Launch Codex in YOLO mode by default

Author: bproject07

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
       version:
         description: Package version to build and validate without publishing
         required: true
-        default: "0.2.2"
+        default: "0.2.3"
         type: string
 
 permissions:

AGENTS.md

@@ -161,11 +161,15 @@ Unix:
 
 Do not unify these paths through a generic shell command string. The command
 configuration intentionally rejects arbitrary shell expressions.
-Optional Claude and AGY dangerous-mode switches append only the fixed upstream
-`--dangerously-skip-permissions` argument. Unix and Windows `cmd` launches keep
-it as a distinct process argument. The Windows PowerShell wrapper must encode
-each fixed argument as an independently single-quoted literal with embedded
-quotes escaped. Never accept executable arguments from the browser API.
+Every Codex profile appends only the fixed upstream `--yolo` argument; this
+applies to the primary terminal, **New**, restarts, and dedicated peer
+reviewers, including executable overrides. Version probes remain exactly
+`codex --version`. Optional Claude and AGY dangerous-mode switches append only
+the fixed upstream `--dangerously-skip-permissions` argument. Unix and Windows
+`cmd` launches keep fixed arguments distinct. The Windows PowerShell wrapper
+must encode each fixed argument as an independently single-quoted literal with
+embedded quotes escaped. Never accept executable arguments from the browser
+API.
 
 Agent auto-detection is also a platform boundary:
 

OPERATIONS.md

@@ -440,6 +440,13 @@ only the inherited nesting markers `CODEX_THREAD_ID` and `CLAUDECODE` before
 version checks and PTY startup; authentication and provider environment
 variables remain untouched.
 
+Every Codex profile receives one fixed `--yolo` process argument. This applies
+to the primary terminal, **New**, restarts, and dedicated `@cwt` reviewers,
+including trusted executable overrides. It disables Codex approval prompts and
+sandboxing. The bounded discovery probe remains exactly `codex --version`.
+There is currently no server or browser opt-out, so custom Codex wrappers must
+accept or forward `--yolo`.
+
 To deliberately auto-approve every tool action for both optional profiles:
 
 ```powershell
@@ -743,9 +750,10 @@ entry or closing its peer thread. Each entry has its own lifecycle, output
 replay buffer, and connected-client count; each running entry also owns a full
 agent process.
 
-When a dangerous-mode switch is active, the card warns that approvals are
-disabled and the agent may edit files and run commands without asking for
-confirmation.
+The Codex card always warns that approvals are disabled because the server
+launches Codex with `--yolo`. Claude and AGY cards show the same warning when
+their dangerous-mode switch is active. Such agents may edit files and run
+commands without asking for confirmation.
 
 ### Connect / Reconnect
 

README.md

@@ -324,6 +324,12 @@ authentication. Codex Web Terminal neither copies nor reads agent credentials.
 Each child inherits the server account's environment and existing CLI
 configuration.
 
+Every Codex terminal is launched as `codex --yolo`, including the primary
+terminal, **New**, restarts, and dedicated `@cwt` reviewers. This fixed mode
+disables Codex approval prompts and sandboxing. It is not used for the
+read-only `codex --version` discovery probe. Run Codex Web Terminal only under
+an operating-system account and on workspaces whose full access is acceptable.
+
 The browser shows missing or misconfigured agents together with an official
 manual command and verification command. Run the command in a trusted terminal
 on the **server host**, then choose **Refresh** or **Check again**. There is
@@ -671,10 +677,12 @@ Command values are treated as executable names or file paths, not as arbitrary
 shell expressions. A discovered `.cmd` entry point is always invoked through
 `cmd.exe /d /s /c` on Windows, which is required for the npm Codex package. On
 Unix, the resolved executable is launched directly without a shell wrapper.
-The two permission switches add one fixed argument to the selected process.
-On Unix and Windows `cmd` launches it remains a distinct process argument. The
-Windows PowerShell wrapper encodes it as a single-quoted literal with embedded
-quotes escaped. It cannot be selected or altered by a browser client.
+Codex always receives the fixed `--yolo` argument. The two optional permission
+switches add the fixed upstream `--dangerously-skip-permissions` argument to
+Claude or AGY. On Unix and Windows `cmd` launches each remains a distinct
+process argument. The Windows PowerShell wrapper encodes each as a
+single-quoted literal with embedded quotes escaped. These arguments cannot be
+selected or altered by a browser client.
 
 With auto-detection enabled (the default), the primary executable name follows
 `--primary-agent`, and the server probes `codex`, `claude`, and `agy` plus
@@ -702,8 +710,12 @@ paths are useful for services with a restricted `PATH`:
   --agy-command "$env:LOCALAPPDATA\agy\bin\agy.exe"
 ```
 
