cloud-setup: typed private-pipe Codex holder transport
Adds the typed private-pipe transport used by the native Codex credential broker in #26170. It launches the single-holder CLI from #26142 with a dedicated CODEX_HOME, carries device-code and short-lived access replies in memory, bounds reply size, and resolves pending requests when the holder exits. No refresh credential goes to a VM, diagnostic output, or process arguments.
This is the first piece of the native client split. #26170 contains the runtime caller, confirmed owner-VM delivery, renewal, and revocation. The wizard stays unchanged until the full stack is integrated.
Relevant notes:
“Setup wizard / New cloud workspace”
“Always need new claude credentials, that kind of suck”
Official operational rules:
“Use one auth.json per runner or per serialized workflow stream.”
“Do not share the same file across concurrent jobs or multiple machines.”
The holder preserves its refreshed cache between uses, and keeps it out of source control, logs, and public artifacts. Official Codex CI/CD auth guide.
Limitation: cmux must remain running on the user’s Mac to renew VM access. Delivered access tokens remain usable until provider expiry after renewal stops.
Validation: current head is f0eeaa387a3030db9df849148168fb9f2b8f4b63, rebased onto landed holder ecf43b7cc1061d8a95bff30f489d6097508ce72a. Whole-PR architecture/static gate passed. The five review findings are repaired: structured account-change errors, timeout mapping, per-request cancellation, awaited child shutdown, and allowlisted TLS/temporary-directory environment. Dedicated Swift lifecycle tests were added. Pre-fix run bde956c7daa19e53ea1cca7b reproduced the behavior failures; final Swift verification uses the combined native/adapter/recovery stack and is pending. Focused Rust holder tests passed in b31ec04c678eecb2b28b40fa on pre-rebase 396bf05c71f8f3887c261644766da8863d4fe178; the Rust files are unchanged after the rebase. A final Swift fix drains the holder’s last timeout reply before EOF settlement; its fixture exits immediately after writing the reply. Independent exact-head xhigh re-review is pending; the previous head was BLOCK. This PR is not a completed user flow by itself.
Review (codex gpt-6-astra xhigh, review-26191): SHIP at f0eeaa387a3030db9df849148168fb9f2b8f4b63
Agent session: agent session