Lawrence Chen
0aa8a724cb
* Add security regression coverage * Fix security scan findings * Address security review follow-ups * Fix review regressions in lease cleanup * Fix final security review findings * Fix remaining autoreview findings * Address final autoreview regressions * Keep active identity cleanup best effort * Bound active identity cleanup * Bound SSH cleanup before endpoint minting * Make cleanup retries bounded and releasable * Bound active identity cleanup preflight * Preserve vault grants on retry presign failure * Guard vault grant rollback state * Back off failed expired lease cleanup * Separate vault quota lock namespace * Tighten VM identity cleanup ordering * Fail closed without VM team membership * Bound VM identity cleanup fanout * Rollback endpoint resume on cleanup failure * Remove nondeterministic vault upload test wait * Fail closed on destroy identity cleanup * Recreate Base when active provider VM is gone * Keep Freestyle attach independent of exec probe * Scope provider identity not-found handling * Use reservation tokens for vault upload rollback * Validate vault upload grants at commit * Bound identity cleanup and duplicate vault reservations * Stage vault uploads before commit * Keep vault staging cleanup retryable * Reuse active vault upload staging keys * Preserve legacy vault upload commits * Make vault staging cleanup recoverable * Avoid endpoint resume rollback races * Serialize vault upload grant cleanup * Finalize vault staging outside quota locks * Track superseded vault upload keys
cmux-vault
cmux-vault discovers local coding-agent session transcripts and syncs them to
cmux Vault cloud storage. Round 1 supports Claude Code, Codex, and pi.
Install
go build ./cmd/cmux-vault
Commands
cmux-vault login
cmux-vault scan
cmux-vault sync
cmux-vault resume <session-id>
cmux-vault status
cmux-vault logout
login starts a device-code flow, prints a verification URL and user code, and
stores Stack Auth tokens in ~/.config/cmux-vault/auth.json with mode 0600.
sync uploads changed transcripts directly to S3-compatible object storage via
presigned URLs. resume restores a missing transcript from cloud storage and
prints the command the agent expects.
Useful flags:
cmux-vault --json scan
cmux-vault sync --agent codex --dry-run
cmux-vault sync --limit 25
cmux-vault resume --agent claude <session-id>
cmux-vault resume --force <session-id>
Environment
CMUX_VAULT_API_BASE: web API base URL. Defaults tohttps://cmux.com.CMUX_VAULT_CONFIG_DIR: override the auth token directory.CMUX_VAULT_STATE_DIR: override the sync state directory.CLAUDE_CONFIG_DIR: override Claude Code config discovery.CODEX_HOME: override Codex discovery.
Default local state lives in ~/.local/state/cmux-vault/state.json.