fix: hide resume button for non-resumable Codex sessions (provider-aware)

[lis186]

繁中摘要

Dashboard 的 resume copy button 以前對所有 codex session 都產出 codex resume <sid>,但 Codex 只在成功完成至少一個 API turn(有 usage)後才寫 rollout 檔 — 只有 502 startup error 的 session 複製出來的指令會失敗:No saved session found with ID。

這個 PR 把 resume 政策變成 provider 宣告式設定(UPSTREAM_PROFILES.resume,沿用 #43 B4 cache profile pattern),server 端算好每個 session 的 resumeCommand,client 變純 view:拿到 null 就不渲染按鈕(fail closed)。實作前先用三個隔離 worktree 平行實驗三種架構(declarative profile / server-computed / client-only),由 codex CLI 評審後採 hybrid 方案;最終程式碼經 codex gate 三輪複審至 clean。

Problem

Before:  every codex session card → copy button → codex resume <sid>
         502-only session (no rollout file) → ERROR: No saved session found
After:   codex session with a completed turn → codex resume <sid>  ✓
         codex session with only startup errors → no button         ✓
         claude sessions → claude --resume <sid> (unchanged)        ✓

Root cause: Codex only writes ~/.codex/sessions/.../rollout-*.jsonl after a successful API turn. ccxray treated every wire-observed session as resumable.

Architecture

server/providers.js           server/store.js               client (pure view)
┌────────────────────┐        ┌──────────────────────┐      ┌────────────────────┐
│ UPSTREAM_PROFILES  │        │ markSessionUsage()   │      │ sess.resumeCommand │
│ anthropic.resume:  │──read─→│  non-subagent+usage  │      │  (sticky)          │
│  {…, 'always'}     │        │  (monotonic)         │ SSE/ │                    │
│ openai.resume:     │        │ computeSessionResume │ API  │ null → no button   │
│  {…, 'has-usage'}  │        │  interprets condition│─────→│ value → copy exact │
└────────────────────┘        └──────────────────────┘      │  string, no rebuild│
        │                            ▲ ▲                    └────────────────────┘
        ▼ /api/settings              │ └ sse-broadcast.summarizeEntry (single funnel)
   providerProfiles                  └── restore loop pre-marks usage before
                                         serialization (order-independent)

• Declarative policy: resume: { template, condition } per upstream profile — adding a future provider is a one-line data change, no client edits
• Server owns the verdict: computeSessionResume interprets the profile; client renders sess.resumeCommand or nothing
• Fail closed: no usage → null; unknown or empty-string provider → null; sentinel sessions (direct-api/codex-raw/unknown) → null. Only provider == null (legacy pre-tagging entries) falls back to anthropic
• Restore correctness: the restore loop marks usage for all entries before any serialization, so an index where the usage turn appears after an earlier usage-less turn still reports the final monotonic value (mutation-tested: removing the pre-mark fails 2 tests)

Process

Three architecture candidates were implemented in parallel isolated worktrees, then judged by codex CLI against the committed diffs (correctness after restore, YAGNI, B4-pattern consistency, extension cost, test quality). Verdict: hybrid — B's server-computed backbone + A's declarative profile home. Post-implementation codex review gate ran 3 rounds (2 minor findings + 1 edge fixed) to clean.

Test plan

• 799 tests pass (16 new: profile shape, settings exposure, store eligibility edge cases, SSE ordering, restore order-independence, render-level button gating)
• Mutation test: commenting out restore pre-marking fails 2 tests
• Real-browser smoke (isolated CCXRAY_HOME, port 5613, browser-harness/CDP): codex-with-usage shows button with correct command, 502-only codex session shows no button, claude session unchanged
• Codex review gate: clean

🤖 Generated with Claude Code