feat(cli): user-facing warning registry + startup banner

[emal-avala]

Summary

Non-fatal warnings (dangerous flags, missing dependencies, deprecations) previously went to tracing::warn! which routes to logs — users rarely look at logs. Added a process-wide services::warnings registry that the REPL renders as a bannered block at startup and an easy API for any code path to enqueue a warning.

───────────────────────────────────────────────────────────────
 [WARN]  All permission checks disabled (--dangerously-skip-permissions).
         The agent can run any tool without confirmation.
 [WARN]  Process-level sandbox disabled for this session (--no-sandbox).
         Tool calls are not isolated.
───────────────────────────────────────────────────────────────

API

use agent_code_lib::services::warnings;

warnings::warn("--no-sandbox disables process isolation");   // severity WARN
warnings::info("Using experimental feature X");              // severity INFO
warnings::snapshot();                                         // read without clearing
warnings::clear();                                            // user-dismiss or test-reset

The registry de-duplicates on push (by level + message) so callers can re-push on every check without flooding the banner.

Wiring

Initial sources in main.rs:

Condition	Severity	Message
--dangerously-skip-permissions	WARN	permission bypass notice
--no-sandbox (sandbox disabled)	WARN	isolation-off notice
--no-sandbox ignored by security gate	WARN	ignored-notice

The banner renders to stderr so it doesn't contaminate stdout when the REPL output is piped.

Why stderr and not the existing tracing::warn! path?

tracing::warn! writes with a log-formatter prefix and is invisible unless RUST_LOG=warn is set. Users expect dangerous-flag warnings to be visible by default without opting in to logging. Both sources fire together (tracing keeps the log entry for telemetry, banner surfaces the user-facing message).

Test plan

• cargo fmt --all — clean
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test -p agent-code-lib --lib services::warnings — 5/5 pass
  • push_and_snapshot_roundtrip
  • duplicate_push_is_ignored
  • different_levels_same_message_are_distinct
  • clear_empties_registry
  • snapshot_does_not_drain
• cargo test -p agent-code --test smoke — 4/4 pass
• Manual: agent --dangerously-skip-permissions → banner renders at REPL startup; normal startup → no banner

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.