feat(v3): expand Codex accounts, Work ownership, and recovery

AGENTS.md

@@ -54,7 +54,7 @@ local `claude` or `codex` session through a WebSocket relay. Two independent lin
   transport, never the caller's Origin. Uvicorn trusts forwarded transport
   metadata only from loopback Caddy. Never put tokens in URLs or protocol
   message bodies; logging redacts token/password fields.
-- **Protocol version gate**: current wire protocol v31 is declared by
+- **Protocol version gate**: current wire protocol v33 is declared by
   `PROTOCOL_VERSION` in both `protocol.py` and `web/src/protocol.ts`.
   `deserialize` hard-rejects a version mismatch, and
   `_Base` is `extra="forbid"`, so ANY protocol change must be deployed to all

CHANGELOG.md

@@ -4,13 +4,84 @@
 
 ## Unreleased
 
+- Store files and images attached to Work messages under that conversation's
+  private `workspace/uploads` directory, where the Work sandbox can actually
+  read them, while keeping uploaded source material out of generated Artifacts
+  and retaining history compatibility with the earlier sibling layout.
+- Let mobile Markdown source editors fill the available file panel, keep active
+  session cards visibly selected, restore code-copy contrast in dark mode, and
+  keep desktop dark code blocks visually separate from the page background.
+- Restore the exact active-turn owner before reconnect tail replay, persist its
+  source-bound browser/native identity into completed Codex History, and expire
+  projections written before that identity was durable instead of repainting a
+  duplicate response after refresh. Legacy CLI rollout user rows now reuse the
+  adjacent native app-server item id as well, so a history refresh cannot paint
+  one terminal prompt and its live mirror as two separate turns.
+  Remote steers flushed under a concurrent CLI turn now retain their exact
+  official `clientId` without admitting foreign CLI content, so delayed native
+  History rows collapse into the original optimistic message instead of
+  repainting it. Live rollout and official History item ids may coexist as
+  exact aliases of that one browser message instead of conflicting with each
+  other. Initial `turn/start` inputs now carry the same exact identity;
+  restart recovery can reattach an officially active split control/rollout turn
+  even after an oversized task's lifecycle marker has fallen outside the
+  bounded tail, preventing false interruption and duplicate prompt projections.
+  When that bounded tail has also evicted the active `TurnBinding`, its original
+  sequence now proves and pre-binds the retained current-turn suffix before Web
+  reduces it; projections cached with the old reversed order are expired once.
+  Once an unraced official Codex History page reports the thread idle, its
+  exact persisted success or failure also replaces a provisional live terminal
+  without discarding live detail or weakening Claude SDK terminal authority.
+- Upgrade the coordinated Wrapper/Relay/Web wire gate to protocol v33 and add
+  multi-account Codex Work. New Work sessions and schedules can select any
+  configured profile, persist that ownership independently of the current
+  default, and keep the same account across retries and wrapper restarts.
+  Legacy Work rows are idempotently assigned to the upgrade-time default even
+  when an earlier account-topology migration already completed. Removed
+  profiles leave existing Work bound and fail closed instead of being
+  reassigned; transient catalog read failures remain warnings, retain each
+  failed profile's last-known
+  session projection, and never trigger a silent fallback. Wrapper activation
+  now snapshots both Work SQLite registries, verifies the ownership migration,
+  and restores matching data before restarting old code after a failed release.
 - Upgrade the coordinated Wrapper/Relay/Web gate to protocol v31. Wrapper-side
   catalog mutations now broadcast an unbuffered invalidation instead of an
   uncorrelated session list; each visible browser coalesces the hint into its
   own generation- and surface-bound list read. Streaming math recognizes
   delimiters split across deltas, paused Goal resumes retain one bounded
   objective anchor, and compact continuation no longer renders a live spinner
   beside a real interrupted terminal.
+- Upgrade the coordinated Wrapper/Relay/Web wire gate to protocol v32 and add
+  concurrent Codex account profiles. Each configured `CODEX_HOME` owns its own
+  official daemon, catalog, controls, and history namespace; Code combines the
+  sessions with account labels and filters, while Work remains on the default
+  profile only. Single-account installs retain native ids and their old UI;
+  multi-account cards use stable colored `default`/celestial ribbons. Local
+  profile-key migrations are crash-resumable and include aliases, fork recovery,
+  turn leases, controls, pins, Work ownership, and rollback checkpoints.
+  Headless profiles now bootstrap their own official remote-control daemon
+  instead of silently degrading to a private stdio process. OAuth-only sibling
+  homes safely reuse the verified managed standalone CLI entry while retaining
+  independent auth, rollout, socket, and daemon state; existing custom layouts
+  are never replaced. An unavailable account control plane fails clearly, while
+  single-account fallback semantics remain unchanged. An authenticated account
+  whose quota read temporarily
+  returns no windows is also shown as a refreshable read failure rather than a
+  missing account.
+- Keep Claude prompts stable across refreshes and Claude/Codex surface switches.
+  Claude Code's internal `promptId` is no longer mistaken for the browser
+  message id; the wrapper persists only exact native-user aliases observed
+  after a generation-bound Agent SDK transcript boundary (with SDK replay as
+  fallback) or a broker-owned append boundary. Learning this Claude metadata
+  no longer invalidates Codex account caches. Derived Claude pages from the old
+  identity model are invalidated without discarding Codex history pages. While
+  an Agent SDK turn is live, transcript EOF now remains an open projection and
+  the first ownership scan no longer mirrors a duplicate partial page; the real
+  `ResultMessage` is the sole completion boundary. A
+  narrowly-proved delayed `request_retry` branch no longer hides the already
+  completed sibling tail, and entering or retrying a resident-session switch
+  publishes the current lifecycle state with a fresh sequence instead of
+  replaying a stale `running` frame.
 - Add protocol v28 Codex account activity. The existing one-shot status read
   carries a validated, bounded 53-week daily token series, and Web exposes a
   Codex-only Desktop-style activity calendar without storing it in live replay.

