[teamleaderleo]

Fixes #33489.

When a chat starts, the credential transfer skips Codex, and failed-turn recovery only knows about Claude. So the first Codex prompt on a Cloud machine fails until the person goes through the turn card's broker login.

What changed

• Rules (Rust, cmux-cloud-start-core harness_login): a Codex start no longer stops at no-transfer-for-harness. It goes through the same checks as Claude's (build gate, signed in, the caller owns the machine, the none choice) on an owner guest only: a team guest keeps its team login, since acpmux's Codex bridge refuses broker access there) and answers install (codex-broker). It reads no Claude login probe and asks no confirm of its own: the broker shows its own device-code sign-in (with Cancel and its scope disclosure) only when the Mac holds no Codex login for this account, and otherwise delivers short-lived access silently. Release keeps Codex out, as the Account wizard already does (the broker is DEV and dogfood only; the Release consent covers the Claude login alone). --login machine keeps the machine's own sign-in, and a run that can show no prompt passes nothing rather than refusing the start.
• App (thin forwarding): CloudStartChat.passHarnessLogin reads the guest kind for Codex too, skips the Claude-only machine login probe for it, and forwards the install to CloudCodexBrokerAdapter.run (the same call the turn card's recovery and the Account wizard make). CloudHarnessLoginDecision.Reason gains codex-broker. A machine the broker already serves for this account is left alone (CloudCodexBrokerAdapter.delivers), so a failed repeat transfer can never revoke the access its other Codex chats use. cmux cloud start-session passes no device-code prompt: a scripted run never waits on one, and with no broker login on the Mac it opens the session as before. CmuxNextApp lines: -1.
• Test: a_codex_start_runs_the_broker_before_the_first_prompt fails on base (Codex was skip (no-transfer-for-harness)) and passes here; the existing tests that pinned the old Codex skip are updated.

Automatic failed-turn recovery for Codex (the turn card's silent path, which stays Claude-only) is not changed here: with the start delivering access, the first prompt no longer needs it.

Overlap: #30171 (capture-only integration PR) touches CloudStartChat+Login.swift; nothing here conflicts with its intent. The quit/update revoke path (#33482) is not touched.

Risk: low-medium. DEV and dogfood builds only; a Codex start on the person's own machine may now show the broker's device-code dialog before the chat opens when the Mac has no Codex login yet (Cancel opens the chat as before). Release is unchanged.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes #33489: a Codex chat's start now runs the Mac's broker before the first prompt, so the first Codex prompt on a Cloud machine no longer fails when no login has been transferred.

• The harness login rules now let a Codex start through the same checks as Claude's and return install (codex-broker), with no Claude login probe and no extra confirm.
• The app forwards the install to the broker adapter; a run that may show no prompt passes nothing instead of refusing, and Release builds keep Codex out.

^{Written for commit 1da462b. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 83d15fb: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33881 -f ref=fix-codex-cloud-first-chat -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 33dc4e8 to compare; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4165528235801 (b08cc6f4d3)
• cmux NEXT nightly 1.0.0-nightly.4165709173201 (7f6fe51cc3)
• cmux NEXT nightly 1.0.0-nightly.4165880669801 (de5076464a)
• cmux NEXT nightly 1.0.0-nightly.4166004947701 (abcde7ea04)

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 8 test failures on Blacksmith runners:

Failures

Test	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='pull_request', path=' skills/cmux-customization/SKILL.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='pull_request', path=' skills/cmux-customization/references/examples.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='pull_request', path=' skills/cmux-customization/references/local-app-views.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='pull_request', path=' skills/cmux-customization/references/viewer-types.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='push', path='skills/ cmux-customization/SKILL.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='push', path='skills/ cmux-customization/references/examples.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='push', path='skills/ cmux-customization/references/local-app-views.md')	View Logs
test_the_workflow_runs_for_every_included_file_outside_cmux_tui (main.Scope.test_th e_workflow_runs_for_every_included_file_outside_cmux_tui) (event='push', path='skills/ cmux-customization/references/viewer-types.md')	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): BLOCK at 5bb7a89

BLOCK at 5bb7a89
Visual verdict: no images; Leo tries the build

1. [P1] [blocking] harness_login.rs:339: let choice = choice(d) at line 319 shadows the function with an Option<Choice>. Calling choice(d) here and at line 341 produces Rust error E0618, preventing the crate and its tests from compiling. Use the existing choice value in both places.

