Cloud sign-in: one Sign in to Claude click starts the login and opens its page

Merged
TE
2d ago
+171-35

Leo (2026-11-02), on Cloud sign-in: "yeah that should be fine right? cuz man i dont wanna be liable for peoples' subscription tokns". cmux keeps no Claude or ChatGPT subscription token. The sign-in finishes through the provider's own flow, in the unmodified claude or codex binary on the person's machine, behind one "Sign in to Claude" button.

What changes

One click, not two. Before, the card's "Sign in to Claude" click started the login on the machine (_acpmux/agent_login/start), and a second click ("Open sign-in page") opened the provider page. The root cause was in the host: each user gesture gives one grant credit, the start used it, and browser.openIn for the page needed a second credit. Now a start that the person's gesture granted leaves a credit for one browser.openIn (cmux tab) of that login's provider page (AgentPaneSignInPage.swift). The credit only covers https pages on the provider sign-in hosts (the same list as acpmux's agent_login::parse::ALLOWED_HOSTS and the page's SIGN_IN_HOSTS), on the same connection, once, within 90 s. Any other URL leaves the credit unspent. The card calls open as soon as the start answers. "Open sign-in page" stays as a secondary button for reopening the page.

Codex. The same single click opens the device page, and the device code is copied to the clipboard as the start answers ("Copied" shows; Copy code stays).

Use an API key is a link next to the one sign-in button, not a second button. A team machine and a chat on this Mac have only the key, so there it stays a button.

What the person does now

  • Claude: 1 click (Sign in to Claude) → approve on Claude's page → paste the code it shows → Continue.
  • Codex: 1 click (Sign in to Codex) → paste the copied code on OpenAI's page and approve. The card notices by itself.

Why the Claude code paste stays (for now)

claude auth login --claudeai on a headless machine prints a manual URL whose redirect_uri is https://platform.claude.com/oauth/code/callback. That page shows a code#state for the CLI's stdin. The CLI's automatic localhost callback only gets the URL it hands its browser opener (BROWSER), and that redirects to http://localhost:<port>/callback on the machine. Dropping the paste needs one of these:

  1. A same-port forward of this Mac's localhost to the machine's port, plus acpmux capturing the automatic URL through a BROWSER shim. cmux would then carry only TCP bytes to the person's own CLI. This keeps cmux furthest from the credential, but it is a cross-layer change (acpmux, the Cloud port forward with a pinned local port, and a fallback when that port is busy on the Mac). It gets its own PR.
  2. Reading the code from the in-app browser tab's callback URL. That has cmux scrape the authorization code out of Anthropic's page, which is closer to "intermediating" than the person pasting it into their own CLI. Not taken.

Until then the paste goes from the card straight to the CLI's stdin on the person's machine. cmux stores nothing and logs nothing (unchanged from today).

Tests

  • webviews/test/cloud-signin-card.test.tsx: one click opens the page (Claude and Codex), Codex's code is copied, the reopen button is secondary, and Use an API key is a link.
  • AgentPaneSignInPageTests: only a start the person's gesture granted leaves the credit. It opens one provider page, once, within its lifetime. Other hosts, http, a port or user info never spend it.
  • Gallery: agent-pane.transcript-type gets a new claude-sign-in variant (the one-button card), and the claude-code-entry and codex-code notes are updated.

Risk: small. The host change grants one extra open of a provider sign-in page after a start the person clicked, and nothing else.

Agent session: agent session

🤖 Generated with Claude Code

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Cloud sign-in is now one click: "Sign in to Claude" (or Codex) starts the login on the machine and opens the provider's sign-in page at the same time, instead of needing a second "Open sign-in page" click.

  • A start that the person's click granted leaves the host one open of that login's provider page: https only, on the provider sign-in hosts, within 90 s, on the same connection. Any other URL leaves the credit unspent; "Open sign-in page" stays as a secondary button for reopening it.
  • Codex's device code is copied to the clipboard as the login starts.
  • "Use an API key" is now a link beside the sign-in button, not a second button; it stays a button on key-only machines.
  • cmux still stores no Claude or ChatGPT subscription token: the sign-in finishes in the person's own claude or codex binary. Claude's page still asks for a code to paste back; the automatic localhost callback is deferred (it needs a same-port forward plus a BROWSER shim).