. A pending revocation blocks re-registration. Revoking a failed first delivery clears its saved mode so a later transfer snapshots the current VM mode. Scheduling requires at least one registered target, preventing an in-flight refresh from restarting renewal after the last target is revoked. Partial revocation and interrupted committed delivery retain an access-removal receipt until prior mode restoration succeeds. Failed installation preserves the existing grant, while a completed transfer interrupted by logout/cancellation removes delivered access and restores the prior mode. Already-issued access may remain valid until provider expiry.
Relevant notes:
Setup wizard
New cloud workspace
Figure out what you want to transfer into the api key from current machine to new machine.. claude setup-token
Always need new claude credentials, that kind of suck
Support vm that are empty without repositories as well…
Official operational rules:
Use one auth.json per runner or per serialized workflow stream.
Do not share the same file across concurrent jobs or multiple machines.
Codex account auth in CI/CD also requires retaining refreshed state and keeping credentials out of repositories, logs and artifacts. VMs receive short-lived access only.
Validation target: 4da61f425a36e4e4b7abfd0a4d40efad7e5e5fd5.
- Whole-PR prepush gate passed against the transport/model base;
pr-overlapreported only this PR. - The split originally preserved the pre-split source; the current head adds focused security/lifecycle regressions. Static checks are not compilation evidence.
- Focused regressions cover owner/consent checks, multi-VM renewal with foreground refresh/revocation, dead-holder recovery, pending revocation, failed installation, paused preflight, cancellation/logout during commit, and a failed mode restoration followed by successful revoke retry, and a failed first delivery followed by a changed-mode transfer/revoke. The empty-target scheduling guard was inspected directly; it has no separate timer regression. Combined exact-stack cmux-ci run
0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7(stepbbc58714e6ed0d379fa0dca8) exited 0: App/test compile plus eight suites and 57 tests. Focused rerun for the serialized broker matrix: step4af5876ef7d092457abafba9, run summary SHA25647d416c578cda502394718b1ae0e7d974504a44c1cef5799c125c497858a28d, exited 0 with all 14 cases passing in 6.426 seconds. Independent xhigh review remains coordinated with the complete stack.
No capture: this domain lifecycle code has no rendered interface. No visible UI is added in this domain-service PR.
Agent session: agent session