From ac7a0bf69db3fc52a39503540f509057aedd28f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ra=C3=BAl=20Negr=C3=B3n?= <raul.n@posthog.com>
Date: Tue, 14 Jul 2026 13:45:14 -0400
Subject: [PATCH 1/3] fix(agent): pin codex approvals_reviewer to host

---
 packages/agent/src/adapters/codex-app-server/spawn.test.ts | 3 +++
 packages/agent/src/adapters/codex-app-server/spawn.ts      | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/packages/agent/src/adapters/codex-app-server/spawn.test.ts b/packages/agent/src/adapters/codex-app-server/spawn.test.ts
index 402aaf2504..9e9f23f7f2 100644
--- a/packages/agent/src/adapters/codex-app-server/spawn.test.ts
+++ b/packages/agent/src/adapters/codex-app-server/spawn.test.ts
@@ -29,6 +29,9 @@ describe("buildAppServerArgs", () => {
     });
 
     expect(args[0]).toBe("app-server");
+    // Pin codex's guardian reviewer to the host default so it never calls the
+    // gateway-blocked `codex-auto-review` model.
+    expect(args).toContain('approvals_reviewer="user"');
     expect(args).toContain('model_provider="posthog"');
     expect(args).toContain(
       'model_providers.posthog.base_url="https://gateway.example/v1"',
diff --git a/packages/agent/src/adapters/codex-app-server/spawn.ts b/packages/agent/src/adapters/codex-app-server/spawn.ts
index 2f0d81ed23..75e1feebdc 100644
--- a/packages/agent/src/adapters/codex-app-server/spawn.ts
+++ b/packages/agent/src/adapters/codex-app-server/spawn.ts
@@ -123,6 +123,13 @@ export function buildAppServerArgs(
       : `sandbox_mode="danger-full-access"`,
   );
 
+  // The host owns approvals (surfaced via approvals.ts → requestPermission). Codex's
+  // guardian reviewer is enabled by default and routes approvals to its dedicated
+  // `codex-auto-review` model, which our gateway's posthog_code allowlist doesn't
+  // serve — so every command review 403s. Pin codex's own default `user` reviewer
+  // so approval decisions stay with the host.
+  args.push("-c", `approvals_reviewer="user"`);
+
   // Disable the user's ambient ~/.codex MCP servers so the adapter only exposes
   // MCP servers PostHog injects per-thread; otherwise codex fails connecting to them.
   for (const name of new CodexSettingsManager(

From 3868e63544ded08160473cc6cf62d2ec84c9e737 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ra=C3=BAl=20Negr=C3=B3n?= <raul.n@posthog.com>
Date: Tue, 14 Jul 2026 14:13:14 -0400
Subject: [PATCH 2/3] fix(agent): guard codex reviewer pin from override

---
 .../src/adapters/codex-app-server/spawn.test.ts    | 14 ++++++++++++++
 .../agent/src/adapters/codex-app-server/spawn.ts   | 10 +++++++---
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/packages/agent/src/adapters/codex-app-server/spawn.test.ts b/packages/agent/src/adapters/codex-app-server/spawn.test.ts
index 9e9f23f7f2..d7145a5d06 100644
--- a/packages/agent/src/adapters/codex-app-server/spawn.test.ts
+++ b/packages/agent/src/adapters/codex-app-server/spawn.test.ts
@@ -42,6 +42,20 @@ describe("buildAppServerArgs", () => {
     );
   });
 
+  it("lets a caller override the reviewer pin without emitting a shadowed duplicate", () => {
+    const args = buildAppServerArgs({
+      binaryPath: "/bundle/codex",
+      apiBaseUrl: "https://gateway.example/v1",
+      configOverrides: { approvals_reviewer: "auto_review" },
+    });
+
+    // codex's `-c` is last-wins, so the default pin must not be emitted alongside
+    // the caller's value — exactly one reviewer entry, and it's the caller's.
+    expect(args.filter((arg) => arg.startsWith("approvals_reviewer="))).toEqual(
+      ['approvals_reviewer="auto_review"'],
+    );
+  });
+
   it("forwards http headers as a quoted TOML inline table on the posthog provider", () => {
     const args = buildAppServerArgs({
       binaryPath: "/bundle/codex",
diff --git a/packages/agent/src/adapters/codex-app-server/spawn.ts b/packages/agent/src/adapters/codex-app-server/spawn.ts
index 75e1feebdc..cddbf5df9c 100644
--- a/packages/agent/src/adapters/codex-app-server/spawn.ts
+++ b/packages/agent/src/adapters/codex-app-server/spawn.ts
@@ -126,9 +126,13 @@ export function buildAppServerArgs(
   // The host owns approvals (surfaced via approvals.ts → requestPermission). Codex's
   // guardian reviewer is enabled by default and routes approvals to its dedicated
   // `codex-auto-review` model, which our gateway's posthog_code allowlist doesn't
-  // serve — so every command review 403s. Pin codex's own default `user` reviewer
-  // so approval decisions stay with the host.
-  args.push("-c", `approvals_reviewer="user"`);
+  // serve — so every command review 403s. Default codex's own `user` reviewer so
+  // approval decisions stay with the host. Skipped when a caller sets the reviewer
+  // via configOverrides (appended last, and codex's `-c` is last-wins) so we never
+  // emit a conflicting duplicate that could shadow the pin back to the auto reviewer.
+  if (options.configOverrides?.approvals_reviewer === undefined) {
+    args.push("-c", `approvals_reviewer="user"`);
+  }
 
