feat: add goal resume guard / 添加目标续跑保护

[Yuimi-chaya]

中文说明

改动内容

• 新增“启用目标续跑保护”开关，默认关闭，不影响现有用户行为。
• 当 Codex++ 检测到 Codex goal 上下文时，在 Responses 中转请求里追加轻量保护提示。
• 保护提示要求恢复、压缩或续跑后优先当前 active goal 和 checkpoint 文件，避免把旧手动引导、旧摘要或旧 goal 结果当成新任务。
• 支持读取 .codexpp-goal-state.md 或 GOAL_STATE.md 作为恢复锚点，并要求长任务在完成小批次或阶段后及时更新 checkpoint。
• 补齐管理器 UI、设置保存/合并、英文 i18n 和 i18n key。
• 增加目标上下文检测、重复注入保护和 checkpoint 更新语义的单测。
• 同步上游一处 cdp_bridge.rs rustfmt 格式，保证 cargo fmt --check 干净通过。

功能入口

这个开关在 Codex++ 管理器的供应商设置里：进入对应供应商配置，在“Codex 目标”区块勾选“启用目标续跑保护”。它不是 Codex App 对话框内的按钮，也不是全局启动页入口。

修复原因

Codex App 在长目标任务中发生上下文压缩、手动中断或隔天恢复时，历史摘要和旧消息可能会混入当前上下文。实际风险是模型把旧的 manual steer、旧 goal token 或旧完成状态误当成当前任务，导致重复执行、回退到旧目标，或者在恢复时丢掉最新目标。

这个补丁不是替代 Codex App 的原生目标功能，而是在 Codex++ 的中转层提供一个可选兜底：只有开启开关且请求里确实包含 goal 上下文时才追加提示，普通对话不会被改写。

实测结果

本地做过一次高上下文真实压力测试：

• 先完成一个旧 raw goal，并产生旧 token。
• 在约 75% 上下文占用后创建新的 after-75 goal。
• 测试过程中真实触发 contextCompaction。
• 压缩后模型继续新 goal，而不是回到旧 raw goal。
• 用户中途手动中断，隔天从 AFTER_75_GOAL_STATE.md 恢复。
• 最终只接受新 token NEW_GOAL_SURVIVED_AFTER_75_20260706，没有执行 OLD_BAD，也没有把旧 token 当答案。

安全边界

• 默认关闭，需要用户主动开启。
• 只在检测到 goal 上下文的 Responses 请求中追加提示。
• 已有 guard marker 时不会重复注入。
• 不读取、不同步、不输出 auth、API key、真实用户配置或 prompt history。
• 不改变普通聊天、普通中转请求或非 goal 请求。

验证

• cargo fmt --check
• cargo test -p codex-plus-core goal_resume_guard
• cargo test -p codex-plus-core settings
• npm run check
• git diff --check
• 本地高上下文实测：真实 compact + 用户中断 + 状态文件恢复 + 最终新 goal token 胜出

English Summary

What changed

• Added an optional “goal resume guard” setting, disabled by default.
• When Codex++ detects Codex goal context, it appends a lightweight guard instruction to proxied Responses requests.
• The guard tells resumed or compacted work to prefer the current active goal and checkpoint files instead of replaying stale manual steering, old summaries, or previous goal results.
• It supports .codexpp-goal-state.md and GOAL_STATE.md as recovery anchors, and asks long-running goals to update checkpoints after meaningful small batches or completed stages.
• Added manager UI, settings persistence/merge support, English i18n, and i18n keys.
• Added tests for goal-context detection, duplicate-injection prevention, and checkpoint-update wording.
• Synced one upstream cdp_bridge.rs rustfmt-only formatting change so cargo fmt --check stays clean.

Feature Entry

The switch is in Codex++ Manager's provider settings. Open the target provider configuration, then enable “Goal Resume Guard” in the “Codex Goals” section. It is not a button inside the Codex App composer and not an entry on the global launch page.

Why

During long Codex goal runs, context compaction, manual interruption, or next-day resume can leave stale summaries and old messages close to the active context. The practical failure mode is that the model may treat an old manual steer, an old goal token, or an already-completed step as the current task, causing duplicated work or a rollback to a previous goal.

This patch does not replace Codex App's native goal feature. It adds an optional relay-layer guard in Codex++: the prompt is appended only when the setting is enabled and the request actually contains goal context. Regular chat requests are left untouched.

Validation Notes

A local high-context pressure test was run:

• Finished an older raw goal first, producing an old token.
• Created a new after-75 goal at roughly 75% context usage.
• A real contextCompaction occurred during the new goal.
• After compaction, the model continued the new goal instead of returning to the old raw goal.
• The user interrupted the run, then resumed later from AFTER_75_GOAL_STATE.md.
• The final answer accepted only NEW_GOAL_SURVIVED_AFTER_75_20260706, did not execute OLD_BAD, and did not use the old token as the answer.

Safety Boundary

• Disabled by default.
• Applies only to Responses requests that contain goal context.
• Skips duplicate injection when the guard marker already exists.
• Does not read, sync, or expose auth, API keys, real user config, or prompt history.
• Does not modify normal chat, normal relay requests, or non-goal requests.

Checks

• cargo fmt --check
• cargo test -p codex-plus-core goal_resume_guard
• cargo test -p codex-plus-core settings
• npm run check
• git diff --check
• Local high-context test: real compaction + user interruption + checkpoint resume + final latest-goal token win