[codex] add Codex session selection support

[dsus4wang]

Summary

Adds Codex session selection to the new-session flow so users can browse and resume existing local Codex sessions from the web UI.

Changes

• Exposes Codex session discovery through the existing machine RPC flow.
• Adds a Codex session selector in the new-session UI.
• Passes selected Codex session ids through spawn/resume.

Validation

• Covered by included CLI, hub, and web tests for session discovery/spawn wiring.

[github-actions]

Findings

• [Major] Scope Codex session discovery to the runner workspace — listCodexSessions() currently walks every transcript under CODEX_HOME/sessions, so a runner started with --workspace-root can expose session titles and absolute paths from projects outside that root through /api/machines/:id/codex-sessions. Existing directory listing and spawn paths enforce the workspace root, but this new machine handler bypasses that boundary. Evidence: cli/src/modules/common/codexSessions.ts:194.

Questions

• None.

Summary

• Review mode: initial
• One issue found: Codex session discovery needs the same workspace-root scoping as the rest of machine browsing/spawn before exposing transcript metadata to the web UI.

Testing

• Not run: bun is not installed in this runner image (bun: command not found).

HAPI Bot

[github-actions]

[MAJOR] Scope Codex session discovery to the runner workspace. This walks every Codex transcript under CODEX_HOME/sessions, so a runner configured with --workspace-root can still expose titles and absolute paths for sessions outside that root through the new web endpoint. Existing machine directory/spawn paths enforce the workspace boundary; this new handler should filter the discovered sessions before returning them.

Suggested fix:

export async function listCodexSessions(
    request: ListCodexSessionsRequest = {},
    options: { workspaceRoot?: string } = {}
): Promise<{ sessions: CodexSessionSummary[]; nextCursor: string | null }> {
    const workspaceRoot = options.workspaceRoot ? await fs.realpath(options.workspaceRoot).catch(() => options.workspaceRoot) : null;
    // ...after building sorted:
    const scoped = workspaceRoot
        ? sorted.filter((entry) => entry.path && isPathWithinWorkspace(entry.path, workspaceRoot))
        : sorted;
    const filtered = includeOld ? scoped : scoped.filter((entry) => !entry.isOld);
}