   // Disable the user's ambient ~/.codex MCP servers so the adapter only exposes
   // MCP servers PostHog injects per-thread; otherwise codex fails connecting to them.

From 641164843d856f9ae429a366adcf9c4357cfcb31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ra=C3=BAl=20Negr=C3=B3n?= <raul.n@posthog.com>
Date: Tue, 14 Jul 2026 14:20:24 -0400
Subject: [PATCH 3/3] refactor(agent): simplify codex reviewer default

---
 .../src/adapters/codex-app-server/spawn.test.ts    | 14 --------------
 .../agent/src/adapters/codex-app-server/spawn.ts   | 12 ++++--------
 2 files changed, 4 insertions(+), 22 deletions(-)

diff --git a/packages/agent/src/adapters/codex-app-server/spawn.test.ts b/packages/agent/src/adapters/codex-app-server/spawn.test.ts
index d7145a5d06..9e9f23f7f2 100644
--- a/packages/agent/src/adapters/codex-app-server/spawn.test.ts
+++ b/packages/agent/src/adapters/codex-app-server/spawn.test.ts
@@ -42,20 +42,6 @@ describe("buildAppServerArgs", () => {
     );
   });
 
-  it("lets a caller override the reviewer pin without emitting a shadowed duplicate", () => {
-    const args = buildAppServerArgs({
-      binaryPath: "/bundle/codex",
-      apiBaseUrl: "https://gateway.example/v1",
-      configOverrides: { approvals_reviewer: "auto_review" },
-    });
-
-    // codex's `-c` is last-wins, so the default pin must not be emitted alongside
-    // the caller's value — exactly one reviewer entry, and it's the caller's.
-    expect(args.filter((arg) => arg.startsWith("approvals_reviewer="))).toEqual(
-      ['approvals_reviewer="auto_review"'],
-    );
-  });
-
   it("forwards http headers as a quoted TOML inline table on the posthog provider", () => {
     const args = buildAppServerArgs({
       binaryPath: "/bundle/codex",
diff --git a/packages/agent/src/adapters/codex-app-server/spawn.ts b/packages/agent/src/adapters/codex-app-server/spawn.ts
index cddbf5df9c..6d25686200 100644
--- a/packages/agent/src/adapters/codex-app-server/spawn.ts
+++ b/packages/agent/src/adapters/codex-app-server/spawn.ts
@@ -124,15 +124,11 @@ export function buildAppServerArgs(
   );
 
   // The host owns approvals (surfaced via approvals.ts → requestPermission). Codex's
-  // guardian reviewer is enabled by default and routes approvals to its dedicated
+  // guardian reviewer is on by default and routes approvals to its dedicated
   // `codex-auto-review` model, which our gateway's posthog_code allowlist doesn't
-  // serve — so every command review 403s. Default codex's own `user` reviewer so
-  // approval decisions stay with the host. Skipped when a caller sets the reviewer
-  // via configOverrides (appended last, and codex's `-c` is last-wins) so we never
-  // emit a conflicting duplicate that could shadow the pin back to the auto reviewer.
-  if (options.configOverrides?.approvals_reviewer === undefined) {
-    args.push("-c", `approvals_reviewer="user"`);
-  }
+  // serve — so every review 403s. Default codex's own `user` reviewer; a caller can
+  // still override it via configOverrides, which the trailing loop appends last.
+  args.push("-c", `approvals_reviewer="user"`);
 
   // Disable the user's ambient ~/.codex MCP servers so the adapter only exposes
   // MCP servers PostHog injects per-thread; otherwise codex fails connecting to them.