Tighten welcome, cmux-cua build, and codex wrapper follow-ups

Resources/bin/cmux-codex-wrapper

@@ -376,6 +376,9 @@ cmux_codex_emit_computer_use_args() {
     # ownership, daemon credentials, and the installed approval broker.
     cmux_computer_use_surface_socket_available || return 0
     local client default_session runtime_scope runtime_uid cua_socket state_dir auth_token
+    # Read the uid in this shell first: the helpers below run in command
+    # substitutions, so a uid they cache would not survive back here.
+    cmux_codex_wrapper_effective_uid || return 1
     client="$(cmux_computer_use_resolve_client)" || return 1
     auth_token="$(cmux_computer_use_auth_token)" || return 1
     # Stable per-terminal session id so the branded cursor survives helper restarts.
@@ -387,7 +390,6 @@ cmux_codex_emit_computer_use_args() {
         runtime_scope="$(printf '%s' "$runtime_scope" | LC_ALL=C /usr/bin/tr -c 'A-Za-z0-9_.-' '-' | /usr/bin/sed -E 's/^[.-]+//; s/[.-]+$//' | /usr/bin/cut -c1-64)"
     fi
     [[ -n "$runtime_scope" ]] || runtime_scope="default"
-    cmux_codex_wrapper_effective_uid || return 1
     runtime_uid="$cmux_codex_wrapper_uid"
     cua_socket="${CMUX_CUA_CODEX_SOCKET_PATH:-/tmp/cmux-cua-${runtime_uid}/${runtime_scope}/cmux-cua-codex.sock}"
     state_dir="${CMUX_CUA_STATE_DIR:-${HOME}/Library/Application Support/cmux/cmux-cua/runtime/${runtime_scope}/state}"

Sources/TabManager.swift

@@ -1389,7 +1389,12 @@ class TabManager: ObservableObject {
             let insertIndex = newTabInsertIndex(snapshot: snapshot, placementOverride: placementOverride)
             var welcomeDelivery: WelcomeBannerDelivery?
             var resolvedInitialTerminalEnvironment = initialTerminalEnvironment
+            // An explicit command runs via `shell -lc`, which never loads cmux's
+            // interactive shell integration, so it could not print the banner.
+            let hasInitialTerminalCommand = !(initialTerminalCommand?
+                .trimmingCharacters(in: .whitespacesAndNewlines).isEmpty ?? true)
             if autoWelcomeIfNeeded && select && initialSurface == .terminal
+                && !hasInitialTerminalCommand
                 && !UserDefaults.standard.bool(forKey: AccountCatalogSection().welcomeShown.userDefaultsKey) {
                 let launch = WelcomeBannerDelivery.prepareLaunch(welcomeBannerDeliveryResolver())
                 welcomeDelivery = launch.delivery

scripts/build-cmux-cua.sh

@@ -14,7 +14,7 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # Append rather than prepend: tools the caller already put on PATH (a pinned
 # toolchain, or the fake git/cargo in tests/test_cmux_cua_build_cache_safety.py)
 # must keep precedence over Homebrew's copies.
-export PATH="${PATH}:${CARGO_HOME:-${HOME}/.cargo}/bin:/opt/homebrew/bin:/usr/local/bin"
+export PATH="${PATH:+${PATH}:}${CARGO_HOME:-${HOME}/.cargo}/bin:/opt/homebrew/bin:/usr/local/bin"
 
 OUTPUT=""
 ARCHS_RAW=""

tests/test_ci_homebrew_cask_macos_dependency.sh

@@ -50,7 +50,7 @@ for file in "${FILES[@]}"; do
         sub(/[[:space:]]*$/, "")
         print
       }
-    ' "$file" | sort -u
+    ' "$file"
   )"
   symbol_count="$(printf '%s\n' "$symbols" | sed '/^$/d' | wc -l | tr -d ' ')"
   if [ "$symbol_count" -ne 1 ]; then

tests/test_shell_welcome_banner_startup.py

@@ -103,7 +103,7 @@ def source(env: dict[str, str]) -> str:
             env[ENV_KEY] = str(token)
             env["TMUX"] = "/tmp/tmux-test/default,1,0"
             output = source(env)
-            if output.count(BANNER) != 0 or "after=unset" not in output:
+            if output.count(BANNER) != 0 or "after=unset" not in output or token.exists():
                 print(f"FAIL: {shell} printed the banner inside tmux")
                 print(output)
                 return 1