2. [P2] [follow-up] CloudStartChat+Login.swift:57: Supply an after screenshot of the device-code dialog during chat start; none was available to assess the newly introduced presentation path.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): BLOCK at 1da462b

BLOCK at 1da462b
Visual verdict: no images; Leo tries the build

1. [P1] [blocking] harness_login.rs:335 — Keep Codex broker installation off team guests. A team machine’s creator passes the ownership check, and the broker’s capability check permits delivery. However, codex_auth_file.rs:95 requires an owner guest and no /srv/team. Installing access.json therefore makes the Codex bridge fail closed, breaking chats that previously worked through the team login. Require an owner guest before installation and cover this with the guest reader.

2. [P2] [follow-up] CloudStartChat+Login.swift:55 — Forward the caller’s headless context. CloudStartSession uses this method, but the Swift decision request never sends headless, so Rust always sees false. A CLI Codex start without a broker login now waits on the native device-code dialog; the tested headless skip is unreachable through the app.

3. [P2] [follow-up] CloudStartChat+Login.swift:57 — Supply an after screenshot of the device-code dialog during the first Codex start; this newly automatic presentation has no visual evidence.

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): BLOCK at a2c678e

BLOCK at a2c678e

Visual verdict: no images; Leo tries the build

1. [P1] [blocking] CloudStartChat+Login.swift:55: Preserve existing broker access when another chat starts. This automatic call repeats the transfer even when other Codex chats already use it. A transient capability or delivery failure invokes the adapter’s revokeAfterFailure, deleting the existing access file and stopping renewal. Existing chats then fail with “Codex broker unavailable.” Cleanup for a failed new start must preserve previously working access.

2. [P1] [blocking] CloudStartChat+Login.swift:57: Forward the caller’s headless status before enabling this prompt. CloudStartSession also calls this method, but the Swift decision request never serializes headless, so Rust always defaults it to false. A scripted Codex start on an already signed-in VM can now wait indefinitely for a Mac device-code dialog when the broker lacks credentials; base opened the session directly. Wire prompt availability through to the Rust guard.

3. [P2] [follow-up] CloudStartChat+Login.swift:57: Add a native capture of the newly triggered start-time device-code dialog, including Cancel.

Rust and Swift tests were not run because neither toolchain is installed.

[teamleaderleo]

Review (codex, router-review): SHIP at 83d15fb

Reviewer: codex gpt-6-astra high, fast tier.

Follow-ups: 2. Each lands as an issue in this repo that links this receipt; the lane that opened the PR fixes it forward.

SHIP at 83d15fb
Visual verdict: no images; Leo tries the build

1. [P2] [follow-up] Packages/macOS/CmuxNext/Sources/CmuxNextCloud/Broker/CloudCodexBrokerAdapter.swift:118: Registration does not establish completed delivery. transfer registers the machine before requesting access, including while device-code sign-in is pending. A concurrent chat therefore skips the broker and sends its first prompt without credentials. Await the existing transfer and distinguish pending registration from successful delivery; cover concurrent starts on the same machine.

2. [P2] [follow-up] Packages/macOS/CmuxNext/Sources/CmuxNextApp/Cloud/CloudStartChat+Login.swift:58: No after images cover the newly triggered device-code dialog. Verify its presentation and Cancel behavior in the build.

Follow-ups:

• Make concurrent starts await completed credential delivery.
• Visually verify the start-time device-code dialog.