Port fresh-agent foundation to main

[danshapiro]

Summary

Clean main-targeted replacement for the dev-targeted fresh-agent foundation from PR #334 (freshcodex-contract-foundation). This keeps the port bounded to the fresh-agent prerequisite needed before later 6e03da80 can be represented on main.

This preserves the PR #334 foundation payload from 6adca421b8fb34779b484a05a9497921e4b48021..0e67ac48c7ef4d21af0955ac2ff8eb577de05884, including:

• canonical fresh-agent pane kind and shared contracts
• client pane/store/UI, persistence migrations, tab/sidebar integration, and websocket client handling
• websocket protocol and server runtime manager/router/adapters for freshclaude/freshcodex
• Codex app-server rich thread/read/turn contract support needed by freshcodex
• focused unit, integration, and browser e2e coverage

Main-specific conflict resolution retained current origin/main Codex app-server sidecar ownership/list-loaded behavior and added explicit Codex approval-policy validation at the launch boundary.

Supersedes the dev-targeted content from PR #334 for main-targeted review purposes. PR #334 is already merged to dev, but this PR is the clean main replacement.

Verification

• npm run test:vitest -- test/unit/server/coding-cli/codex-app-server/client.test.ts test/unit/server/coding-cli/codex-app-server/runtime.test.ts (70 passed)
• npm run typecheck:client
• npm run typecheck:server
• npm run test:vitest -- test/unit/client/components/fresh-agent/FreshAgentView.test.tsx test/unit/client/components/fresh-agent/FreshAgentTranscript.test.tsx test/unit/client/components/fresh-agent/FreshAgentDiffPanel.test.tsx test/unit/client/components/TabsView.fresh-agent.test.tsx test/unit/client/store/freshAgentSlice.test.ts test/unit/client/lib/fresh-agent-ws.test.ts test/unit/client/store/persisted-state.fresh-agent.test.ts test/unit/client/store/storage-migration.fresh-agent.test.ts test/e2e/agent-chat-restore-flow.test.tsx test/e2e/agent-chat-resume-history-flow.test.tsx (29 passed)
• npm run test:vitest -- --config vitest.server.config.ts test/unit/server/fresh-agent/claude-adapter.test.ts test/unit/server/fresh-agent/claude-normalize.test.ts test/unit/server/fresh-agent/claude-restore-contract.test.ts test/unit/server/fresh-agent/codex-adapter.test.ts test/unit/server/fresh-agent/codex-normalize.test.ts test/unit/server/fresh-agent/router.test.ts test/unit/server/fresh-agent/runtime-manager.test.ts test/unit/server/ws-handler-fresh-agent.test.ts test/unit/server/agent-api/layout-store.fresh-agent.test.ts test/unit/server/session-directory/fresh-agent-projection.test.ts test/unit/server/coding-cli/codex-app-server/schema-traceability.test.ts (32 passed)
• npm run build (passed; Vite emitted existing large-chunk warnings)
• npm run test:e2e:chromium -- test/e2e-browser/specs/fresh-agent.spec.ts test/e2e-browser/specs/fresh-agent-mobile.spec.ts (4 passed)
• git diff --check origin/main..HEAD

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b2657d5662

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resume using sessionRef when resumeSessionId is missing

Cross-device restore now produces fresh-agent panes with sessionRef but no resumeSessionId (see sanitizePaneSnapshot for non-local records), and FreshAgentView forwards that payload to freshAgent.create. In this manager, create() only calls adapter.resume() when resumeSessionId is present, so these restores silently start a brand-new session instead of resuming the durable thread identified by sessionRef, which can fork conversations and lose continuity when reopening synced tabs.

Useful? React with 👍 / 👎.