feat: add Codex executor with session resume

README.md

@@ -3,12 +3,12 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20-green.svg)](https://nodejs.org)
 
-**Codex or Claude hosted autonomous implementation loop with Reasonix, Claude Code, and Agy executors.**
+**Codex or Claude hosted autonomous implementation loop with Reasonix, Claude Code, Agy, and Codex executors.**
 
 `agent-workflow` orchestrates a stateful implement-review-fix cycle where:
 
 - **Codex or Claude** acts as the host planner, reviewer, and final acceptance authority
-- **Reasonix, Claude Code, or Agy** executes implementation and fixes in the same session
+- **Reasonix, Claude Code, Agy, or Codex** executes implementation and fixes in the same session
 - The workflow maintains atomic state, VCS baseline gates, scope enforcement, and convergence limits
 - Supports both **Git** and **SVN** working copies with strict validation
 
@@ -16,7 +16,7 @@
 
 - Node.js >= 20
 - Git repository or SVN working copy
-- At least one executor: [Reasonix](https://reasonix.ai), [Claude Code](https://claude.ai/code), or [Agy](https://agy.dev)
+- At least one executor: [Reasonix](https://reasonix.ai), [Claude Code](https://claude.ai/code), [Agy](https://agy.dev), or Codex
 
 ## Installation
 
@@ -95,13 +95,13 @@ agent-workflow decide --run <run-id> --input decision.json --reviewer <codex|cla
 Start a new workflow run. Requires a clean working tree.
 
 ```bash
-agent-workflow start --plan <plan.json|-> --executor <reasonix|claude|agy> [--reviewer <codex|claude>] [--vcs <git|svn|none>] [--max-cycles <n>] [--new-task]
+agent-workflow start --plan <plan.json|-> --executor <reasonix|claude|agy|codex> [--reviewer <codex|claude>] [--vcs <git|svn|none>] [--max-cycles <n>] [--new-task]
 ```
 
 - `--vcs` - Explicitly specify VCS kind (`git`, `svn`, or `none`). If omitted, auto-detects from the working directory. If neither Git nor SVN is detected, it automatically falls back to `none` (snapshot mode).
 - When `CODEX_THREAD_ID` is available, runs in the same Codex thread and repository share a current task. Each executor is created lazily on first use and its reliable session handle is reused by later plans in that task.
 - `--new-task` creates a new task boundary and clears all three lazy executor bindings. Use it only when the conversation has moved to a materially different task.
-- Claude, Reasonix, and Agy bindings remain separate. Selecting another executor does not switch an active run; it starts or resumes that executor only in a later run after the repository is clean.
+- Claude, Reasonix, Agy, and Codex bindings remain separate. Selecting another executor does not switch an active run; it starts or resumes that executor only in a later run after the repository is clean.
 - Agy sessions without a captured conversation ID are not shared because `--continue` cannot guarantee which conversation will be selected.
 - Git and SVN working copies are automatically detected when `--vcs` is not provided.
 - SVN working copies must be in a clean, consistent state (no mixed revisions, switched paths, externals, or conflicts).
@@ -146,10 +146,10 @@ agent-workflow retry-execute --run <run-id>
 If a failed Claude launch recorded a session ID that was never created, explicitly bind a known persisted Claude session from the same repository and frozen plan while retrying:
 
 ```bash
-agent-workflow retry-execute --run <run-id> --session <claude-session-id>
+agent-workflow retry-execute --run <run-id> --session <claude-or-codex-session-id>
 ```
 
-The override is accepted only for Claude runs. The session JSONL must exist under `~/.claude/projects`, belong to the run repository, and contain the frozen plan title. Baseline, scope, and review-artifact gates still apply, and the old/new session IDs are appended to the workflow audit log.
+The override is accepted only for Claude and Codex runs. For Claude the session JSONL must exist under `~/.claude/projects`; for Codex it is searched under `~/.codex/sessions` and `~/.codex/archived_sessions`. The session must belong to the run repository and contain the frozen plan title. Baseline, scope, and review-artifact gates still apply, and the old/new session IDs are appended to the workflow audit log.
 
 For Reasonix runs blocked after a session handle was not captured, `retry-execute` automatically recovers the persisted session only when its project directory, frozen plan title, and execution time window match the run. The recovery is recorded in the workflow audit log.
 
