fix(codex): resume archived native sessions

[maria-rcks]

archiving a codex session externally makes thread/resume fail. on current v2, the shared turn-start service silently starts a replacement native session and replays app history. this change catches the specific archived-session error in CodexAdapterV2, calls thread/unarchive for the same native id, and retries the identical resume once.

unrelated errors keep propagating. if unarchive or the retry fails, the existing global fallback may still start a fresh native session; this pr leaves that policy unchanged.

closes #10481. closes #10505. maintainer triage specifies this recovery. replaces the v1 implementation in #10505, closed during the v2 migration.

verification:

• isolated blacksmith: vp test run apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts passed 133 tests, including 11 recovery/failure cases in the existing file. targeted lint and formatting passed; server typecheck exited 0. lint reports two existing unused-variable warnings.
• actual web client with codex 0.160.0, one new sandbox thread: after a completed turn, archive only its new native session, restart the sandbox backend to force resume, then send the same followup. baseline replaced native 01a1040d-2cf6-7ad0-ad78-caf497cc7511 with 01a1040f-3c59-7170-8190-8dd3580ce1d7. with only the adapter patch applied, repeating the archive/restart/followup kept 01a1040f-3c59-7170-8190-8dd3580ce1d7 and completed the turn without a new resume-failed warning.

the terminal in these captures runs a read-only query of the sandbox's actual persisted run-attempt.updated events. before: completed runs 1 and 2 have different native ids. after: runs 2 and 3 have the same native id. both versions recalled the token through conversation history, so token recall alone does not prove native-session continuity.

after: real client followup completes with the original native session and read-only event proof.

after.mp4

desktop, mobile, remote/relay, tunnel, and live chatgpt archive were not independently exercised. the shared server adapter serves those clients; the real provider archive was exercised through codex's native rpc. no client ui or wire contracts change.

implemented by gpt-6.1-sol with xhigh reasoning through the codex harness in t3 code.

[macroscopeapp]

Approvability

Verdict: Approved at 1b082c1

Macroscope's review found this PR approvable — This is a focused Codex adapter bug fix that restores archived sessions through an unarchive-and-resume sequence while preserving unrelated failures. Production behavior is confined to the existing resume path, with targeted tests covering recovery and error handling.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: d9e693b8-55d2-4caf-b41b-4e6b9c76c5a4

📥 Commits

Reviewing files that changed from the base of the PR and between 243d1e7 and 1b082c1.

📒 Files selected for processing (2)

• apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
• apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The Codex adapter now unarchives a thread and retries its resume request when Codex returns a matching archived-session error. Replay tests cover recovery, retry failures, and errors that should not trigger unarchiving.

Changes

Archived Codex thread recovery

Layer / File(s)	Summary
Resume, unarchive, and retry apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts	resumeThread sends the raw resume request. For matching archived-session errors, it requests thread/unarchive and retries the same resume. Other request errors are rethrown.
Replay recovery and error cases apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts	Parameterized tests cover archived-session recovery, errors that do not trigger unarchiving, retry failures, and resumed thread state.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 1b082

The archived-session recovery appears ready to merge after normal checks. No concrete remaining issue is identified in the supplied change context.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1b082

Recovery targets the existing saved session and retries once without changing credentials or permissions. No introduced security vulnerability was established. The remaining uncertainty is how session state is reconciled when recovery fails or is interrupted after reactivation.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — Each recovery request targets the single native thread already referenced by the provider-thread object and uses the existing session client. This establishes the immediate operation scope, not the deployment’s full tenant or credential exposure.

Trust Boundaries and Controls

• observed — Recovery requires a typed app-server request error with matching text. The tested authentication-failed, archived-workspace and archive-path permission-denied messages do not issue unarchive. The adapter retains the same provider authority; upstream ownership authorization was not established by this scope.

Resilience and Maintainability Implications

• inferred — Successful unarchive followed by failed resume can leave the original native session unarchived while the existing fallback creates a replacement. The shown recovery and fallback paths contain no compensating rearchive. Whether this is intentionally retained state or reconciled elsewhere remains unresolved; unauthorized access was not demonstrated.

Hardening Proposals

• proposed — Define and exercise native-session ownership semantics for interruption, retry failure and concurrent recovery after unarchive succeeds. Establish whether retaining the original unarchived session is intentional before adding reconciliation or compensation that could interfere with another successful caller.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue #10481 requires a Codex thread to resume and accept a new message after ChatGPT archives its native session. CodexAdapterV2.resumeThread now catches archived-session or codex unarchive error…
Out of Scope Changes check	✅ Passed	The changes are limited to archived-session recovery in CodexAdapterV2 and tests for that behavior. The added tests support issue #10481. No unrelated changes appear in the reviewed diff.
Title check	✅ Passed	The title clearly and concisely identifies the fix: resuming archived native Codex sessions.
Description check	✅ Passed	The description covers the problem, implementation, scope and maintainer triage, focused tests, real-client verification, and limitations. It meets the template requirements.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

the docstring coverage warning does not require a change for this focused fix. the existing resumeThread contract is unchanged, and the recovery path has a local comment explaining why the unarchive response is ignored. the existing adapter test file covers recovery and failure behavior; adding documentation solely to reach the generic coverage percentage would not help explain this change.