[loopx-agent]

A registered Agent can have several original Codex App conversations. The existing directory returns them, but the work-record page chose the first row and the backend rejected every read as ambiguous. This makes valid saved work unreadable.

The existing Agent entry now offers an exact conversation choice. Each binding mounts its own original reader, live observation, draft and pending receipt; refresh preserves the choice. A revoked choice stays unavailable instead of opening the sole remaining conversation. Read, open and input still use the original host and exact binding; a thread claimed by two registered Agents is rejected.

This delivers selection and continued reading/replies for already-bound local Codex App threads. It does not create, remap, resume or fork Sessions. Managed-session discovery and the unified managed/attached Agent journey remain separate work; this does not close the broader workspace or two-surface acceptance.

The implementation reuses the original binding and input owners. The only local split separates discovery/selection from a keyed reader lifecycle, removing obsolete optional-binding branches rather than creating a second store or authority.

Validation: 59 real HTTP/SQLite/JSONL and disposable Desktop-peer tests; the full packaged attached-host-follow-up scenario, including stale selection, delayed reads, independent drafts, full paging/live/tool records, busy/recovery and original input behavior; TypeScript, Chat build, CSS tokens and Node syntax. Standard premerge passed 6 direct and 5 selected checks with no automatic failures; its 5 binary-image manual holds are retained and all five synthetic images were inspected. Exact-scope CQR is valid. No remote CI was queried under the configured local-validation policy.

Earlier failures remain recorded: a new fixture initially omitted the native completion timestamp, existing unavailable-state assertions expected now-on-demand prose, and copying baseline assets into a generated bundle left an invalid inventory. The fixture/assertions and generated bundle were corrected; final checks passed. These were not relabeled as historical passes.

Visual evidence

Final source content: 03ada5e49d02b6d8f151559fb06ee2086c393a83; comparison base: 35031332795ee7417f56f6a7582e09cc3a75458a. These are packaged synthetic pages with a real isolated HTTP/SQLite/JSONL owner and disposable host peer. The before comparison uses the base frontend and its exact binding selector on the same two saved conversations. Both versions made zero input attempts. No live workspace, private conversation or installed-App context is published.

Default versus detail: select the original Session once, then read its actual conversation and single composer. Full host identity remains in the selection; tool processes stay expandable and failures/unknowns remain visible. The long-content view retains complete conversation prose; reading and switching do not execute work. Desktop and 390px were inspected, including the populated mixed-state work record. These captures qualify the packaged boundary, not installed adoption or a complete managed-session design.

State	Capture
Before, desktop: both valid Sessions unreadable
After, desktop: exact original Session readable
Before, 390px
After, 390px
Populated work with long dialogue and an unconfirmed check

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

用户从 Goal 进入注册 Agent 的工作记录，要回看该 Agent 已经存在的原宿主会话。 同一 Agent 绑定两条 Codex 原会话时，旧页面选择首条记录，后端却把多条合法绑定全部拒为歧义；现在在同一 Agent 内选择确切会话，读到它自己的历史。 完整原文、草稿和投递回执按原会话隔离，刷新保留选择；失效选择不会自动跳到其它会话，阅读和切换不启动执行。 本次只交付已绑定本机 Codex 会话的发现、选择与原路径继续，不新建、改归属、恢复或分叉任何真实会话。 managed 与 attached 的统一发现、完整双端交付和真实输入法验收仍未由本段结清；安装采用在合并后单独读回。

这是已存在工作无法访问的问题，不是为新功能补一组样例。接口目录早已能列出同一注册 Agent 的多条绑定，但后续验证把 Agent 和某一条会话混在一起。只反复重连不能解除这个拒绝；反过来，自动取首条又无法代表用户真正要读哪一段历史。我用同一组两个原生记录对照了主干与当前内容：主干确实拒绝，修改后能从既有工作入口选择并阅读，且阅读过程没有投递消息。

改动思路

复用原绑定、宿主历史与输入回执 owner，把发现和选择留在外层，以精确绑定为 key 挂载原读者；删除失去意义的可选绑定分支，不增加 Session 存储、迁移或执行权威。

当前 PR 解决同一注册 Agent 的多条现有 Codex 原会话无法阅读和精确继续的问题；managed 会话归属及 Lark 同步不混入这一交付。

最小路线既不是新建一套会话管理，也不是让用户复制宿主标识再配置。单一原会话沿用直接打开，多条时才给出一个原位选择；这是无法从现有信息推导的阅读意图，不是新增权限确认。后端只承认确切绑定，前端只记住用户看哪条记录。已保存选择失效时保持不可用，不能因为还剩一条记录就替用户切走。原宿主负责执行，原消息回执负责恢复；这两个阶段都没有因为页面更容易读而获得额外授权。

输入	主干	当前版本
一条合法原会话	直接读原记录	保留
同 Agent 两条合法原会话	选首条后仍被歧义规则拒绝	精确选择后读取对应原记录
原选择消失，还剩其它会话	没有这条多会话路径	不替换、不串草稿，明确显示绑定已变更
同一宿主线程归属冲突	不足以可靠区分	拒绝读取与投递，保留原恢复入口

这张表是当前代码的解释，不代替执行证据。真正决定可读和可回复的仍是当前来源及宿主读回。

具体改动

书面设计依据为 docs/development/design.md@35031332795ee7417f56f6a7582e09cc3a75458a。earn-the-users-attention 对应现有 Agent 入口内一个必要选择和对话主体；explanations-on-demand 保留完整工作正文、可展开工具与真实失败，未把原文藏成提示；populated-page-review 覆盖同输入前后桌面、390px和长内容混合状态，五张公开合成图直接在 PR 描述中。原宿主为历史事实源的边界另核对了同版本的 session runtime adapter，没有建立第二事件库。

关键代码讲解

• current_binding：Validate exact source identity before reading or host input. Agent cardinality-one becomes exact Agent/ref uniqueness with a conflicting-thread owner refusal.
• AttachedAgentConversations：Discover only the requested registered Agent and select its original Session. First-row Agent selection becomes one exact Session choice; a stored stale choice stays unavailable.
• AttachedConversation：Own one exact original reader and pending-input lifecycle. Original paging/live/input code is retained behind binding-keyed mount, with impossible optional-binding branches removed.

