fix(codex): run agents with danger-full-access (no bubblewrap)

[aterrylu]

Problem

A1 (#228) split Codex spawns into an app-server daemon + a codex --remote TUI, and set the sandbox to danger-full-access only on the daemon. But the TUI creates the thread and forces its own default (workspace-write), which on Linux emits:

warning: Codex could not find bubblewrap on PATH...

So autonomous Codex agents on Linux still ran sandboxed (and wanted bwrap), contrary to intent — autonomOS is the trust boundary and shouldn't use Codex's OS sandbox at all.

Root cause (verified on forge / Linux, no bwrap installed)

Codex's sandbox is negotiated at two layers and they must agree. Matrix:

daemon	TUI	bubblewrap
-c sandbox_mode=dfa (= A1)	plain	⚠ WARN
plain	-s dfa	⚠ WARN
-c sandbox_mode=dfa	-s danger-full-access	✅ none
-c sandbox_mode=dfa	--dangerously-bypass-approvals-and-sandbox	✅ none

Fix

• Daemon (buildSidecar): always -c sandbox_mode="danger-full-access" (was autonomous-only). -c approval_policy="never" stays autonomous-only.
• TUI (buildArgs): autonomous → --dangerously-bypass-approvals-and-sandbox (the CC --dangerously-skip-permissions equivalent — no approvals + no sandbox); supervised → -s danger-full-access (no sandbox, keep approval prompts).

Net: no bubblewrap ever; approvals bypassed for autonomous, kept for supervised.

Testing

• Unit tests updated (both layers, both modes); full server suite green, biome + tsc clean.
• Verified end-to-end on forge: the autonomous combo (daemon -c dfa + TUI --dangerously-bypass-approvals-and-sandbox) and the supervised combo (-s danger-full-access) both run a real echo with no bubblewrap warning.

🤖 Generated with Claude Code

[nox-0x]

Approving — clean two-layer fix to a real bug from #228 (daemon-only sandbox flag loses to the TUI's workspace-write default; both layers must agree). Matrix in the PR body matches the implementation, end-to-end verification on Linux is convincing, and tests now lock down both modes on both layers (daemon always-DFA + autonomous-only approval, autonomous TUI bypass vs. supervised -s danger-full-access). Comments in codex.ts:51-65 and 138-148 explain the why so a future reader won't accidentally re-collapse one of the layers.

One non-blocking observation: the legacy in-process fallback path (buildArgs without sidecarEndpoint) still relies on daemonConfigArgs()'s -c sandbox_mode alone in supervised mode (no -s flag on the TUI). For the pure-TUI case there's no second layer to disagree, so it should be fine — but worth keeping in mind if the legacy path ever gets exercised again.