fix(codex): preserve sandbox mode on resume

[snvtac]

PR Type

• Patch - Bug fix, typo, test gap (no Feature Doc needed)
• Feature - New capability or behavior change (requires Feature Doc)
• Protocol - Rules, skills, workflow changes (the doc IS the contribution)

Related Issue

Closes #987

Feature Doc (Feature PRs only)

N/A

What

• Replay the configured Codex sandbox mode on codex exec resume via --config sandbox_mode="...".
• Keep resume free of unsupported --sandbox and --add-dir flags.
• Add regression coverage for default and env-configured sandbox replay on resume.

Why

Issue #987 reports a Windows PowerShell launch failure where Clowder believes Codex is running in danger-full-access, but the failure path reaches the Windows managed sandbox runner. Fresh Codex exec already passes --sandbox; resume did not replay the sandbox mode and could drift back to a CLI default.

This keeps the fix narrow to the API resume argv path. Draft PR #980 covers a broader nearby surface; this PR intentionally does not include the UI default or Windows CLI resolver changes from that branch.

Tradeoff

This is argv-level coverage rather than a Windows manual repro. The change is limited to the supported resume config channel because codex exec resume does not accept --sandbox.

Test Evidence

pnpm --filter @cat-cafe/api run build
# pass

pnpm --filter @cat-cafe/api run lint
# pass

pnpm biome check packages/api/src/domains/cats/services/agents/providers/CodexAgentService.ts packages/api/test/codex-agent-service.test.js --diagnostic-level=error
# Checked 2 files. No fixes applied.

CAT_CAFE_DISABLE_SHARED_STATE_PREFLIGHT=1 pnpm --dir packages/api exec node --import ./test/helpers/setup-cat-registry.js --test --test-timeout=60000 test/codex-agent-service.test.js
# tests 48, pass 48, fail 0

git diff --check
# pass

AC Checklist (Feature PRs only)

N/A

[zts212653]

Thanks for sending the narrow PR.

Maintainer triage: clowder-ai#987 is accepted, and this PR is a welcome patch for the Codex resume argv slice. I am routing it to the existing #987 review thread for code review rather than opening a separate implementation track.

Merge is not cleared yet. Notes before merge:

• CI has not actually run yet; the workflow runs are in action_required, likely because this is a first-time contributor fork PR.
• This overlaps with draft PR [codex] preserve sandbox across Codex resume #980, but fix(codex): preserve sandbox mode on resume #1014 is intentionally narrower and does not include the UI default / Windows resolver changes from [codex] preserve sandbox across Codex resume #980.
• Because this touches Codex sandbox / permission propagation and source-managed API files, merge needs review, CI, and an intake plan back into the source repo if accepted.

[砚砚/gpt-5.5🐾]

[zts212653]

APPROVE — CI green including Windows Smoke, scope clean, fix matches existing patterns.

Correctness

• ✅ Refutes the existing CodexAgentService.ts:533 assumption ("sandbox locked at creation") and updates the comment to match. That assumption was the root cause of the resume drift.
• ✅ sandboxConfigArgs lives in the dedup() chain, so user-supplied cliConfigArgs overrides still win — userConfigKeys (L464–473) sees sandbox_mode and dedup() correctly skips the system entry.
• ✅ toTomlString(sandboxMode) matches the majority pattern in this file (L253, L258, L310, L323, L420, L495, L514). The lone approval_policy="${approvalPolicy}" outlier (L439) is pre-existing tech debt, not introduced here.
• ✅ Scope is minimal: only the resume branch argv is extended; fresh exec branch and its --sandbox <mode> flag are unchanged. Verified via grep -c sandboxConfigArgs on the diff — 2 hits (1 declaration + 1 usage in resume only).

Tests

• ✅ Two new + two modified tests cover: default-resume sandbox, env-configured-resume sandbox, no --sandbox flag on resume, no --add-dir on resume while requiring sandbox_mode config.
• ✅ Windows Smoke job passing is the highest-signal check here — it confirms the --config sandbox_mode= channel actually maps to the non-elevated runtime on Win, which is exactly the path under suspicion in #987.
• Tests stop at the argv mock boundary; that's the right scope for cat-cafe. Deeper validation lives in Windows Smoke + reporter-side re-validation.

Pre-merge note (non-blocking)

Closes #987 may be over-claiming. The bug report doesn't pin down whether the failure happens on exec or exec resume — the wording "let GPT-5.5 set up the proxy" reads more like a turn-1 / fresh-exec path, which this PR does not touch. Two clean options at merge time:

1. Change Closes → Refs in the PR body, then reopen #987 after merge to await reporter re-validation on Windows.
2. Merge as-is, then manually reopen #987 with a comment asking the reporter to re-test against the fix.

Either works; pick whichever is lighter at merge. The fix itself stands on its own merit regardless of #987 disposition.

Thanks for the careful, narrowly-scoped fix and the regression coverage @snvtac.

— Reviewed by 宪宪 (布偶猫 Opus 4.7) on behalf of cat-cafe / Clowder AI maintainers. [宪宪/Opus 4.7🐾]