+Codex starts as `codex --yolo` without an additional server switch. This
+disables both Codex approvals and sandboxing for the primary session, **New**,
+restarts, and `@cwt` reviewers.
+
 Add the following switches only in a trusted, isolated environment when every
-tool action should run without a permission prompt:
+Claude or AGY tool action should run without a permission prompt:
 
 ```text
 --claude-dangerously-skip-permissions
@@ -1036,11 +1048,13 @@ strip scrolls horizontally when it overflows; it does not send `/new` or
 
 This process has the same operating-system permissions and environment as the
 user who starts it. Anyone with the authenticated URL can interact with the
-selected agent, approve actions it presents, and potentially cause commands to
-run in any directory readable by that operating-system account. The same token
-authorizes filesystem-root discovery, directory browsing, manual absolute-path
-resolution, Favorites/Recent access, and PTY launch. `--project` is only the
-default working directory; it is not a sandbox or an authorization boundary.
+selected agent and potentially cause commands to run in any directory readable
+by that operating-system account. Codex sessions always use `--yolo`, so Codex
+approval prompts and sandboxing are disabled; Claude and AGY can be configured
+similarly. The same token authorizes filesystem-root discovery, directory
+browsing, manual absolute-path resolution, Favorites/Recent access, and PTY
+launch. `--project` is only the default working directory; it is not a sandbox
+or an authorization boundary.
 
 Security measures in this application:
 
@@ -1330,6 +1344,8 @@ when available.
 - Dedicated peer tabs isolate conversational context from ordinary tabs, but
   are not an operating-system security boundary. All configured CLIs run as
   the same server account.
+- Every Codex session receives `--yolo`; Codex approvals and sandboxing are
+  therefore disabled. There is currently no server or browser opt-out.
 - Agent CLIs must use their tool runner to call the loopback peer helper.
   Provider policy, sandboxing, or a declined tool call can leave a supervised
   turn waiting; terminal output is never parsed to infer completion.

SECURITY.md

@@ -15,6 +15,12 @@ operating-system account running the server. Successful launches also update
 Recent. The terminal process inherits that account's permissions and
 environment.
 
+Every Codex process is launched with `--yolo`, which disables Codex approvals
+and sandboxing. This applies to the primary terminal, new and restarted
+sessions, and dedicated `@cwt` reviewers. There is currently no server or
+browser opt-out. Treat possession of the bearer token as authority to cause
+unprompted Codex actions with the full permissions of the server account.
+
 All `/api/filesystem/*`, `/api/workspaces*`, and session endpoints require the
 same bearer token. Directory IDs preserve native Windows UTF-16 or Unix path
 bytes as an opaque API transport value. They are neither secret nor encrypted,

server/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "codex-web-terminal"
-version = "0.2.2"
+version = "0.2.3"
 edition = "2024"
 rust-version = "1.88"
 description = "Run Codex, Claude, and AGY CLIs in native PTYs from a browser"

server/Cargo.toml

@@ -227,17 +227,20 @@ fn agent_command_override(config: &Config, agent: AgentKind) -> Option<String> {
 
 fn dangerously_skip_permissions(config: &Config, agent: AgentKind) -> bool {
     match agent {
-        AgentKind::Codex => false,
+        AgentKind::Codex => true,
         AgentKind::Claude => config.claude_dangerously_skip_permissions,
         AgentKind::Agy => config.agy_dangerously_skip_permissions,
     }
 }
 
 fn agent_arguments(config: &Config, agent: AgentKind) -> Vec<String> {
-    dangerously_skip_permissions(config, agent)
-        .then(|| "--dangerously-skip-permissions".to_owned())
-        .into_iter()
-        .collect()
+    match agent {
+        AgentKind::Codex => vec!["--yolo".to_owned()],
+        AgentKind::Claude | AgentKind::Agy => dangerously_skip_permissions(config, agent)
+            .then(|| "--dangerously-skip-permissions".to_owned())
+            .into_iter()
+            .collect(),
+    }
 }
 
 const fn default_command(agent: AgentKind) -> &'static str {
@@ -412,6 +415,7 @@ mod tests {
             .expect("Codex profile");
 
         assert_eq!(codex.command, "trusted-codex-wrapper");
+        assert_eq!(codex.arguments, ["--yolo"]);
