refactor(codex): extract config building and support CLI overrides in remote mode

This refactoring introduces CLI argument overrides for sandbox and approval policy settings in remote mode, allowing users to specify security constraints via `--sandbox` and `--ask-for-approval` flags.

Changes:
- Add `CodexCliOverrides` type and `parseCodexCliOverrides()` utility to parse CLI flags like `--sandbox`, `-s`, `--ask-for-approval`, `-a`, along with convenience flags (`--full-auto`, `--dangerously-bypass-approvals-and-sandbox`)
- Extract complex start config building logic into `buildCodexStartConfig()` function with proper approval policy and sandbox resolution based on permission mode
- Thread `codexCliOverrides` through the session/loop/launcher chain and apply overrides only when permission mode is 'default'
- Update `codexRemoteLauncher` to use the new config builder and display appropriate warnings based on whether overrides are present
- Add comprehensive tests for both parsing and config building functions

cli/src/codex/utils/codexCliOverrides.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { parseCodexCliOverrides } from './codexCliOverrides';
+
+describe('parseCodexCliOverrides', () => {
+    it('parses sandbox and approval flags', () => {
+        expect(parseCodexCliOverrides(['-s', 'read-only', '-a', 'on-request'])).toEqual({
+            sandbox: 'read-only',
+            approvalPolicy: 'on-request'
+        });
+    });
+
+    it('parses long flags with equals syntax', () => {
+        expect(parseCodexCliOverrides(['--sandbox=workspace-write', '--ask-for-approval=never'])).toEqual({
+            sandbox: 'workspace-write',
+            approvalPolicy: 'never'
+        });
+    });
+
+    it('parses convenience flags', () => {
+        expect(parseCodexCliOverrides(['--full-auto'])).toEqual({
+            sandbox: 'workspace-write',
+            approvalPolicy: 'on-request'
+        });
+
+        expect(parseCodexCliOverrides(['--dangerously-bypass-approvals-and-sandbox'])).toEqual({
+            sandbox: 'danger-full-access',
+            approvalPolicy: 'never'
+        });
+    });
+
+    it('uses last value when flags repeat', () => {
+        expect(parseCodexCliOverrides(['--sandbox', 'read-only', '--sandbox', 'danger-full-access'])).toEqual({
+            sandbox: 'danger-full-access'
+        });
+
+        expect(parseCodexCliOverrides(['-a', 'untrusted', '-a', 'on-failure'])).toEqual({
+            approvalPolicy: 'on-failure'
+        });
+    });
+
+    it('ignores invalid values and stops at terminator', () => {
+        expect(parseCodexCliOverrides(['--sandbox', 'nope', '--ask-for-approval', 'bad'])).toEqual({});
+
+        expect(parseCodexCliOverrides(['-s', 'read-only', '--', '-a', 'never'])).toEqual({
+            sandbox: 'read-only'
+        });
+    });
+});

cli/src/codex/utils/codexCliOverrides.ts

@@ -0,0 +1,82 @@
+export type CodexCliOverrides = {
+    sandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
+    approvalPolicy?: 'untrusted' | 'on-failure' | 'on-request' | 'never';
+};
+
+const SANDBOX_VALUES = new Set<CodexCliOverrides['sandbox']>([
+    'read-only',
+    'workspace-write',
+    'danger-full-access'
+]);
+
+const APPROVAL_POLICY_VALUES = new Set<CodexCliOverrides['approvalPolicy']>([
+    'untrusted',
+    'on-failure',
+    'on-request',
+    'never'
+]);
+
+export function parseCodexCliOverrides(args?: string[]): CodexCliOverrides {
+    const overrides: CodexCliOverrides = {};
+    if (!args || args.length === 0) {
+        return overrides;
+    }
+
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--') {
+            break;
+        }
+
+        if (arg === '--full-auto') {
+            overrides.approvalPolicy = 'on-request';
+            overrides.sandbox = 'workspace-write';
+            continue;
+        }
+
+        if (arg === '--dangerously-bypass-approvals-and-sandbox') {
+            overrides.approvalPolicy = 'never';
+            overrides.sandbox = 'danger-full-access';
+            continue;
+        }
+
+        if (arg === '-s' || arg === '--sandbox') {
+            const value = args[i + 1];
+            if (SANDBOX_VALUES.has(value as CodexCliOverrides['sandbox'])) {
+                overrides.sandbox = value as CodexCliOverrides['sandbox'];
+                i += 1;
+            }
+            continue;
+        }
+
+        if (arg.startsWith('--sandbox=')) {
+            const value = arg.slice('--sandbox='.length);
+            if (SANDBOX_VALUES.has(value as CodexCliOverrides['sandbox'])) {
+                overrides.sandbox = value as CodexCliOverrides['sandbox'];
+            }
+            continue;
+        }
+
+        if (arg === '-a' || arg === '--ask-for-approval') {
+            const value = args[i + 1];
+            if (APPROVAL_POLICY_VALUES.has(value as CodexCliOverrides['approvalPolicy'])) {
+                overrides.approvalPolicy = value as CodexCliOverrides['approvalPolicy'];
+                i += 1;
+            }
+            continue;
+        }
+
+        if (arg.startsWith('--ask-for-approval=')) {
+            const value = arg.slice('--ask-for-approval='.length);
+            if (APPROVAL_POLICY_VALUES.has(value as CodexCliOverrides['approvalPolicy'])) {
+                overrides.approvalPolicy = value as CodexCliOverrides['approvalPolicy'];
+            }
+        }
+    }
+
+    return overrides;
+}
+
+export function hasCodexCliOverrides(overrides?: CodexCliOverrides): boolean {
+    return Boolean(overrides?.sandbox || overrides?.approvalPolicy);
+}

