feat: add real-time permission and model mode synchronization close #21

Implements bidirectional sync of permission/model modes between CLI sessions and web app. Adds Codex-specific permission modes (read-only, safe-yolo, yolo) alongside Claude's modes. Web can now control CLI session state via RPC set-session-config handler, while CLI broadcasts state changes through keep-alive payloads. UI controls are flavor-aware, showing appropriate modes for Claude vs Codex vs Gemini. Type centralization in api/types eliminates circular dependencies.

cli/src/index.ts

@@ -118,12 +118,19 @@ import { getCliArgs } from './utils/cliArgs'
       const { runCodex } = await import('@/codex/runCodex');
 
       // Parse known arguments and collect unknown ones for passthrough
-      const options: { startedBy?: 'daemon' | 'terminal'; codexArgs?: string[] } = {};
+      const options: {
+        startedBy?: 'daemon' | 'terminal';
+        codexArgs?: string[];
+        permissionMode?: 'default' | 'read-only' | 'safe-yolo' | 'yolo';
+      } = {};
       const unknownArgs: string[] = [];
       for (let i = 1; i < args.length; i++) {
         const arg = args[i];
         if (arg === '--started-by') {
           options.startedBy = args[++i] as 'daemon' | 'terminal';
+        } else if (arg === '--yolo' || arg === '--dangerously-bypass-approvals-and-sandbox') {
+          options.permissionMode = 'yolo';
+          unknownArgs.push(arg);
         } else {
           unknownArgs.push(arg);
         }
@@ -327,7 +334,11 @@ ${chalk.bold('To clean up runaway processes:')} Use ${chalk.cyan('hapi doctor cl
         options.startingMode = z.enum(['local', 'remote']).parse(args[++i])
       } else if (arg === '--yolo') {
         // Shortcut for --dangerously-skip-permissions
+        options.permissionMode = 'bypassPermissions'
         unknownArgs.push('--dangerously-skip-permissions')
+      } else if (arg === '--dangerously-skip-permissions') {
+        options.permissionMode = 'bypassPermissions'
+        unknownArgs.push(arg)
       } else if (arg === '--started-by') {
         options.startedBy = args[++i] as 'daemon' | 'terminal'
       } else {