feat: add Codex executor with session resume

2026-07-22 22:15:15 +08:00
parent d38151ad78
commit 214b7c9a30
19 changed files with 1855 additions and 33 deletions
@@ -5,7 +5,7 @@ description: Drive an explicitly invoked agent-workflow in which the host (Codex

 # Agent Workflow Host

-Act as the host planner, reviewer, and final acceptance authority. Let the selected executor implement and fix code. You must pass your own identity (codex or claude) as the `--reviewer` on lifecycle commands. Use `agent-workflow`; do not replace its state machine with direct executor commands. You cannot use the claude executor if you are the claude reviewer. On resume, you must inspect the `reviewer` field in the status output and refuse to continue if it belongs to a different host. When executing lifecycle commands, pass your concrete current identity (e.g. `--reviewer codex`) instead of using a literal `<codex|claude>` placeholder.
+Act as the host planner, reviewer, and final acceptance authority. Let the selected executor implement and fix code. You must pass your own identity (codex or claude) as the `--reviewer` on lifecycle commands. Use `agent-workflow`; do not replace its state machine with direct executor commands. You cannot use the `claude` executor if you are the `claude` reviewer. You cannot use the `codex` executor if you are the `codex` reviewer. On resume, you must inspect the `reviewer` field in the status output and refuse to continue if it belongs to a different host. When executing lifecycle commands, pass your concrete current identity (e.g. `--reviewer codex`) instead of using a literal `<codex|claude>` placeholder.

 ## Invocation Contract

@@ -31,9 +31,9 @@ When invoked, the host (Codex or Claude) drives the workflow using its respectiv
 - Treat an explicit `执行` invocation as authorization to execute the latest clearly bounded plan in the conversation.
 - Do not start when the conversation contains multiple unresolved plan variants, missing scope, missing acceptance criteria, or missing verification commands. Ask only for the unresolved decision.
 - If invoked without an operation, show the supported operations and do nothing.
- Default to `reasonix`. Use `claude` or `agy` only when the user explicitly selects it or the approved plan already names it.
+- Default to `reasonix`. Use `claude`, `codex`, or `agy` only when the user explicitly selects it or the approved plan already names it.
 - Never switch or fall back to another executor during a run.
- Treat the current task as the durable binding identified by `CODEX_THREAD_ID` plus the target repository. Each task may lazily bind one Reasonix, one Claude, and one Agy session; do not eagerly start unused executors.
+- Treat the current task as the durable binding identified by `CODEX_THREAD_ID` plus the target repository. Each task may lazily bind one Reasonix, one Claude, one Codex, and one Agy session; do not eagerly start unused executors.
 - A normal `执行` starts a new run in the current task and automatically reuses the selected executor's bound session when one exists. The other executor bindings remain untouched.
 - Use `执行新任务计划` and pass `--new-task` only when the user clearly starts a materially different task. If the boundary is ambiguous, ask whether the prior executor context should be retained.

@@ -74,7 +74,7 @@ When invoked, the host (Codex or Claude) drives the workflow using its respectiv
 7. Start the run and record the emitted run ID, then immediately print a logs-follow command the user can run independently:

 ```bash
-agent-workflow start --plan <temp-plan.json> --executor <reasonix|claude|agy> --reviewer YOUR_IDENTITY [--vcs <git|svn|none>] [--new-task]
+agent-workflow start --plan <temp-plan.json> --executor <reasonix|claude|agy|codex> --reviewer YOUR_IDENTITY [--vcs <git|svn|none>] [--new-task]
 ```

 Do not pass `--new-task` for a follow-up plan, a correction, or another implementation slice of the same user goal. The CLI validates persisted task bindings before reuse and blocks stale or mismatched handles. An executor selected for the first time in the task starts lazily and is then recorded for later runs. Agy degraded `--continue` handles are intentionally not shared.
@@ -171,8 +171,7 @@ After `fix`, repeat review and decision for the new cycle. Respect the configure
 - For `查看 <run-id>`, run `agent-workflow status --run <run-id> --json`, summarize it, and do not advance the workflow.
 - For `继续 <run-id>`, read status first, then continue from `awaiting_review`, `awaiting_scope_resolution`, or `awaiting_host`. Read the persisted state and referenced cycle artifacts when earlier command output is no longer in context; do not reconstruct findings from memory.
 - For `清理后重试 <run-id>`, run `agent-workflow retry-review --run <run-id> --reviewer YOUR_IDENTITY` after the approved scope artifacts have been removed. It must refuse when baseline drift or out-of-scope paths remain.
- For `执行器重试 <run-id>`, run `agent-workflow retry-execute --run <run-id>` after the external cause of an executor failure is cleared (e.g., session conflict resolved, transient error gone, or corrected an invalid `model` configuration). It preserves failed attempt logs and reuses the same session handle. If a Reasonix handle was not captured, the CLI may recover a persisted session only when its project directory, frozen plan title, and execution time window match the run, and must audit the recovery. Initial-cycle retries continue from the original plan; later-cycle retries resume from the preceding decision. Refuses when baseline has drifted, scope violations exist, or the cycle already produced review artifacts.
- For `执行器重试 <run-id> 使用会话 <claude-session-id>`, run `agent-workflow retry-execute --run <run-id> --session <claude-session-id>` only when a Claude run's recorded session was never created or is unavailable and a known persisted replacement session contains the same frozen plan. The CLI must validate that the session belongs to the same repository and plan before recording the rebind in the audit log and retrying. Never edit `state.json` manually or guess a session ID.
+- For `执行器重试 <run-id>`, run `agent-workflow retry-execute --run <run-id>` after the external cause of an executor failure is cleared (e.g., session conflict resolved, transient error gone, or corrected an invalid `model` configuration). It preserves failed attempt logs and reuses the same session handle. If a Reasonix handle was not captured, the CLI may recover a persisted session only when its project directory, frozen plan title, and execution time window match the run, and must audit the recovery. For `执行器重试 <run-id> 使用会话 <claude-or-codex-session-id>`, explicitly bind a known Claude or Codex session; the CLI validates the session JSONL against the repository, frozen plan title, and executor kind, and records an audit event with the previous and new session IDs. Initial-cycle retries continue from the original plan; later-cycle retries resume from the preceding decision. Refuses when baseline has drifted, scope violations exist, or the cycle already produced review artifacts.
 - For `延长 <run-id> 添加 <n> 个周期`, run `agent-workflow extend --run <run-id> --additional-cycles <n>` to extend a `budget_exhausted` run. This requires: the run ended at `budget_exhausted`, has a valid session handle, the last decision was `fix`, baseline hasn't drifted, and scope is clean. Returns to `awaiting_host` state to continue the same executor session.
 - Treat `completed`, `needs_human`, `blocked`, and `aborted` as terminal. Report them instead of attempting another cycle.
 - `budget_exhausted` is terminal but can be extended with the extend command if all conditions are met.