[teamleaderleo]

Connects the Codex broker to the app’s Cloud lifetime. Wizard and authentication recovery callers receive one confirmed transfer API with a native device-code prompt callback. A private, stable directory per user/team retains the local rotating credential across VMs and app restarts; VMs receive only short-lived access. cmux must remain running on the user’s Mac to renew access.

CloudService owns the adapter and fences transfers during policy disable, account/team changes, sign-out, VM removal, and app shutdown. Concurrent first-time transfers share one login flow. Retirement remains a shared barrier until cleanup finishes, and failed cleanup retains its target, installation receipt, and previous authentication mode for retry. Paused VMs are not resumed. Successful server deletion is the only path that discards a VM’s pending cleanup without restoring its files.

Quit cleanup runs across targets and scopes in parallel. A three-second deadline bounds the caller’s wait while uncancelled remote cleanup retains its lock until the mutation finishes. Renewal and local holders stop; already-issued access remains valid until provider expiry. Policy re-enable reuses the persisted holder after cleanup succeeds.

Based on NEXT at 9aa29f072741227f3e5dde78b732ac9732414abf, which includes landed #26170 and #26311; model/target dependency #26269 and holder shutdown follow-up #26311 are covered by the combined verification below. Wizard/auth prompt wiring lands separately. No capture: this PR adds lifecycle and domain coordination; it adds no rendered interface or changes to existing login entry points.

Relevant notes:

Setup wizard
New cloud workspace
Figure out what you want to transfer into the api key from current machine to new machine.. claude setup-token
Always need new claude credentials, that kind of suck
Claude failed to authenticate

Official operational rules:

Use one auth.json per runner or per serialized workflow stream.
Do not share the same file across concurrent jobs or multiple machines.

Maintain Codex account auth in CI/CD also requires retaining refreshed auth state and keeping it out of repositories, logs, and public artifacts. The dedicated local holder follows those rules.

Observed / Not run

• Validation head: e64a38dce1e40163c50b7b4e714f53186dc00e0d. Whole-PR prepush gate passed against the stacked base; overlap check found no competing implementation.
• Combined integration 0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7 covers the preceding adapter source at cedae931827d792896616a7807a7d4546682ac23 plus native 1a080e68028745b7e2efe8550f9892c13ab5ebbb and pipe 8be44060fa90a9dd066ffba11e7a747295cf01a8. cmux-ci step bbc58714e6ed0d379fa0dca8 compiled app/test targets and exited 0. All eight suites passed (57 tests): CloudUI 17, workspace lifecycle 3, target 4, native broker 7, pipe 5, adapter 15, credential recovery 3, Codex recovery 3.
• The preceding adapter’s 15 tests cover consent cancellation, scope separation/change, reuse after restart, policy fencing, concurrent first login, removal during consent, paused cleanup and retry, confirmed deletion, bounded parallel quit without cancelling remote mutations, and accurate pending-cleanup warnings.
• Command: cmux-ci run --class light --script scripts/ci/package-test-lane.sh --ref 0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7 --arg suite --arg Packages/macOS/CmuxNext --arg CmuxNextCloudUITests --arg CloudWorkspaceSetupLifecycleTests --arg CloudCodexBrokerTargetTests --arg CloudCodexBrokerTests --arg CloudCodexBrokerSessionTests --arg CloudCodexBrokerAdapterTests --arg CloudCredentialRecoveryTests --arg CloudCodexDeviceRecoveryTests.
• Receipt: cmux-ci artifact bbc58714e6ed0d379fa0dca8 OUTPUT --summary; SHA-256 561d5fe046927fc7c754ac0dba7324639d249f8dd940c18f802c72b4521429bf.
• New regression: failure-cleanup reaching its 30-second UI deadline must not cancel the remote deletion task. The task is now retained until its reply; this regression passed in step 963669da742683a8ccf52736 on integration b233271e11c21190adfeb8d055e89961af3fc805 (app/test compile, native 7, pipe 5, adapter 16 tests; exit 0). After native receipt changes, confirmed deletion also clears uncertain-installation and staging receipts. Integrated verification at 5a2ddffa618889b0aa9fc4c4dc831c515f3c2695, step 9cab64c64e209a6e03ded5ec, compiled successfully. Cloud UI, workspace lifecycle, session, adapter (16 tests), credential recovery, and Codex device recovery suites passed. The native suite initially failed under the parallel process-backed matrix before staging. The test-only serialization repair at native 4da61f425a3698913581dcc3c3dc09b1b676cac3 passed focused step 4af5876ef7d092457abafba9: app/test compile and all 7 native tests, including all 14 interruption cases. Summary SHA-256: 47d416c578cda502394718b1ae0e7d974504a44c1cef5799c125c497858a28d7. Production source is unchanged by that test-only repair. Summary SHA-256: 8316709075e579f8aae328fd98f8dcc111361301bc8065ecc752c07f4a701945. The earlier step 239cb1d9b2066b4b19767004 was cancelled as superseded. The regression was not executed on the deliberately broken intermediate commit.
• No live provider account or actual VM end-to-end transfer was exercised. Exact-head independent xhigh review remains pending.

Agent session: agent session

[teamleaderleo]

Owned by an agent session · session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Bead cx-4jn2qt created for this PR by the cmux coordinator.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review e64a38d: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26212 -f ref=cloud-setup-codex-broker-adapter -f platform=macos -f backend_mode=local

Not verified: macOS jobs did not run: compile and app tests were skipped on e64a38dce1; ci-status is green without them.

CI passes on e64a38dce1 (run 40572989447 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40573137908 at 88484f9 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 9aa29f0. This pull request is one of 1 merged since: #26212.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4059411161803 (cc0d757245)