fix(code): make codex-review run on current codex-cli (ISS-11082)

[peterulsteen]

Summary

Fixes ISS-11082. code:codex-review failed on every round with a bare CODEX_FAILED:codex exited with code 2. /plan-with-codex uses the same script, so it failed too.

• run_codex_review.sh passed --full-auto to codex exec and codex exec resume. codex-cli 0.147 removed that flag (Remove legacy --full-auto handling from codex exec openai/codex#36054), so codex now exits 2 with error: unexpected argument '--full-auto' found.
• The script now passes -c sandbox_mode=read-only -c approval_policy=never, which both subcommands accept. -s read-only does not work here: codex exec resume rejects -s, so every resumed round would drop to a fresh session.
• --full-auto also set approval to never. codex exec defaults to never, except when the user's config sets approvals_reviewer = "auto_review", in which case the user's approval_policy applies (codex-cli 0.159.3, codex-rs/exec/src/lib.rs:757-790). The explicit -c approval_policy=never keeps the old behavior: with auto_review and on-request configured, exec and resume report approval: never on 0.154.0 and 0.159.3.
• codex's stderr is no longer sent to /dev/null. CODEX_FAILED now ends with one line saying why codex failed, taken from the first of these that exists:
  1. the last turn.failed message in the --json stream (or, if none, the last error message), because codex writes turn failures to stdout;
  2. the first stderr line that starts with error, which covers clap and config errors;
  3. the last stderr line, skipping codex's Reading ... from stdin... banner.
• The full stderr goes to the script's stderr, now also on both CODEX_EMPTY paths (exit 0 with no agent message). When a resume fails, the message now names the cause before the script falls back to a fresh session.
• plugins/code/hooks/plan-review.sh gets the same change: codex exec -c sandbox_mode=read-only -c approval_policy=never, with stderr appended to the hook's debug log instead of /dev/null (review, Mike).
• debate-loop.sh now prints the CODEX_FAILED reason with printf '%s' instead of echo -e. The reason is now codex's own text, and echo -e read the \c in C:\cache as "stop output", which cut the message short.

Compatibility

No version detection is needed. I probed every locally installed codex-cli build with --help, and the sandbox argument works across the whole range. The -c approval_policy=never override was probed on 0.154.0 and 0.159.3 only; it uses the same generic -c key=value mechanism as the sandbox override.

codex-cli	exec --full-auto	exec -c sandbox_mode=read-only	exec resume -c sandbox_mode=read-only	exec resume -s read-only
0.136.0 to 0.146.0 (12 builds)	accepted	accepted	accepted	rejected
0.154.0, 0.158.0	rejected	accepted	accepted	rejected

The reviewer's sandbox is now read-only instead of --full-auto's workspace-write. Nothing needs to write: Codex only reads the plan and the code, and the script writes the feedback file from the JSON stream. The callers (debate-loop.sh, plan-with-codex.md) match CODEX_FAILED:* by prefix, so the longer reason does not break them.

Versions

• code 1.16.3 -> 1.16.4

Testing

• New file plugins/code/tools/python/test_run_codex_review.py runs the script against a fake codex that rejects flags the way codex-cli 0.147+ does, and runs plan-review.sh against the same fake. All 12 tests pass at dbfe326. Review-round counterfactuals: dropping the approval flag fails the first-round, resume and fallback tests; dropping either CODEX_EMPTY stderr fails its case; restoring --full-auto or 2>/dev/null in the hook fails the hook tests.
• I checked each test by breaking the code it covers and running only that test. Each one failed:

Mutation	Test that failed, and what it saw
restore --full-auto	both round tests: CODEX_FAILED:codex exited with code 2: error: unexpected argument '--full-auto' found
use -s read-only	first round: config pair missing; resumed round: assert 2 == 1, a silent fresh-session fallback; resume-fallback test: wrong cause
restore 2>/dev/null	CLI-rejection, stderr-error, last-line and resume-fallback tests
unanchored error match	picks the ... ERROR codex_core::mcp ... tracing line
drop -m1	the token spills onto a second stdout line
drop the error-line preference	reports ... try '--help'.
use the first line instead of the last	reports WARNING: a notice
drop the banner filter	reports Reading additional input from stdin...
skip the JSON stream	reports the tracing line
prefer error over turn.failed	reports Reconnecting... 1/5
drop the resume reason	Codex session resume failed, starting fresh session...

• Real runs used codex-cli 0.158.0 with gpt-6-astra.
  • origin/main (ed495653) prints CODEX_FAILED:codex exited with code 2.
  • This branch returns a verdict and a session id in round 1, and round 2 resumes that session with no fallback. Both were run at 2e01f2d, before the review round.
  • An unsupported model now reports CODEX_FAILED:codex exited with code 1: {"type":"error","status":400,...,"message":"The 'bogus-model-xyz' model is not supported when using Codex with a ChatGPT account."}}.
  • Running codex exec -c sandbox_mode=read-only directly reports sandbox: read-only, even though the user config sets workspace-write.
• Gates:
  • uv run ruff check . is clean.
  • uv run pyright reports 0 errors.
  • uv run pytest plugins/ at the final head dbfe326: 2191 passed, 3 skipped. CI at dbfe326 is green.
• Review: two reviewers read the pinned diff and found no BLOCKING or HIGH issues.
  • Fixed: the removal version, the JSON-stream cause, the three unpinned behaviors, echo -e in the consumer, the empty (), and the fake codex's banner order.
  • Kept as-is: full stderr on failure goes to the diagnostic channel (not trimmed to 50 lines).

Follow-ups (not in this PR)

• plugins/code/hooks/plan-review.sh still uses gpt-5.3-codex-spark, which codex rejects for ChatGPT-account auth (now visible in the hook's debug log). The hook is not registered in hooks.json, so nothing runs it today.
• The default --codex-model gpt-5.3-codex in run_codex_review.sh and debate-loop.sh is rejected for ChatGPT-account codex auth (The 'gpt-5.3-codex' model is not supported when using Codex with a ChatGPT account., found in this machine's ~/.closedloop-ai/plan-with-codex/ logs).

🤖 Generated with Claude Code

[mikeangstadt]

Good fix, and the mutation table in the description is the kind of test evidence I wish every PR shipped with. Three non-blocking notes inline; the plan-review.sh one is the only one I'd consider pulling into this PR.