Bug: /codex Step 2C "resume session" command uses flags (-C, -s) codex CLI rejects on `exec resume`

[jfcampbl]

Bug: /codex Consult Mode (Step 2C) "resume session" command uses flags codex CLI rejects

Versions

• gstack: 1.15.0.0
• codex-cli: 0.125.0 (Homebrew cask codex)
• macOS 14 (Darwin 25.4.0) arm64

What's wrong

~/.claude/skills/gstack/codex/SKILL.md Step 2C "Consult Mode" — the resumed-session code path documents this command:

codex exec resume <session-id> "<prompt>" -C "$_REPO_ROOT" -s read-only -c 'model_reasoning_effort="medium"' --enable web_search_cached --json

But on codex-cli 0.125.0, codex exec resume only accepts:

• -c, --config <key=value>
• --enable <FEATURE>
• --disable <FEATURE>
• --last
• --all
• --json (inherited)

-C (working directory) and -s (sandbox) belong on codex exec only, not resume. Passing them yields:

error: unexpected argument '-C' found
  tip: to pass '-C' as a value, use '-- -C'
Usage: codex exec resume [OPTIONS] [SESSION_ID] [PROMPT]

Same with -s. Skill fails with exit 2, no session resume happens.

Reproduce

SESSION_ID=$(cat .context/codex-session-id)  # any valid id
codex exec resume "$SESSION_ID" "ping" -C "$(pwd)" -s read-only -c 'model_reasoning_effort="medium"' --enable web_search_cached --json
# error: unexpected argument '-C' found

codex exec resume "$SESSION_ID" "ping" -s read-only --json
# error: unexpected argument '-s' found

Fix

In codex/SKILL.md Step 2C, the resumed-session command should drop -C and -s and rely on -c overrides instead:

codex exec resume <session-id> "<prompt>" \
  -c 'model_reasoning_effort="medium"' \
  -c 'sandbox_mode="read-only"' \
  --enable web_search_cached --json

Working-directory inheritance comes from the parent shell (resume already binds to the original session's cwd). Sandbox via sandbox_mode="read-only" works in -c.

The new-session block in the same file (codex exec not codex exec resume) is correct — -C and -s work there.

Check codex exec resume --help confirms

Usage: codex exec resume [OPTIONS] [SESSION_ID] [PROMPT]

Arguments:
  [SESSION_ID]  Conversation/session id (UUID) or thread name...
  [PROMPT]      Prompt to send after resuming the session...

Options:
  -c, --config <key=value>     Override a configuration value...
      --last                   Resume the most recent recorded session...
      --all                    Show all sessions...
      --enable <FEATURE>       Enable a feature (repeatable)...

No -C or -s on the resume subcommand.

Workaround for users hitting this now

Pass sandbox + working dir via -c:

codex exec resume "$SESSION" "$PROMPT" \
  -c 'sandbox_mode="read-only"' \
  -c 'model_reasoning_effort="medium"' \
  --enable web_search_cached --json < /dev/null

(Working directory inherits from parent shell; cd into the right repo first.)

Adjacent observation

Independently of this flag bug, codex's session-resume itself silently starts a new session in 0.125.0 when it can't find the saved thread (see openai/codex#19661 — same root cause as failed to record rollout items: thread <uuid> not found). So even with corrected flags, /codex consult-resume mode currently doesn't actually preserve conversation continuity. Worth noting in skill docs until #19661 lands.

[jbetala7]

Opened PR #1270 to fix this: #1270

The change removes -C and -s read-only from the codex exec resume command, runs resume from the repo root, and passes read-only sandboxing via -c 'sandbox_mode="read-only"'. Added a regression test for the generated command shape.

Verified with:

• bun run gen:skill-docs --host all
• bun test test/skill-validation.test.ts
• bun test test/gen-skill-docs.test.ts test/host-config.test.ts