cloud: bridge owner-VM Codex access grants
cloud-setup: bridge Codex short-lived access into owner VMs
A cloud workspace can consume a short-lived Codex access grant without receiving the rotating refresh credential. This adds the owner-VM half of the broker: a private versioned access file, an advertised capability, and the app-server external-auth startup/refresh bridge.
The bridge validates the VM owner boundary, file owner/mode/version/lifetime, pins the ChatGPT account, gates startup until external login succeeds, revalidates grants before releasing queued work, forwards cancellation while revocation settles, and redacts credentials from protocol journals. An absent file preserves the existing login path; invalid, revoked or mismatched grants fail closed. A refresh seed is never written to or read by the VM.
This is a prerequisite for the native broker delivery in #26170 and local holder in #26142. The native owner must proactively renew files while connected; this bridge does not request a fresh grant from the owner on demand. A provider rejection before the next grant arrives returns a stable error. Issued access tokens remain valid until provider expiry; revoking the file prevents subsequent broker-backed work.
Relevant setup notes: “New cloud workspace”, “Figure out what you want to transfer into the api key from current machine to new machine.. claude setup-token”, and “Always need new claude credentials, that kind of suck”.
The official CI/CD authentication rules say “Use one auth.json per runner or per serialized workflow stream.” and “Do not share the same file across concurrent jobs or multiple machines.” The holder retains Codex's refreshed cache and serializes rotation; VMs receive only the access-token shape through the separate external-token app-server contract.
Validation: pre-clippy head a2cdac614f9abeb4f4301166b98e46753ab9fa6b passed the whole-PR static gate and cmux-ci step 658eccd9f72caefce44a9860: 10 tests, zero failures/flakes, no leaks. This includes direction-aware reverse permission denial, cancellation during pending login, background termination responses during renewal, and the earlier request-settlement cases. The three new routing regressions failed as expected before repair at 720868d18833912cf0c190b03c1c4fab5b30f7f1 in step 93876016805197c555f88cb8 (8 prior acpmux/platform tests passed); the earlier two failure-settlement regressions likewise reproduced at 197e223024d87a32d207d0dc148f136fcead0a34 in step 772a00158234bb17582cc4ab. Constructor-only reply tests were consolidated into actual dispatch coverage. pr-overlap found shared acpmux files but no duplicate credential bridge. The handoff contract is in cmux-tui/docs/codex-cloud-broker.md.
Observed / Not run: live provider login and multi-VM runtime smoke are not yet exercised. App wiring remains in the separate native adapter change.
Current head 2deb41fba4ff380b94c44401acd348a66c156989 contains the three clippy repairs plus the three stale test call-site renames that all-targets clippy exposed. Exact all-targets clippy passed through cmux-ci run 40542954435 (receipt 0fae1a7b8e8c4b66997ca2cc2515d57d.json). Independent xhigh re-review of this exact head is pending; prior SHIP applies only to a2cdac614f9abeb4f4301166b98e46753ab9fa6b.
Agent session: agent session