fix(codex): pick up new sessions; stop misattributing active processes (#209)

[NovakPAai]

Fixes #209.

Summary

Three related bugs in the Codex integration that hit long-running codbash servers — especially on Linux with multiple concurrent Codex sessions:

1. New ~/.codex/sessions/**/*.jsonl files are not picked up. _sessionsNeedRescan() only watched Claude paths (~/.claude/history.jsonl, ~/.claude/projects/). New Codex sessions never invalidated the cache.
2. /api/active cwd lookup returns garbage. On Linux lsof -a -p <pid> -d cwd -Fn can emit /proc/<n>/cwd (readlink: Permission denied); the regex /\nn(\/[^\n]+)/ captured the whole thing, then the cwd→session match failed.
3. Multiple live Codex processes mapped to the same fallback-latest session. When cwd was known but no session matched it, the code still confidently attributed the process to "the latest session of this tool".

Changes

src/data.js

• Extend _sessionsNeedRescan() + _updateScanMarkers() to also track:
  • ~/.codex/history.jsonl mtime + size
  • ~/.codex/session_index.jsonl mtime + size
  • per-day mtimes of ~/.codex/sessions/YYYY/MM/DD (new _codexDayDirMtimes() helper)
• Walk the day-dir tree exactly once per rescan check (stashed in _codexDayDirMtimesPending) and reuse the result in _updateScanMarkers() — avoids a TOCTOU race between two independent walks.
• In getActiveSessions():
  • Prefer fs.readlinkSync('/proc/<pid>/cwd') on Linux (guarded by Number.isFinite(pid) && pid > 0).
  • lsof regex changed to /^n(\/[^\n]*)/m (multiline anchor, no leading-newline dependency).
  • Strip lsof's trailing " (readlink: …)" annotation.
  • Reject /proc/* pseudo-paths (they cannot match a real session project).
  • Among multiple sessions sharing the same cwd, pick the most recently active one (last_ts desc) instead of the first hit.
  • Drop fallback-latest when cwd is known — set sessionId = '' and _sessionSource = 'unmatched' instead of confidently misattributing.

src/frontend/app.js

• pollActiveSessions() and renderRunningCard() now key unmatched entries (sessionId === '') by a synthetic pid:<pid> so they remain visible on the Agent Board (Focus button keeps working — focusSession uses a.pid regardless).

Test plan

• node --test test/*.test.js → 41/42 pass; 1 pre-existing fail in wsl-windows.test.js (verified on origin/main without these changes)
• Smoke: loadSessions() returns cached identity on repeat call; getActiveSessions() works on macOS with live Claude processes
• Manual verify on Linux VPS with concurrent Codex sessions: new ~/.codex/sessions/2026/05/14/rollout-*.jsonl appears in /api/sessions without restart; /api/active no longer shows multiple processes all sharing the same fallback-latest session
• _sessionSource: 'unmatched' entries appear on the Agent Board with PID-only labelling

Reviewer notes

The review (code-reviewer agent) surfaced 2 HIGH (double walk / Agent Board invisibility) — both fixed. 3 MEDIUM and 2 LOW accepted with reasons documented in the commit body.

[vakovalskii]

LGTM ✅ Clean fix for #209, addresses all three root causes from the bug report:

Verified:

• node -c clean on both touched files
• 40/42 tests pass, 1 skip (HOME-as-git-root from #212), 1 fail (wsl-windows, pre-existing on main)
• CI green 6/6

Spot-checks:

• Codex cache invalidation: _codexDayDirMtimesPending neatly stashes the walk result inside _sessionsNeedRescan() for reuse in _updateScanMarkers() — closes the TOCTOU window cleanly without doubling FS work 👏
• /proc/<pid>/cwd readlink guarded by Number.isFinite(pid) && pid > 0 — defensive
• lsof regex ^n(\/[^\n]*)/m with the (readlink: …) strip + /proc/* reject handles the exact failure mode reported in #209
• cwd-match candidate ordering by last_ts desc fixes the symptom where multiple concurrent Codex processes collapsed to one entry
• The asymmetric fallback (unmatched when cwd known, fallback-latest only when cwd absent) is the right call — better to surface an honest 'we don't know' on the Agent Board than confidently misattribute
• Synthetic pid:<pid> key in pollActiveSessions keeps unmatched entries visible without breaking focusSession (which keys on a.pid)

Thanks @NovakPAai!