CHANGELOG_zh.md

@@ -4,11 +4,62 @@
 
 ## 未发布
 
+- Work 消息附带的文件和图片现在会保存到当前会话私有的
+  `workspace/uploads` 目录，Work 沙箱可以直接读取；上传的输入资料不会被误列为
+  生成的 Artifacts，同时旧版相邻目录中的附件路径仍可兼容历史展示。
+- 移动端 Markdown 源码编辑器现在会填满可用文件面板；暗色主题下的当前会话卡片
+  会保持清晰选中，代码块复制按钮恢复可读对比度，桌面端代码块也会与页面背景
+  保持清晰层次。
+- 重连补发实时尾部前会恢复当前回合的精确归属，并将与 rollout 源文件绑定的
+  浏览器/原生消息身份持久化到已完成的 Codex History；升级时会淘汰身份尚未持久化
+  的旧投影，避免刷新后把同一回复重复绘制为两层。旧版 CLI rollout 中相邻的
+  user 双记录现在也会复用 app-server 原生 item id，历史刷新不会再把同一次终端输入
+  与其实时镜像画成两个回合。
+  Remote steer 即使被官方 daemon 延迟写入并归到并行 CLI turn，也只会提取精确
+  `clientId`、不会放行外部 CLI 正文；后续原生 History 行会并回原来的乐观消息，
+  不再重复绘制。同一条浏览器消息的 live rollout item id 与官方 History item id
+  现在可作为两个精确别名并存，不再互相冲突。初始 `turn/start` 输入现在也携带
+  同一精确身份；即使超大任务的
+  生命周期标记已经落到有界尾部之外，重启恢复仍可通过官方活跃状态与原生
+  item/rollout 绑定重新接管，避免误报“已打断”及重复显示同一条输入。
+  若有界尾部连当前 `TurnBinding` 也已淘汰，wrapper 现在会用其原始序号严格证明
+  并在 Web 消费正文前绑定余下的当前回合后缀；旧版反向顺序写入的错误缓存会一次性失效。
+  无实时竞态的
+  官方 Codex History 明确报告线程空闲后，其持久化成功或失败终态也会替换临时的
+  live 终态，同时保留实时详情，且不会削弱 Claude SDK 的终态权威。
+- Wrapper、Relay 与 Web 的协同 wire gate 升级到 protocol v33，并为 Codex Work
+  新增多账号支持。新 Work 会话与定时任务都可选择任一已配置 Profile，账号归属会
+  独立于当前默认账号持久化，并在重试和 wrapper 重启后保持不变。即使早期账号拓扑
+  迁移已经完成，升级时仍会幂等地把旧 Work 数据绑定到当时的默认账号。Profile 被
+  移除后既有 Work 仍保持原归属并 fail-closed，不会被改绑；临时目录读取失败会保留
+  对应账号最后一次成功的会话投影，不会触发静默回退。wrapper 发布会先快照两个 Work SQLite 注册表，
+  验证账号归属迁移，并在失败回滚时先恢复匹配数据再启动旧代码。
 - Wrapper、Relay 与 Web 的协同 gate 升级到 protocol v31。wrapper 内部的目录
   变化不再广播无关联会话列表，而是发送不进入重放环的失效提示；当前可见页面会
   将并发提示合并为绑定自身连接 generation 与 surface 的列表读取。流式公式可识别
   跨 delta 拆开的分隔符，暂停 Goal 恢复时会保留一次有界目标锚点，compact 续接也
   不再同时显示运行转圈和真实“已打断”终态。
+- Wrapper、Relay 与 Web 的协同 wire gate 升级到 protocol v32，并新增可同时使用的
+  Codex 多账号 Profile。每个 `CODEX_HOME` 独立拥有官方 daemon、目录、控制状态和
+  历史命名空间；Code 统一展示并提供账号标签/筛选，Work 仍只使用默认 Profile。
