feat(coding-agent): import Codex sessions (redo of #3714)

[Yeachan-Heo]

Draft. Do not merge. Base is the revert branch, not dev — it will retarget to dev automatically once #3730 lands.

Restores #3714 and #3717, which #3730 reverts out of the 0.12.8 release.

The diff here is byte-identical to the reverted work. This branch exists so the implementation stays reviewable while the blockers are resolved, and so the revert does not read as abandoning the feature.

What has to be fixed before this can land

1. Non-Linux hard failure

service.ts:1061 passes retainSourceAuthority = true unconditionally; codex.ts:481 throws on any non-Linux platform. Every macOS/Windows invocation returns source_untrusted / discovery.

Options:

• add a non-authority fallback path for platforms without descriptor-relative authority, or
• gate the command's registration so it is not offered where it cannot run (a missing command beats a hard error).

2. The nlink guard rejects real Codex data

readSessionMeta drops any source with nlink !== 1. Measured on a real Codex home:

~/.codex/sessions  →  2089 files, nlink distribution: { "2": 2089 }
freshly created file, same directory  →  nlink = 1

Discovery returns 0 sessions. The guard's intent is right — nlink == 1 proves no second name exists for a TOCTOU swap, and O_NOFOLLOW cannot catch hard links — but it does not match how Codex actually writes rollout files.

Needs first: the same measurement on Linux. If Linux Codex also writes nlink=2, the feature is inert on its only supported platform and the guard has to change. If Linux is nlink=1, this collapses into blocker 1.

Then a decision on relaxing the guard without weakening the trusted-source model — e.g. proving identity through the retained descriptor across the read instead of requiring a single link up front.

3. Suite is not platform-guarded

session-import-codex.test.ts fails 15 of 34 on macOS. Needs skipIf (or a shared platform guard) so contributors keep a green baseline while the feature stays Linux-only.

Notes for review

• No changes have been made to the reverted code. Fixes should land as commits on top so the delta from feat(coding-agent): import Codex sessions #3714 is reviewable.
• docs/session-operations-export-share-fork-resume.md:39-40 already documents both the single-link and Linux-only constraints; whatever is decided above should keep those in sync.

[Yeachan-Heo]

SIGNED VERDICT — REQUEST_CHANGES

Exact review snapshot:

• PR head: feat/codex-session-import-redo at 49ff89414e0b37bc1103d97c1af1b121b5c13ab0
• PR base: revert/3714-codex-session-import at ba672261a585a84d0926168c76ce080ad8d67099
• Current dev: 732856b3ccb3fade6e9fbc17908a4fbca5a7682f
• GitHub state: open draft, mergeable/CLEAN only against the revert-branch base
• PR-head CI: 0 check runs and 0 commit statuses
• Base CI: 32 checks — 29 success, 3 skipped
• Current dev CI: 31 checks — 23 success, 5 skipped, 3 failure; that independent red state is not transferable evidence for this head

Blocking findings

1. HIGH — the command hard-fails on every non-Linux host. service.ts:1061 unconditionally requests retained source authority, while codex.ts:481-486 rejects all non-Linux platforms. The command is still registered there, so macOS/Windows users receive source_untrusted / discovery instead of a supported implementation or a deliberate unavailable-command contract.

2. HIGH — the trusted-source model is neither compatible nor complete. The source path requires nlink === 1; this PR itself records a real Codex home with 2,089/2,089 rollout files at nlink=2, while Linux remains unmeasured. Separately, the retained root traversal proves descriptor identity but does not verify owner-only/non-writable source directories, and free-form redaction in codex.ts:100-128 does not cover standard Authorization: Basic ..., Cookie, or Set-Cookie credential forms. Do not relax the link guard without a replacement authority proof.

3. HIGH — bounds and managed-storage failure handling are fail-open or too late. service.ts:765-896 writes the complete converted body before enforcing the 128 MiB target limit; the source allowance is 8 GiB. Native discovery collects and sorts every directory entry before applying its count limit. findExisting() maps an unsafe/failed candidate scan to “not found,” and staging recovery maps every readdir error to an empty directory, allowing publication work to continue without establishing storage state.

4. HIGH — this is a stale restoration, not a current-dev integration. The head is one commit over the retained revert branch and has no CI. Current dev is divergent and has later changes in the same native, print-mode, slash-command, session-storage, generated-inventory, and test surfaces. Retargeting alone is not sufficient; reconstruct/rebase the corrected change on current dev, preserve later fixes, then review the resulting exact diff and current-head CI.

5. MEDIUM — command-policy and coverage gaps remain. /import-session codex with zero IDs discovers and serially imports every matching source without a post-discovery batch ceiling or cancellation path. ACP-disabled manual invocation is returned as unmatched and can be forwarded to the model instead of being consumed with an unsupported diagnostic. The native-authority suite is not platform-guarded and uses synthetic single-link fixtures rather than accepted provider-format evidence.

Admission boundary

This PR is a Codex-only prototype over local $CODEX_HOME history. It does not satisfy or close #3709, whose admitted contract requires explicit user-selected Codex and Claude export/transcript inputs, a provider-neutral adapter boundary, authoritative format evidence, and no speculative private-history scraper. It is independent of #3633.

Required repair

Resolve the source-format/authority and platform contract first; fail closed on every scan/recovery error; enforce streaming output/discovery/batch bounds; close the redaction gaps; consume ACP-disabled invocations explicitly; guard and strengthen the platform/security fixtures; then rebuild the proposal on current dev and obtain current-head CI.

Contributor ledger

• vntrevx: original feat(coding-agent): import Codex sessions #3714 implementation and Codex-title follow-up; the redo correctly preserves co-author credit.
• Yeachan-Heo: fix(coding-agent): classify /import-session seam in SDK operation inventory #3717 inventory repair, revert(coding-agent): back out Codex session import for 0.12.8 #3730 release-containment revert, and this review-preserving redo.
• raphaelnz: independent Bounded resume listing hides persisted titles in existing sessions #3633 title-listing reproduction and predecessor exploration; not part of this PR diff.

Verdict is valid only for head 49ff89414e0b37bc1103d97c1af1b121b5c13ab0.

Signed-off-by: Yeachan-Heo owner@github