Cloud: a Codex chat's start runs the Mac's broker before the first prompt

TE
3d ago
+140-41

Fixes #33489.

When a chat starts, the credential transfer skips Codex, and failed-turn recovery only knows about Claude. So the first Codex prompt on a Cloud machine fails until the person goes through the turn card's broker login.

What changed

  • Rules (Rust, cmux-cloud-start-core harness_login): a Codex start no longer stops at no-transfer-for-harness. It goes through the same checks as Claude's (build gate, signed in, the caller owns the machine, the none choice) on an owner guest only: a team guest keeps its team login, since acpmux's Codex bridge refuses broker access there) and answers install (codex-broker). It reads no Claude login probe and asks no confirm of its own: the broker shows its own device-code sign-in (with Cancel and its scope disclosure) only when the Mac holds no Codex login for this account, and otherwise delivers short-lived access silently. Release keeps Codex out, as the Account wizard already does (the broker is DEV and dogfood only; the Release consent covers the Claude login alone). --login machine keeps the machine's own sign-in, and a run that can show no prompt passes nothing rather than refusing the start.
  • App (thin forwarding): CloudStartChat.passHarnessLogin reads the guest kind for Codex too, skips the Claude-only machine login probe for it, and forwards the install to CloudCodexBrokerAdapter.run (the same call the turn card's recovery and the Account wizard make). CloudHarnessLoginDecision.Reason gains codex-broker. A machine the broker already serves for this account is left alone (CloudCodexBrokerAdapter.delivers), so a failed repeat transfer can never revoke the access its other Codex chats use. cmux cloud start-session passes no device-code prompt: a scripted run never waits on one, and with no broker login on the Mac it opens the session as before. CmuxNextApp lines: -1.
  • Test: a_codex_start_runs_the_broker_before_the_first_prompt fails on base (Codex was skip (no-transfer-for-harness)) and passes here; the existing tests that pinned the old Codex skip are updated.

Automatic failed-turn recovery for Codex (the turn card's silent path, which stays Claude-only) is not changed here: with the start delivering access, the first prompt no longer needs it.

Overlap: #30171 (capture-only integration PR) touches CloudStartChat+Login.swift; nothing here conflicts with its intent. The quit/update revoke path (#33482) is not touched.

Risk: low-medium. DEV and dogfood builds only; a Codex start on the person's own machine may now show the broker's device-code dialog before the chat opens when the Mac has no Codex login yet (Cancel opens the chat as before). Release is unchanged.

Agent session: agent session

🤖 Generated with Claude Code

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes #33489: a Codex chat's start now runs the Mac's broker before the first prompt, so the first Codex prompt on a Cloud machine no longer fails when no login has been transferred.

  • The harness login rules now let a Codex start through the same checks as Claude's and return install (codex-broker), with no Claude login probe and no extra confirm.
  • The app forwards the install to the broker adapter; a run that may show no prompt passes nothing instead of refusing, and Release builds keep Codex out.