[Juliusolsson05]

Problem

Driving Codex's trust dialog with synthesized keystrokes produced four distinct production failures in one day — #705 (inverted accept bytes, Claude sibling), #711 (clicks refused invisibly), #712 (wake readiness timeout killing a live CLI waiting on its own dialog), #713 (app-hostage modal). One root: the dialog exists at all for sessions the app spawns into a folder the user explicitly chose.

Fixes #714.

Implemented behavior

The folder choice is the trust decision, so it gets recorded where Codex records it — [projects."<path>"] trust_level = "trusted" in $CODEX_HOME/config.toml — before the PTY spawns, and the dialog never appears.

• codex-headless (submodule bump to feat(config): pre-trust a project folder on disk before spawn codex-headless#45): ensureCodexProjectTrust(cwd) — append-only and format-preserving (the config is user-owned; codex-rs itself uses toml_edit to avoid destroying it), never modifies an existing entry (an explicit non-trusted decision must not be upgraded behind the user's back), stands down on inline projects = {…} tables (appending alongside one is a duplicate-key parse error that would stop Codex from launching), atomic temp+rename, never throws. Format verified against the live config (a dozen organic entries) and codex-rs set_project_trust_level.
• agent-code: one await ensureCodexProjectTrust(this.cwd) early in CodexSession.start() — before ownership handoff, resume preparation, and the "config/read must remain the final await before spawn" invariant — covering fresh panes, recover/wake respawns, orchestration children, and worktree cwds at the single spawn site. Failure modes deliberately never gate the spawn; the trust-dialog condition/modal remain the fallback (whose own defects bug(codex): trust dialog clicks are refused invisibly — keystroke never reaches the agent #711/bug(session): wake readiness timeout kills a live codex blocked on its trust dialog — 30s kill loop #712/bug(ui): one pane's condition modal blocks the entire application and hides its own failure toasts #713 stay open for the fallback path).

Tests

• Package (fix(dispatch): close selected dispatch row #45): 9 cases incl. prefix byte-identity on append, byte-for-byte idempotency, untrusted-entry preservation, inline-table stand-down, escaping round-trip, fail-open on unreadable config. 196/196 suite, contract, typecheck.
• Parent: new launch-ordering case pinning trust:ensure → handoff → resume:start (the write precedes every ownership step and the spawn) and exactly-once-per-attempt, via the existing recorded launch-ladder harness (mock records trust calls in a separate channel so the exact-array assertions of the ladder tests stay byte-identical). Codex runtime suites 18/18; tsc node + web clean.

Notes

• Claude parity (hasTrustDialogAccepted in ~/.claude.json) is a named follow-up in feat(codex): pre-trust project folders on disk before spawn — retire the trust dialog for app-spawned sessions #714; the bug(claude): trust dialog accept confirms "No, exit" — new default highlight kills the session #705 dialog driver keeps Claude covered meanwhile.
• package-lock.json untouched: the package's package.json did not change (path-alias consumption).

🤖 Generated with Claude Code

https://claude.ai/code/session_01E9UW81kpTBiDPhZFpcpjf6