fix(hook): launch codex through cue

openspec/changes/agent-codex-make-codex-launch-through-cue-2026-06-09-10-30/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-06-09

openspec/changes/agent-codex-make-codex-launch-through-cue-2026-06-09-10-30/notes.md

@@ -0,0 +1,19 @@
+# agent-codex-make-codex-launch-through-cue-2026-06-09-10-30 (minimal / T1)
+
+Branch: `agent/codex/make-codex-launch-through-cue-2026-06-09-10-30`
+
+Make the generated `codex()` authmux shell hook launch Codex through Cue by
+default with `AUTHMUX_CODEX_CUE_PROFILE` override and
+`AUTHMUX_SKIP_CUE_LAUNCH` escape hatch.
+
+## Handoff
+
+- Handoff: change=`agent-codex-make-codex-launch-through-cue-2026-06-09-10-30`; branch=`agent/codex/make-codex-launch-through-cue-2026-06-09-10-30`; scope=`src/lib/config/login-hook.ts, scripts/postinstall-login-hook.cjs, src/tests/login-hook.test.ts`; action=`finish via PR`.
+- Verification: `node dist/tests/login-hook.test.js`; `npm test` (195/195 passing).
+- Smoke note: direct `cue launch codex --cue-profile core --version` escalation timed out twice in auto-review, so full live smoke will be done after merge by sourcing updated `.bashrc`.
+
+## Cleanup
+
+- [ ] Run: `gx branch finish --branch agent/codex/make-codex-launch-through-cue-2026-06-09-10-30 --base main --via-pr --wait-for-merge --cleanup`
+- [ ] Record PR URL + `MERGED` state in the completion handoff.
+- [ ] Confirm sandbox worktree is gone (`git worktree list`, `git branch -a`).

scripts/postinstall-login-hook.cjs

@@ -50,7 +50,12 @@ function renderHookBlock() {
     "    command authmux restore-session >/dev/null 2>&1 || true",
     "    command authmux skills activate-current --agent codex >/dev/null 2>&1 || true",
     "  fi",
-    "  command codex \"$@\"",
+    "  local __authmux_cue_profile=\"${AUTHMUX_CODEX_CUE_PROFILE:-core}\"",
+    "  if command -v cue >/dev/null 2>&1 && [[ -z \"${AUTHMUX_SKIP_CUE_LAUNCH:-}\" ]]; then",
+    "    cue launch codex --cue-profile \"$__authmux_cue_profile\" \"$@\"",
+    "  else",
+    "    command codex \"$@\"",
+    "  fi",
     "  local __codex_exit=$?",
     "  if command -v authmux >/dev/null 2>&1; then",
     "    CODEX_AUTH_FORCE_EXTERNAL_SYNC=1 command authmux status >/dev/null 2>&1 || true",

src/lib/config/login-hook.ts

@@ -66,7 +66,12 @@ export function renderLoginHookBlock(): string {
     "    command authmux restore-session >/dev/null 2>&1 || true",
     "    command authmux skills activate-current --agent codex >/dev/null 2>&1 || true",
     "  fi",
-    "  command codex \"$@\"",
+    "  local __authmux_cue_profile=\"${AUTHMUX_CODEX_CUE_PROFILE:-core}\"",
+    "  if command -v cue >/dev/null 2>&1 && [[ -z \"${AUTHMUX_SKIP_CUE_LAUNCH:-}\" ]]; then",
+    "    cue launch codex --cue-profile \"$__authmux_cue_profile\" \"$@\"",
+    "  else",
+    "    command codex \"$@\"",
+    "  fi",
     "  local __codex_exit=$?",
     "  if command -v authmux >/dev/null 2>&1; then",
     "    CODEX_AUTH_FORCE_EXTERNAL_SYNC=1 command authmux status >/dev/null 2>&1 || true",

src/tests/login-hook.test.ts

@@ -67,6 +67,7 @@ test("installLoginHook refreshes an existing legacy hook block", async (t) => {
     const contents = await fsp.readFile(rcPath, "utf8");
     assert.ok(contents.includes("command authmux restore-session"));
     assert.ok(contents.includes("command authmux skills activate-current --agent codex"));
+    assert.ok(contents.includes("cue launch codex --cue-profile \"$__authmux_cue_profile\""));
     assert.ok(contents.includes("CODEX_AUTH_FORCE_EXTERNAL_SYNC=1 command authmux status"));
     assert.ok(contents.includes("__authmux_ensure_session_key"));
     assert.ok(contents.includes("export CODEX_AUTH_SESSION_KEY=\"terminal:${__authmux_tty}:$$\""));
@@ -116,6 +117,9 @@ test("renderLoginHookBlock includes terminal-mode restore guard", () => {
   assert.ok(hook.includes("__authmux_ensure_session_key"));
   assert.ok(hook.includes("command authmux restore-session"));
   assert.ok(hook.includes("command authmux skills activate-current --agent codex"));
+  assert.ok(hook.includes("local __authmux_cue_profile=\"${AUTHMUX_CODEX_CUE_PROFILE:-core}\""));
+  assert.ok(hook.includes("AUTHMUX_SKIP_CUE_LAUNCH"));
+  assert.ok(hook.includes("cue launch codex --cue-profile \"$__authmux_cue_profile\""));
   assert.ok(hook.includes("CODEX_AUTH_FORCE_EXTERNAL_SYNC=1 command authmux status"));
   assert.ok(!hook.includes("__first_non_flag"));
   assert.ok(!hook.includes("if ! typeset -f codex"));