+  单账号保持原生 id 与原 UI；多账号卡片使用稳定的彩色 `default`/天体 ribbon。
+  本地 Profile key 迁移支持崩溃续接，并覆盖 alias、fork 恢复、turn lease、控制状态、
+  置顶、Work 归属与 rollback checkpoint。无界面 Profile 现在会为各自账号
+  bootstrap 官方 remote-control daemon，不再静默降级到私有 stdio；只有 OAuth
+  与会话数据的次账号会安全复用已校验的 managed standalone CLI 入口，同时保持
+  登录、rollout、socket 和 daemon 独立，已有自定义目录不会被覆盖。账号控制面
+  不可用时会明确失败，单账号的既有 fallback 语义保持不变。已登录账号若本次额度
+  读取暂时没有返回窗口，也会显示为可刷新重试的读取失败，而不会再误导为缺少账号。
+- Claude 问题在刷新以及 Claude/Codex 页面切换后保持同一条消息。wrapper 不再把
+  Claude Code 内部生成的 `promptId` 误当作浏览器消息 id，只持久化按 turn generation
+  冻结的 Agent SDK transcript 新增边界（SDK replay 作为兜底），或 broker 精确新增
+  边界观察到的原生 user UUID 映射；学习这项 Claude 元数据时也不再误入 Codex
+  账号缓存。升级时仅淘汰旧身份模型生成的 Claude 派生页，不清除 Codex 历史页。
+  Agent SDK 回合仍在运行时，transcript EOF 会保持为开放投影，首次 ownership 扫描
+  也不再重复镜像半成品历史；只有真实 `ResultMessage` 才能完成该回合。满足严格
+  证据的延迟 `request_retry` 分叉不再隐藏已经成功完成的兄弟尾段；进入 resident
+  会话或重试切换命令时，也会使用新序号发布当前生命周期状态，不再重播过期的
+  `running` 帧。
 - 新增 protocol v28 Codex 账户活动。现有的一次性状态读取会携带经过校验、限制
   为最近 53 周的每日 Token 序列；Web 提供仅 Codex 可见、仿 Desktop 的活动
   日历，且这些账户数据不会进入实时重放缓存。五档颜色按当前日历中的单日峰值

CLAUDE.md

@@ -66,7 +66,7 @@ local `claude` or `codex` session through a WebSocket relay. Two independent lin
   `useLayoutEffect` is deliberately dependency-free — late virtualizer/image
   measurements settle without a React render, and constraining it to its read
   set reintroduces a full-viewport jump on touch release.
-- **Protocol version gate**: current wire protocol v31 is declared by
+- **Protocol version gate**: current wire protocol v33 is declared by
   `PROTOCOL_VERSION` in both `protocol.py` and `web/src/protocol.ts`.
   `deserialize` hard-rejects a version mismatch, and
   `_Base` is `extra="forbid"`, so ANY protocol change must be deployed to all