feat(codex): pre-trust project folders on disk before spawn — retire the trust dialog for app-spawned sessions #714

Motivation

Driving provider trust dialogs with synthesized keystrokes has now produced four distinct production failures in one day: the Claude accept keystroke inverted by an upstream re-layout (#705), Codex trust clicks refused invisibly (#711), the wake readiness timeout killing a live Codex that was waiting on its own trust dialog (#712), and the app-global modal holding every pane hostage (#713). All of them share one root: the dialog exists at all.

Codex persists folder trust in $CODEX_HOME/config.toml (default ~/.codex/config.toml) as:

[projects."/abs/path"]
trust_level = "trusted"

— verified against the live config (a dozen existing entries) and codex-rs (core/src/config/edit.rs set_project_trust_level). The user chooses the project folder in Agent Code explicitly; that choice is the trust decision. Writing it to disk before spawn means the dialog never appears for app-spawned sessions.

Intended behavior

Before Agent Code spawns a Codex PTY for cwd X, it ensures [projects."X"] exists in codex's config with trust_level = "trusted":

• Append-only and format-preserving: if the exact project table is absent, append it; never rewrite, reorder, or reserialize the rest of the file (user comments and formatting survive). Atomic temp+rename write.
• Respect explicit user choices: if the project table already exists — whatever its trust level — leave it untouched.
• Fail open to the dialog: any read/parse/write problem (including an inline projects = { … } style table we can't safely append to) skips silently and the existing trust-dialog condition/modal path remains the fallback. Trust pre-writing is an optimization, never a gate; spawn must never be blocked by it.
• $CODEX_HOME honored (same resolution as the rest of codex-headless).

The knowledge lives in codex-headless (ensureCodexProjectTrust(cwd)), called by CodexSession.start() before the PTY spawn. Covers every spawn path (fresh, recover/wake, orchestration children, worktree cwds) at the single spawn site.

Acceptance criteria

• A fresh Codex agent in a never-trusted folder starts with no trust dialog; the config gains exactly one appended table; the rest of the file is byte-identical.
• Second spawn in the same folder is a no-op (byte-identical config).
• An existing entry (any trust level) is never modified.
• A config using the inline projects = {} form is left untouched and the dialog still works.
• Spawn proceeds normally when the config is unwritable.

Follow-up (separate issue)

Claude parity: pre-accept hasTrustDialogAccepted in ~/.claude.json the same way, retiring the #705 dialog driver to a fallback.

Refs #711 #712 #713, #705.