fix(setup): report actionable harness authentication checks

TE
7d ago
+319-12

HOLD: Wait for swift test, fast tier, and release compile to pass; compare the action export failure against base.

Provider configuration and protocol failures in cmux setup harness currently report state: "ok" with no recovery action. This adds typed auth_status and recovery fields to the existing harness rows in both setup commands. Signed-out profiles retain their profile-specific login command; verification failures become needs_user with a quoted, no-prompt diagnostic command.

detected describes sign-in or provider-configuration evidence, not token freshness or the expected account. Expiry and wrong-account diagnosis still require provider evidence. Risk: callers that interpreted all unknown checks as ready now see explicit check failures as actionable; deliberately unavailable Keychain/disabled-launch checks keep their current behavior. Setup still performs no install, login, refresh, or configuration writes.

Leo’s request:

Also, we need to be fixing authentication issues, like the whole onboarding situation. Is that in? What does you improve? What does you fix? The edge cases, like you guys need to be comprehensively brainstorming all the onboarding edge cases: foot guns, paper cuts, snags, clips, whatever the fuck.

Testing

Observed / Not run

  • Before the implementation, four new integration tests failed on the missing JSON fields; provider and protocol errors also returned state: "ok" (run 40636172209).
  • Final fleet command: cmux-ci test --setup rust -- cargo test -p cmux-tui --test setup cmux_setup_harness_auth_ --locked (run 40637391751, 7 passed for baee66e91983457c95e4d784116262c10817b633).
  • Broader harness run 40636678544 passed nine cases. Its custom-profile fixture selected the first discovered harness and is now corrected; the existing setup task-list assertion at tests/setup.rs:926 also fails because it omits the already-shipped tailnet check. That baseline failure is outside this change.
  • Independent Astra HIGH review: SHIP on baee66e91983457c95e4d784116262c10817b633; the disabled explicit-check edge found during review is fixed and covered.
  • python3 scripts/verify-local.py, the NEXT prepush gate, formatting, and diff checks passed.
  • Localization audit: scripts/localize-changes --base 7242a82b4a8e3c52d41413457a4cdb40f237eb56 passed; no changed catalog keys. Changes are machine-readable setup diagnostics and the developer contract.
  • Fixtures cover Claude, Codex, OpenCode, explicit auth-required, provider configuration, protocol errors, timeouts, quoted profile IDs, JSON recovery parity, conservative Keychain behavior, and both disabled-launch switches with an explicit profile auth check. No live credentials or real provider calls were used. Token freshness and account identity were not verified.

Changelog

Fixed: Harness setup reports explicit authentication-check failures with profile-specific recovery commands.

Proof

No capture: CLI JSON only. A protocol failure changes from signed_in: null, state: "ok", user_action: null to signed_in: null, auth_status: "needs_action", state: "needs_user" with recovery.command: "cmux harness doctor work-opencode --no-prompt --json".

Agent session: agent session