@@ -205,7 +205,7 @@ agent-workflow web [--port <n>]
 - **`--port <n>`** — specify a custom port to listen on (default: `4317`).
 - **Security & Scope** — The server binds exclusively to the loopback interface (`127.0.0.1`) for local-only access. It refuses any external or remote listener configurations. Since executor logs can contain sensitive code, configuration details, or tokens/credentials, binding to `127.0.0.1` ensures that the console remains local. Mutation endpoints require same-origin localhost requests, JSON content type, bounded bodies, and validated model values. Credentials are never returned to the browser.
 - **Workflow monitoring remains read-only** — The console provides no endpoints to start, stop, decide, or otherwise control workflow runs. It parses and displays execution progress, cycles, timeline, and stdout/stderr output. It cannot recover or display private reasoning tokens/processes of underlying models that are not output to the console.
-- **Writable global model settings** — The Chinese “全局执行器模型配置” view can independently set Claude, Agy, and Reasonix models. Discovery uses the current CLI environment: Claude via Anthropic `/v1/models` (with configured-default fallback), Agy via `agy models`, and Reasonix via `reasonix doctor --json` provider/model entries. Reasonix candidates use the CLI-compatible `provider/model` form, with provider-only fallback when no concrete model is listed. CLI discovery allows up to 15 seconds for executor startup; HTTP model discovery remains bounded separately. Discovery failures are isolated per executor, and manual entry always remains available. Saving atomically updates only `executors.<kind>.model` in `~/.agent-workflow/config.json`, preserves unrelated fields, and clears an override when the value is emptied. Active executors are not interrupted; saved models take effect on later cycles, scope remediation, extensions, and executor retries through the existing reload path. Project configuration continues to override global values.
+- **Writable global model settings** — The Chinese “全局执行器模型配置” view can independently set Claude, Agy, Reasonix, and Codex models. Discovery uses the current CLI environment: Claude via Anthropic `/v1/models` (with configured-default fallback), Agy via `agy models`, and Reasonix via `reasonix doctor --json` provider/model entries. Reasonix candidates use the CLI-compatible `provider/model` form, with provider-only fallback when no concrete model is listed. CLI discovery allows up to 15 seconds for executor startup; HTTP model discovery remains bounded separately. Discovery failures are isolated per executor, and manual entry always remains available. Saving atomically updates only `executors.<kind>.model` in `~/.agent-workflow/config.json`, preserves unrelated fields, and clears an override when the value is emptied. Active executors are not interrupted; saved models take effect on later cycles, scope remediation, extensions, and executor retries through the existing reload path. Project configuration continues to override global values.
 - **Interaction with `logs --follow`** — The web server directly reads the persisted run files without taking any logs follow locks or interfering with the main executor loop, allowing you to use both the CLI `logs --follow` and the web console concurrently.
 
 ### `agent-workflow abort`
@@ -261,7 +261,7 @@ Create `agent-workflow.json` in your repository root, and optionally create `~/.
 `timeoutSeconds` is an inactivity timeout, not a total runtime limit. The host resets the timeout whenever the executor emits stdout/stderr progress, so an active task may run longer than the configured window. A continuously silent executor is terminated after the configured number of seconds. Agy receives a 24-hour internal print-mode ceiling while the host inactivity timeout remains the primary stuck-process guard.
 
 - `defaultVcs` - Default VCS kind: `"auto"` (detect), `"git"`, `"svn"`, or `"none"`. Default is `"auto"`.
-- `model` - Executor model identifier (accepted as any non-empty string). When set, it is passed to Claude, Agy, and Reasonix. The effective model is reloaded from the latest config before each later cycle, scope remediation, cycle extension, and executor retry, so mid-run model changes take effect without starting a new run. Binary path, agent, profile, budget, timeout, and other executor settings are locked at run start.
+- `model` - Executor model identifier (accepted as any non-empty string). When set, it is passed to Claude, Agy, Reasonix, and Codex. The effective model is reloaded from the latest config before each later cycle, scope remediation, cycle extension, and executor retry, so mid-run model changes take effect without starting a new run. Binary path, agent, profile, budget, timeout, and other executor settings are locked at run start.
 
 Configuration files are forbidden from storing secrets (`apiKey`, `token`, `secret`, `password`, `credential`, etc.). If the latest config is invalid or the reloaded `model` is empty, the run enters a `blocked` state before launching the executor. After correcting the config, the same run can continue with `agent-workflow retry-execute --run <run-id>`.