Resume the real Codex session instead of starting a new one

[selfcontained]

Problem

Restarting a Codex agent silently started a brand-new conversation. startAgent only ever minted a cli_session_id for Claude agents, so Codex agents kept a null id, shouldResume stayed false, and every restart fell through to the new-session branch — dropping the entire prior conversation.

Fix

Codex mints its own session id at launch, so Dispatch can't pre-assign one the way it does for Claude. Recover it from the rollout logs instead:

• Rollouts already carry the [dispatch:<agentId>] tag Dispatch stamps into the launch guidance, so the newest tagged rollout under the Codex sessions dir identifies the session to resume.
• codex resume <id> appends to that same rollout and keeps the same id (verified against codex-cli 0.147.0), so once discovered the id stays valid across any number of restarts.
• The discovered id is persisted to cli_session_id through the same conditional-UPDATE race guard Claude uses, now extracted as claimCliSessionId.

Two related bugs in the resume command itself, both previously unreachable:

• Passthrough args were dropped, so a full-access agent came back sandboxed after a restart (losing --dangerously-bypass-approvals-and-sandbox).
• The session id now trails the flags, so codex binds it to SESSION_ID rather than sliding into the optional trailing [PROMPT] positional.

Rollout discovery moves into a shared codex-sessions module — the token harvester walked the same tree — and now honours CODEX_HOME like the CLI does, which also keeps the harvester test out of the real ~/.codex.

Validation

Live on an isolated dev stack with a real Codex agent: launched it, stopped it, restarted it.

• Restart resolved cliSessionId to 019fec2f-… and reported Session resumed.
• Running process: codex resume -c mcp_servers.dispatch.url=… -c mcp_servers.dispatch.bearer_token_env_var=… 019fec2f-… — MCP wiring intact, session id trailing.
• Still exactly one rollout file for the agent afterwards, confirming it appended to the existing session rather than forking a new one.

Checks: pnpm run check clean, 2561 server unit tests pass, 178 E2E pass. No apps/web changes.

🤖 Generated with Claude Code