[codex] Make remote conversation resume resilient

[cnjack]

What

• Add canonical, atomic conversation activation for local, SSH, and Docker sessions.
• Load transcript history independently from runtime activation, with a dedicated conversation loading view and inline SSH host-key/auth actions.
• Reuse ref-counted SSH transports across compatible conversation engines.
• Add strict known_hosts/TOFU fingerprint confirmation; host-key changes remain blocked.
• Add bounded SSH reconnect (8 attempts with jitter), task-scoped retry progress, and safe read-only replay.
• Backfill existing text/tool history through the current encrypted Cloud relay and transparently activate remote sessions without Cloud repository changes.
• Keep provider/model metadata as an atomic pair and preserve the current default model on cold resume.

Why / root cause

• Remote session index keys used scheme-qualified workspace labels while engine status exposed raw paths, so switching conversations repeatedly opened the connection flow and created new SSH transports.
• Bind followed by legacy resume could discard the new remote engine and silently rebuild the conversation on a local executor.
• Transcript replay was coupled to runtime connection, turning SSH/Docker activation delays into a full-page loading failure.
• SSH transport failures were swallowed by tool wrappers and later mislabeled as model connectivity failures.
• A want-reply SSH global keepalive can spin indefinitely in x/crypto/ssh after the response channel is closed, leaking one busy CPU goroutine per probe.
• Recorder model switches updated only the model id, leaving a stale provider paired with a model from another provider.

Safety / impact

• Unknown host keys require an explicit fingerprint-bound acceptance; changed keys cannot be silently overwritten.
• Passwords and passphrases are not persisted or uploaded.
• Before-dispatch failures and explicit read-only operations can replay after reconnect. Arbitrary commands or writes that may have been dispatched are never replayed; the UI asks the user to verify the remote state.
• Remote write/edit metadata failures fail closed before mutation.
• Retry status remains local and task-scoped; switching conversations cannot steal focus.
• No Cloud API, UI, or repository changes are required.

Checks

• go test ./... -count=1 -timeout=240s
• Targeted go test -race for SSH reconnect, model restoration, tools, Web, and runner
• make lint
• Web TypeScript typecheck
• Web test suite: 32 files / 147 tests
• make build-web and go build ./...
• Full repository pre-push hook: build, vet, incremental golangci-lint, and go test ./...

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a6027e3c-a0a6-44fc-b419-a627f928fe2c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jcode-cloud-app]

Caution

Review failed

jcode review did not complete. No native review was published for this attempt.

Pull request: #188 · [codex] Make remote conversation resume resilient

Revision: 712c42586f02

Reason: The repository could not be prepared for review.

View run

---

_{This status comment is updated in place. The native review is a separate, non-blocking COMMENT review.}