fix: gate root skip-permissions bypass and ship the auto-review model override (#1688 #1225)

[lidge-jun]

Summary

Two community issues, verified and falsified independently.

#1688 — ocx claude --dangerously-skip-permissions aborts as root

Claude Code 2.1.205+ exits as root unless it believes it is sandboxed. OpenCodex launches the session, so it can mark the environment — but doing that unconditionally would tell Claude Code a safety guard is satisfied when it is not.

So the bypass is gated on both conditions: the user explicitly passed --dangerously-skip-permissions (they have already accepted that risk) and uid == 0. An ordinary launch is untouched, and an explicit IS_SANDBOX=0 from the user still wins — setDefault never overwrites a user value, and that case is tested.

The launch says what happened, both ways:

⚠ Root --dangerously-skip-permissions requested: OpenCodex set IS_SANDBOX=1 to bypass
  Claude Code's root guard. OpenCodex did not create an OS sandbox; prefer running as
  a non-root user.

A silent safety-guard bypass would have been the wrong shape here even if it fixed the symptom. No bubblewrap sandbox was added — that is a Linux-only isolation feature needing its own threat model, not something to bundle into a launcher flag fix.

#1225 — configurable auto-review model

Upstream Codex picks the reviewer model from auto_review_model_override on the catalog entry of the running model, so OpenCodex's lever is the catalog it writes. This carries #2363's approach: a root auto_review_model setting, trimmed and validated against the final catalog, stamped across entries by both writers (retained sync and convergence), with a diagnostic when the target does not resolve.

One thing corrected before merging: #2363's original head accidentally broke permit-bound Codex-home cache invalidation — an unrelated regression that would have shipped with the feature. Fixed in src/codex/catalog/sync.ts:1960 and kept green by the composed-acceptance and convergence suites, which is how it was caught.

Verification

bun x tsc --noEmit                                     exit 0
bun test claude-cli + claude-auth-mode                 66 pass / 0 fail
bun test codex-catalog + convergence-account-selectors
          + convergence-contract + composed-acceptance  254 pass / 0 fail
bun run privacy:scan                                   Privacy scan passed
docs-site build                                        393 pages, Complete!

Falsified separately: removing the IS_SANDBOX assignment reddens the root-launch case (Expected "1", received undefined); removing the override stamping reddens the catalog assertion (Unable to find property auto_review_model_override).

Checklist

• Targets dev
• Regression tests per fix, falsified individually
• Safety-guard bypass is doubly gated, user-overridable, and announced
• docs-site/ updated for the new setting

Closes #1688. Closes #1225.

Summary by CodeRabbit

• New Features

  • Added support for configuring a Codex automatic review model through the root configuration file.
  • Validates configured models, applies valid selections across the catalog, and provides diagnostics for invalid or unavailable models.
  • Added safer Claude launches when running as root with permission bypass enabled, including sandbox handling and warnings.

• Documentation

  • Documented Codex catalog and automatic review model configuration behavior.

• Tests

  • Added coverage for configuration validation, catalog synchronization, model availability changes, and Claude safety notices.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 464c43a4-2163-4a10-9ba9-77650b3a1bdf

📥 Commits

Reviewing files that changed from the base of the PR and between 324c1aa and 9910c4e.

📒 Files selected for processing (9)

• docs-site/src/content/docs/reference/configuration/providers.md
• src/cli/claude.ts
• src/codex/catalog.ts
• src/codex/catalog/parsing.ts
• src/codex/catalog/sync.ts
• src/codex/convergence.ts
• tests/claude-cli.test.ts
• tests/codex-catalog.test.ts
• tests/codex-convergence-account-selectors.test.ts

---

📝 Walkthrough

Walkthrough

Changes

Claude root launch handling

Layer / File(s)	Summary
Root skip-permissions launch flow src/cli/claude.ts, tests/claude-cli.test.ts	cmdClaude detects UID 0 with --dangerously-skip-permissions. buildClaudeEnv defaults IS_SANDBOX to 1 without replacing an existing value. Tests cover authorization, precedence, and notices. Lines 37–38, 120–122, 309–341; tests lines 2–62.

Codex auto-review model configuration

Layer / File(s)	Summary
Auto-review selector parsing and application src/codex/catalog/parsing.ts, src/codex/catalog/sync.ts, src/codex/catalog.ts, tests/codex-catalog.test.ts, docs-site/src/content/docs/reference/configuration/providers.md	The root auto_review_model setting is read and validated. The final catalog preserves native overrides and stamps, clears, or diagnoses configured selectors. Tests and documentation cover the setting.
Catalog writer finalization src/codex/catalog/sync.ts, src/codex/convergence.ts, tests/codex-convergence-account-selectors.test.ts	Retained synchronization and convergence finalize overrides after catalog processing. Tests cover resolved, cleared, unresolved, removed, and restored selectors. The cache path is computed before the catalog existence guard.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant cmdClaude
  participant Claude
  User->>cmdClaude: Invoke root Claude with skip-permissions
  cmdClaude->>cmdClaude: Check UID and flag
  cmdClaude->>Claude: Launch with warning and IS_SANDBOX environment

Loading

Suggested reviewers: ingwannu, luvs01

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/community-bugs-wave2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9910c4ef9b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore native overrides when removing the global override

When a valid auto_review_model is applied, every native row's original auto_review_model_override is replaced by the configured value; if the setting is then removed or becomes unresolved, sourceModels contains only that global value, so globalStamp is true and this branch changes the native rows to null rather than recovering their original upstream overrides. Consequently, an apply-then-clear sequence permanently changes native auto-review selection across later syncs, contrary to the documented preservation behavior in providers.md; retain the original value from a pristine/upstream source or persist ownership metadata for OpenCodex stamps.

AGENTS.md reference: AGENTS.md:L279-L280

Useful? React with 👍 / 👎.