[teamleaderleo]

Summary

Codex authentication recovery now uses the account-scoped refresh broker after confirmation. This Mac remains the single refresh-token holder; only a short-lived access token is delivered to the selected VM. The native device-code prompt is cancellable, bounded, and shows the code in cmux instead of a VM terminal. Claude recovery remains unchanged.

The recovery dialog explains exactly what moves and reminds the user to keep cmux running on this Mac so the broker can renew access. Cancellation, dismissal, logout, and scope changes stop the in-flight prompt without retrying the failed turn. Debug-only fixtures and focused tests cover cancellation, already-cancelled tasks, browser handoff, and successful retry.

Dependencies

The broker and auth-recovery prerequisites have landed. This auth-only follow-up is based on NEXT at 1c1632b0eb6f53b647adf485914d21a67c1cd74f; it preserves the native backend availability check and the account, team, tab, session, and daemon guards from #26148. The wizard switch is separate.

Operational rules

The OpenAI CI/CD auth guidance says:

“Use one auth.json per runner or per serialized workflow stream.”

“Do not share the same file across concurrent jobs or multiple machines.”

The broker follows those rules by keeping refresh state on the user's Mac, serializing refreshes, and delivering only short-lived access to confirmed VMs. It never copies a shared refresh seed into a VM, writes credentials to the repository, or prints them to logs.

Note coverage

This addresses the setup note “Claude failed to authenticate” and the requirement to make “manual transfer claude credentials to VM” explicit and confirmed. Codex recovery now has the same one-click, user-confirmed path while stating that its refresh credential stays on the Mac.

Validation

• prepush-gate.py --base 1c1632b0eb6f53b647adf485914d21a67c1cd74f — pass (no new violations; app-size warnings only).
• Catalog validation passes; all seven new keys include all 21 locales.
• Focused fleet verification at cde52914522c43d0644641163b93d19d87c5fa42: CloudCodexDeviceRecoveryTests, CloudCredentialRecoveryTests, and CloudCodexBrokerAdapterTests, cmux-ci step 33a791a56a95b31fe3aeda26: PASS (exit 0); app/test package compiled and all three suites passed.
• The device prompt has no timer. Its user-answer stream is bounded to one answer; cancellation and scope changes dismiss it, and deferred cleanup finishes the stream.

Native UI evidence

Native cmux app captures at cde52914522c43d0644641163b93d19d87c5fa42, artifact job 2ea571994eaade549d021b8f. The before fixture reproduces the prior disclosure text from 1c1632b0eb6f; it is not an execution of that base build. The after disclosure and device-code prompt use the production native dialog specs. All fixtures are inert; no real credentials or sign-in were used. Capture privacy checks passed.

Before — previous per-VM disclosure (inert reconstruction of existing text)

Light	Dark

After — broker disclosure

Light	Dark

After — native device-code prompt (synthetic DEMO-CODE)

Light	Dark

Review (codex gpt-6-astra xhigh, review-26211): SHIP at cde5291. No findings.

Agent session: agent session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cmux-bot]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Not verified: macOS jobs did not run: compile and app tests were skipped on cde5291452; ci-status is green without them.

CI passes on cde5291452 (run 40574138581 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Bead cx-h1njnn created for this PR by the cmux coordinator.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40581569324 at afa75ae failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 1c1632b. This pull request is one of 4 merged since: #26267, #26143, #26211, #26333.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40577589011 at 20b8793 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 1c1632b. This pull request is one of 3 merged since: #26267, #26143, #26211.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4059411161803 (cc0d757245)