cloud-setup: connect Codex broker to app lifetime

Merged
TE
10d ago
+817-3

Connects the Codex broker to the app’s Cloud lifetime. Wizard and authentication recovery callers receive one confirmed transfer API with a native device-code prompt callback. A private, stable directory per user/team retains the local rotating credential across VMs and app restarts; VMs receive only short-lived access. cmux must remain running on the user’s Mac to renew access.

CloudService owns the adapter and fences transfers during policy disable, account/team changes, sign-out, VM removal, and app shutdown. Concurrent first-time transfers share one login flow. Retirement remains a shared barrier until cleanup finishes, and failed cleanup retains its target, installation receipt, and previous authentication mode for retry. Paused VMs are not resumed. Successful server deletion is the only path that discards a VM’s pending cleanup without restoring its files.

Quit cleanup runs across targets and scopes in parallel. A three-second deadline bounds the caller’s wait while uncancelled remote cleanup retains its lock until the mutation finishes. Renewal and local holders stop; already-issued access remains valid until provider expiry. Policy re-enable reuses the persisted holder after cleanup succeeds.

Based on NEXT at 9aa29f072741227f3e5dde78b732ac9732414abf, which includes landed #26170 and #26311; model/target dependency #26269 and holder shutdown follow-up #26311 are covered by the combined verification below. Wizard/auth prompt wiring lands separately. No capture: this PR adds lifecycle and domain coordination; it adds no rendered interface or changes to existing login entry points.

Relevant notes:

Setup wizard
New cloud workspace
Figure out what you want to transfer into the api key from current machine to new machine.. claude setup-token
Always need new claude credentials, that kind of suck
Claude failed to authenticate

Official operational rules:

Use one auth.json per runner or per serialized workflow stream.
Do not share the same file across concurrent jobs or multiple machines.

Maintain Codex account auth in CI/CD also requires retaining refreshed auth state and keeping it out of repositories, logs, and public artifacts. The dedicated local holder follows those rules.

Observed / Not run

  • Validation head: e64a38dce1e40163c50b7b4e714f53186dc00e0d. Whole-PR prepush gate passed against the stacked base; overlap check found no competing implementation.
  • Combined integration 0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7 covers the preceding adapter source at cedae931827d792896616a7807a7d4546682ac23 plus native 1a080e68028745b7e2efe8550f9892c13ab5ebbb and pipe 8be44060fa90a9dd066ffba11e7a747295cf01a8. cmux-ci step bbc58714e6ed0d379fa0dca8 compiled app/test targets and exited 0. All eight suites passed (57 tests): CloudUI 17, workspace lifecycle 3, target 4, native broker 7, pipe 5, adapter 15, credential recovery 3, Codex recovery 3.
  • The preceding adapter’s 15 tests cover consent cancellation, scope separation/change, reuse after restart, policy fencing, concurrent first login, removal during consent, paused cleanup and retry, confirmed deletion, bounded parallel quit without cancelling remote mutations, and accurate pending-cleanup warnings.
  • Command: cmux-ci run --class light --script scripts/ci/package-test-lane.sh --ref 0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7 --arg suite --arg Packages/macOS/CmuxNext --arg CmuxNextCloudUITests --arg CloudWorkspaceSetupLifecycleTests --arg CloudCodexBrokerTargetTests --arg CloudCodexBrokerTests --arg CloudCodexBrokerSessionTests --arg CloudCodexBrokerAdapterTests --arg CloudCredentialRecoveryTests --arg CloudCodexDeviceRecoveryTests.
  • Receipt: cmux-ci artifact bbc58714e6ed0d379fa0dca8 OUTPUT --summary; SHA-256 561d5fe046927fc7c754ac0dba7324639d249f8dd940c18f802c72b4521429bf.
  • New regression: failure-cleanup reaching its 30-second UI deadline must not cancel the remote deletion task. The task is now retained until its reply; this regression passed in step 963669da742683a8ccf52736 on integration b233271e11c21190adfeb8d055e89961af3fc805 (app/test compile, native 7, pipe 5, adapter 16 tests; exit 0). After native receipt changes, confirmed deletion also clears uncertain-installation and staging receipts. Integrated verification at 5a2ddffa618889b0aa9fc4c4dc831c515f3c2695, step 9cab64c64e209a6e03ded5ec, compiled successfully. Cloud UI, workspace lifecycle, session, adapter (16 tests), credential recovery, and Codex device recovery suites passed. The native suite initially failed under the parallel process-backed matrix before staging. The test-only serialization repair at native 4da61f425a3698913581dcc3c3dc09b1b676cac3 passed focused step 4af5876ef7d092457abafba9: app/test compile and all 7 native tests, including all 14 interruption cases. Summary SHA-256: 47d416c578cda502394718b1ae0e7d974504a44c1cef5799c125c497858a28d7. Production source is unchanged by that test-only repair. Summary SHA-256: 8316709075e579f8aae328fd98f8dcc111361301bc8065ecc752c07f4a701945. The earlier step 239cb1d9b2066b4b19767004 was cancelled as superseded. The regression was not executed on the deliberately broken intermediate commit.
  • No live provider account or actual VM end-to-end transfer was exercised. Exact-head independent xhigh review remains pending.

Agent session: agent session