Repository navigation
Allow retained Sidekick conversations to resume after adapter configuration changes #1221
Description
Problem
XMD refuses to resume an existing Sidekick conversation when its saved provider command/configuration differs from the current one. This blanket equality check blocks ordinary adapter upgrades before attempting a native provider resume.
Reported in REPL d5bfff4b06747d3b9321f20ed5d5bb5c: the conversation was created with the old Codex adapter payload, then the host-installed Codex CLI change in #1204 selected a new payload directory. Both adapters identify as codex-acp 1.6.2. The refusal does not establish any native Codex incompatibility.
The visible message says the conversation was created under a different provider configuration and the build cannot apply and verify that change.
Evidence
packages/core/src/agent/conversation.ts,admitting(): compares saved and current{provider, agentCommand, configuration}withsameJson, then throws before provider reattachment.- Saved operation:
agent_conversation_configuration. - Old adapter digest:
3ee22bc6b1649d02fcef80b352516f395fe774e63b459193195a41c42930dd8b. - Current adapter digest from Use the host-installed Codex CLI for agent sessions #1204:
a3f699537970127972635b4596aef40ab8a4caa25a9028861d9ee07bf6c4b1a1. - Existing native Codex session:
01a1bca3-342d-7ee2-aa83-c4b2c8bc9219. packages/acp/src/session-key.tsalso derives logical session identity from agentCommand; verify removal of the guard does not silently create a new conversation.
Requested behavior
Remove the blanket saved-configuration restriction so retained conversations can resume using the configured adapter. Preserve the existing native conversation and history. Keep actual tool/permission enforcement and report genuine provider resume failures clearly.
Keep this repair focused: no new compatibility/migration framework, no digest whitelist, no private journal rewriting, and no silent replacement with a fresh conversation.
Acceptance
- Regression coverage demonstrates retained conversation resume across an adapter command/payload change.
- Existing native identity/history remain intact; refusal happens only for an actual unsupported operation or provider failure, not whole-configuration inequality.
- Existing Sidekick permission/tool restrictions still apply.
- Review and required CI pass for a focused PR.
The user authorized a new dedicated lane to implement this fix and merge it after required review and checks.
Activity
taras commentedon Nov 10, 2026
Implementation is proceeding in isolated branch
codex/retained-conversation-1221, based on220e54f86dd3698311ee57e660afd00b3e3bc2e1, using the merged adversarial implementation workflow with Claude Opus as Implementor. The user approved the workflow execution after the initial sandbox refusal; the failed pre-prompt launch evidence is preserved.The accepted change removes whole-configuration equality admission and updates its owning specification. The plan must prove that a changed adapter command resumes the existing native conversation and history, preserves replay and completed prompts, surfaces real provider resume failures, and keeps current Sidekick tool and permission enforcement. Session-key command hashing and recovery ownership are explicit parts of the trace. No compatibility framework, digest whitelist, private-journal rewriting, or fresh replacement conversation is authorized.
The reported live session will remain untouched. Independent review and required CI remain merge gates; PR #1203 is unrelated and excluded.
taras commentedon Nov 10, 2026
Planning traced a necessary continuation gap: Core checks a returned native identity but does not currently deliver the retained native target/provider-record locator to ACP before command-dependent placement. A retained Prompt already supplies the old session key, including the supported failed-host-acknowledgement window; this offers a direct record lookup without a registry or journal migration.
Preparation correction: the coordinator added a blanket “no new public API” restriction that was absent from the user’s request. That added restriction is withdrawn. A narrow extension to the existing provider setup can be considered within the original focused repair; no exact interface or new ownership behavior is approved by this correction. The original Architect session is preparing the concrete proposal, including preservation of the original ownership account and current Sidekick enforcement. All original no-framework/no-migration/no-replacement constraints remain.
taras commentedon Nov 10, 2026
The user accepted the bounded continuation design after reviewing both facts and the conversation lock: “Ok, I accept.”
Accepted: deliver the retained native conversation assertion and the original provider/command/sessionKey locator through the existing provider setup. Use the saved provider record’s exact loading target, verify the original native identity, and keep the original ownership/route coordinates across adapter command changes. The current adapter command/configuration still executes; the original tuple continues protecting the same conversation and keeps Stop/recovery aligned. A free process lock after a crash does not establish quiescence.
This accepts the two setup facts and original-owner approach, including the concrete
retainedAgentSessionIdand retained-session locator proposal. It authorizes no registry, journal format, generic migration/recovery, wider permissions, replacement conversation or extra product scope. The retained Architect and Planner are reconciling the final handoff, followed by Opus implementation, required review/CI and the already-authorized merge. Original sessions, evidence and finite allowances remain unchanged.taras commentedon Nov 10, 2026
Read-only diagnosis of the reported history confirms that 152 retained Prompt records name one original session key and native Codex identity. The saved ACPX record still contains that identity and cwd; the original ownership account is idle/quiesced.
The saved ACP-first route’s executable binding is
codex-cli 0.163.0, SHA-2568813367285524ac798dd96d1b071aea30d58708c7226fd236cd275cf1cfdee31. The currently installed Codex executable reports the same version and hash. This supports preserving the existing bound-build check while fixing command-dependent placement; no separate build drift is observed for this saved route.No live session was opened or prompted, and no journal or provider record was edited. This is metadata diagnosis, not a claim that native resume has been executed successfully. Controlled regressions remain the acceptance evidence.