Python 规则现在同时检查 Agent 和已有 binding_ref 的唯一匹配，合法的第二条记录不再使第一条失效；若同一宿主线程仍有不同注册 owner，所有相关操作拒绝。现有读取、打开、实时观察和输入共用这一条验证，没有各自再造准入。前端外层只发现目标 Agent 的记录并记忆阅读意图，内层保留原分页、流、草稿和回执实现；更换绑定时旧读者卸载，迟到回复不能进入新读者。

原 HTTP 测试增加独立第二条 SQLite/JSONL 记录，实际检查第二线程的投递、打开、重复操作和跨回执拒绝；宿主 peer 根据收到的确切线程写回对应隔离记录，而不是由 mock 直接给出目标正确结论。原完整浏览器场景补上多条选择、两个草稿、刷新、迟到读取与失效选择的反例，继续执行全部原历史、工具、实时观察和失败恢复断言。改动的 12 个路径中有 5 个是逐张检查过的合成截图，未加入真实机器、私聊或运行材料。

对主干的风险

最危险的反例是后端放开多条后，前端把旧会话的历史、草稿或未确认投递带入另一条会话。已经从实际 HTTP 与打包读者两侧挑战它：第二条消息只写到第二个原记录，原记录不变；重复操作只投递一次，跨会话回执、旧 lifetime 和竞争归属拒绝且无新增输入。浏览器故意延后第一条的真实读取，在切到第二条后才放回；第二条仍只显示自己的正文和草稿。另一反例是失效选择被当成没有偏好，在只剩其它一条时自动打开它；完整场景明确检查此时没有回复框，并在来源恢复后读回原选择和草稿。

59 组真实隔离 HTTP/SQLite/JSONL 与宿主 peer 测试通过，完整打包 attached-host-follow-up 最终通过，包含单一原会话的原有行为。TypeScript、Chat 构建、CSS token、Node 语法、RFC 与差异检查通过。标准本地预合并 6 个直接和 5 个选择检查没有自动失败；CQR cqr_1fef0b3b0f6ef3c0130d 有效。5 个二进制图像 hold 仍在机器报告中，已分别检查像素与合成来源，没有把人工核验说成自动消失。

早期新 fixture 缺少原生完成事件时间戳导致 1 失败、58 通过，修正原生数据后 59 通过；旧测试仍等已收进帮助的正文，现按真实 glyph 打开再检查；生成目录混入基线资源时清单校验失败，恢复准确生成内容后完整测试通过。私有截图准备的入口/语言未设妥也曾失败，最终相同输入对照才用于评审。原断言、失败记录和超时限制均保留，未把历史失败改称成功。当前策略不查询远端 CI，这次未获取任何 CI 状态。

语义与 CI 对齐

新增选择不把 codex 执行器当注册 Agent，也不从“绑定存在”推导运行或工具权限。原 binding_ref 与回执格式没有变化，不加兼容版本；已注册新原会话可单独发现，未注册、错误来源、旧生命周期和冲突线程不能借同 Goal 逃逸。前端的选择是用户阅读意图，不是机器 obligation；没有改 Core 工作、调度、结算或 Agent 提示。语义 advisory 未发现其支持的新载体，但其范围有限，不能当作任意 TSX 语义证明，实际行为由上述正反例约束。

我的整体评价

这是一段可以独立使用和回滚的修正，长程路径判断为 preserved：原始历史和未完成投递仍由原宿主与原回执恢复，没有新存储迁移或重放。用户体验判断为 improved：从完全读不到两条现有记录，到在原 Agent 内明确选择后读到对应内容；不要求额外授权、复制命令或启动模型。225 行新增、44 行删除主要来自已有读者的生命周期分离、两侧集成断言与公开证据，边界与实际问题相称；只改后端或只改控件都留下同一任务的断点。

已逐张检查同输入前后桌面和 390px，以及长正文、工具折叠和失败状态：原先空白加绑定错误变为一个会话选择控件与真实对话；单一输入框仍在底部，未知或失败没有被收起。

选择器仍使用原宿主身份区分会话，尚未提供更易辨认的原生标题；未把合成图当作安装采用、完整 managed 层级、独立理解度或量化长程收益。

我建议批准准确 head 03ada5e49d02b6d8f151559fb06ee2086c393a83。这一评价只覆盖已声明的原会话切换与继续，后续仍需原流程的发布读回、审批 closeout、准确 head merge readiness 和既有合并授权；单凭合入或本次 UI 修正不能结清整个工作台目标。

English verdict: APPROVE — 03ada5e49d02b6d8f151559fb06ee2086c393a83. Multiple accepted original Codex conversations are now individually readable and addressable inside their registered Agent. Exact binding, stale-choice, delayed-read, draft, receipt, lifetime and conflicting-owner cases are covered by real isolated HTTP/native-peer tests and the full packaged scenario. Existing sole-Session behavior and original-host execution remain intact; local checks/CQR passed and five visual holds were inspected manually. Installed adoption, readable native titles and the full managed/attached and dual-surface journey remain separate.