cli/src/codex/utils/codexStartConfig.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest';
+import { buildCodexStartConfig } from './codexStartConfig';
+
+describe('buildCodexStartConfig', () => {
+    const mcpServers = { hapi: { command: 'node', args: ['mcp'] } };
+
+    it('applies CLI overrides when permission mode is default', () => {
+        const config = buildCodexStartConfig({
+            message: 'hello',
+            mode: { permissionMode: 'default' },
+            first: true,
+            mcpServers,
+            cliOverrides: { sandbox: 'danger-full-access', approvalPolicy: 'never' }
+        });
+
+        expect(config.sandbox).toBe('danger-full-access');
+        expect(config['approval-policy']).toBe('never');
+        expect(config.config).toEqual({ mcp_servers: mcpServers });
+    });
+
+    it('ignores CLI overrides when permission mode is not default', () => {
+        const config = buildCodexStartConfig({
+            message: 'hello',
+            mode: { permissionMode: 'yolo' },
+            first: false,
+            mcpServers,
+            cliOverrides: { sandbox: 'read-only', approvalPolicy: 'never' }
+        });
+
+        expect(config.sandbox).toBe('danger-full-access');
+        expect(config['approval-policy']).toBe('on-failure');
+    });
+
+    it('passes model when provided', () => {
+        const config = buildCodexStartConfig({
+            message: 'hello',
+            mode: { permissionMode: 'default', model: 'o3' },
+            first: false,
+            mcpServers
+        });
+
+        expect(config.model).toBe('o3');
+    });
+});

cli/src/codex/utils/codexStartConfig.ts

@@ -0,0 +1,59 @@
+import { trimIdent } from '@/utils/trimIdent';
+import type { CodexSessionConfig } from '../types';
+import type { EnhancedMode } from '../loop';
+import type { CodexCliOverrides } from './codexCliOverrides';
+
+const TITLE_INSTRUCTION = trimIdent(`Based on this message, call functions.hapi__change_title to change chat session title that would represent the current task. If chat idea would change dramatically - call this function again to update the title.`);
+
+function resolveApprovalPolicy(mode: EnhancedMode): CodexSessionConfig['approval-policy'] {
+    switch (mode.permissionMode) {
+        case 'default': return 'untrusted';
+        case 'read-only': return 'never';
+        case 'safe-yolo': return 'on-failure';
+        case 'yolo': return 'on-failure';
+        default: {
+            throw new Error(`Unknown permission mode: ${mode.permissionMode}`);
+        }
+    }
+}
+
+function resolveSandbox(mode: EnhancedMode): CodexSessionConfig['sandbox'] {
+    switch (mode.permissionMode) {
+        case 'default': return 'workspace-write';
+        case 'read-only': return 'read-only';
+        case 'safe-yolo': return 'workspace-write';
+        case 'yolo': return 'danger-full-access';
+        default: {
+            throw new Error(`Unknown permission mode: ${mode.permissionMode}`);
+        }
+    }
+}
+
+export function buildCodexStartConfig(args: {
+    message: string;
+    mode: EnhancedMode;
+    first: boolean;
+    mcpServers: Record<string, { command: string; args: string[] }>;
+    cliOverrides?: CodexCliOverrides;
+}): CodexSessionConfig {
+    const approvalPolicy = resolveApprovalPolicy(args.mode);
+    const sandbox = resolveSandbox(args.mode);
+    const allowCliOverrides = args.mode.permissionMode === 'default';
+    const cliOverrides = allowCliOverrides ? args.cliOverrides : undefined;
+    const resolvedApprovalPolicy = cliOverrides?.approvalPolicy ?? approvalPolicy;
+    const resolvedSandbox = cliOverrides?.sandbox ?? sandbox;
+
+    const prompt = args.first ? `${args.message}\n\n${TITLE_INSTRUCTION}` : args.message;
+    const startConfig: CodexSessionConfig = {
+        prompt,
+        sandbox: resolvedSandbox,
+        'approval-policy': resolvedApprovalPolicy,
+        config: { mcp_servers: args.mcpServers }
+    };
+
+    if (args.mode.model) {
+        startConfig.model = args.mode.model;
+    }
+
+    return startConfig;
+}