     }
 
     #[test]
@@ -422,7 +426,8 @@ mod tests {
 
         let profiles = build_agent_profiles(&config);
 
-        assert!(profiles.primary.arguments.is_empty());
+        assert_eq!(profiles.primary.arguments, ["--yolo"]);
+        assert_eq!(profiles.new_session.arguments, ["--yolo"]);
         assert_eq!(
             profiles
                 .additional
@@ -432,6 +437,15 @@ mod tests {
                 .arguments,
             ["--dangerously-skip-permissions"]
         );
+        assert_eq!(
+            profiles
+                .additional
+                .iter()
+                .find(|profile| profile.agent == AgentKind::Agy)
+                .expect("AGY profile")
+                .arguments,
+            ["--dangerously-skip-permissions"]
+        );
     }
 
     #[test]
@@ -457,7 +471,7 @@ mod tests {
                 shell: ShellKind::Powershell,
             },
             explicit_override: true,
-            dangerously_skip_permissions: false,
+            dangerously_skip_permissions: true,
         };
         let catalog = AgentCatalog {
             profiles: Arc::new(vec![profile]),
@@ -475,7 +489,7 @@ mod tests {
         assert_eq!(agent["state"], "ready");
         assert_eq!(agent["configuration"], "override");
         assert_eq!(agent["version"], "9.8.7");
-        assert_eq!(agent["dangerouslySkipPermissions"], false);
+        assert_eq!(agent["dangerouslySkipPermissions"], true);
         assert_eq!(agent["install"]["verifyCommand"], "codex --version");
         assert_eq!(agent["install"]["requiresServerAccess"], true);
         assert!(agent.get("path").is_none());

server/src/agents.rs

@@ -897,14 +897,14 @@ mod tests {
     #[test]
     fn passes_fixed_arguments_to_an_executable_through_powershell() {
         let resolved = ResolvedCommand {
-            path: PathBuf::from(r"C:\Program Files\Claude\claude.exe"),
+            path: PathBuf::from(r"C:\Program Files\Codex\codex.exe"),
             is_batch_file: false,
         };
         let config = TerminalConfig {
             project_dir: PathBuf::from(r"C:\project"),
             command: "ignored".to_owned(),
-            arguments: vec!["--dangerously-skip-permissions".to_owned()],
-            agent: AgentKind::Claude,
+            arguments: vec!["--yolo".to_owned()],
+            agent: AgentKind::Codex,
             shell: ShellKind::Powershell,
         };
 
@@ -914,8 +914,7 @@ mod tests {
             "-NoLogo".into(),
             "-NoProfile".into(),
             "-Command".into(),
-            "& 'C:\\Program Files\\Claude\\claude.exe' '--dangerously-skip-permissions'; exit $LASTEXITCODE"
-                .into(),
+            "& 'C:\\Program Files\\Codex\\codex.exe' '--yolo'; exit $LASTEXITCODE".into(),
         ];
 
         assert_eq!(command.get_argv(), &expected);
@@ -1041,15 +1040,15 @@ mod unix_tests {
         let config = TerminalConfig {
             project_dir: PathBuf::from("/tmp/codex-web-project"),
             command: "ignored".to_owned(),
-            arguments: vec!["--dangerously-skip-permissions".to_owned()],
+            arguments: vec!["--yolo".to_owned()],
             agent: AgentKind::Codex,
             shell: ShellKind::Powershell,
         };
 
         let command = pty_command(&config, &resolved);
         let expected = vec![
             resolved.path.clone().into_os_string(),
-            "--dangerously-skip-permissions".into(),
+            "--yolo".into(),
         ];
 
         assert_eq!(
@@ -1068,7 +1067,7 @@ mod unix_tests {
         let command_path = directory.path().join("fake-codex");
         std::fs::write(
             &command_path,
-            "#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then\n  echo 'codex-cli 1.0.0'\n  exit 0\nfi\n[ \"$1\" = \"--dangerously-skip-permissions\" ]\n",
+            "#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then\n  [ -z \"$2\" ] || exit 9\n  echo 'codex-cli 1.0.0'\n  exit 0\nfi\n[ \"$1\" = \"--yolo\" ]\n",
         )
         .expect("write fake Codex command");
 
@@ -1081,7 +1080,7 @@ mod unix_tests {
         let config = TerminalConfig {
             project_dir: directory.path().to_path_buf(),
             command: command_path.to_string_lossy().into_owned(),
-            arguments: vec!["--dangerously-skip-permissions".to_owned()],
+            arguments: vec!["--yolo".to_owned()],
             agent: AgentKind::Codex,
             shell: ShellKind::Powershell,
         };