From c0987fd14bf9f23243f9a603c5bd6beb3dedb23b Mon Sep 17 00:00:00 2001
From: NPUlrk <21106497+NPUlrk@users.noreply.github.com>
Date: Sat, 18 Jul 2026 12:56:55 +0800
Subject: [PATCH] fix(codex): use supported safe-yolo approval policy

---
 cli/src/codex/codexLocalLauncher.test.ts         | 2 +-
 cli/src/codex/utils/appServerConfig.test.ts      | 6 +++---
 cli/src/codex/utils/permissionModeConfig.test.ts | 4 ++--
 cli/src/codex/utils/permissionModeConfig.ts      | 6 ++++--
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/cli/src/codex/codexLocalLauncher.test.ts b/cli/src/codex/codexLocalLauncher.test.ts
index 345b69680c..f741fde6c0 100644
--- a/cli/src/codex/codexLocalLauncher.test.ts
+++ b/cli/src/codex/codexLocalLauncher.test.ts
@@ -247,7 +247,7 @@ describe('codexLocalLauncher', () => {
         expect(harness.launches).toHaveLength(1);
         expect(harness.launches[0]?.codexArgs).toEqual([
             '--ask-for-approval',
-            'on-failure',
+            'on-request',
             '--sandbox',
             'workspace-write',
             '--model',
diff --git a/cli/src/codex/utils/appServerConfig.test.ts b/cli/src/codex/utils/appServerConfig.test.ts
index ebf128fb3b..f49e9e704c 100644
--- a/cli/src/codex/utils/appServerConfig.test.ts
+++ b/cli/src/codex/utils/appServerConfig.test.ts
@@ -98,7 +98,7 @@ describe('appServerConfig', () => {
         });
     });
 
-    it('keeps on-failure approvals for safe-yolo threads', () => {
+    it('keeps supported escalation approvals for safe-yolo threads', () => {
         const params = buildThreadStartParams({
             cwd: '/workspace/project',
             mode: { permissionMode: 'safe-yolo', collaborationMode: 'default' },
@@ -106,7 +106,7 @@ describe('appServerConfig', () => {
         });
 
         expect(params.sandbox).toBe('workspace-write');
-        expect(params.approvalPolicy).toBe('on-failure');
+        expect(params.approvalPolicy).toBe('on-request');
     });
 
     it('allows MCP elicitation without enabling sandbox prompts for read-only threads', () => {
@@ -460,7 +460,7 @@ describe('appServerConfig', () => {
             cliOverrides: { sandbox: 'read-only', approvalPolicy: 'never' }
         });
 
-        expect(params.approvalPolicy).toBe('on-failure');
+        expect(params.approvalPolicy).toBe('on-request');
         expect(params.sandboxPolicy).toEqual({ type: 'workspaceWrite' });
         expect(params.collaborationMode).toEqual({
             mode: 'default',
diff --git a/cli/src/codex/utils/permissionModeConfig.test.ts b/cli/src/codex/utils/permissionModeConfig.test.ts
index 927308f3ad..98ec14e740 100644
--- a/cli/src/codex/utils/permissionModeConfig.test.ts
+++ b/cli/src/codex/utils/permissionModeConfig.test.ts
@@ -10,9 +10,9 @@ describe('resolveCodexPermissionModeConfig', () => {
         });
     });
 
-    it('keeps safe-yolo escalation on failure', () => {
+    it('keeps safe-yolo escalation available with a supported approval policy', () => {
         expect(resolveCodexPermissionModeConfig('safe-yolo')).toEqual({
-            approvalPolicy: 'on-failure',
+            approvalPolicy: 'on-request',
             sandbox: 'workspace-write',
             sandboxPolicy: { type: 'workspaceWrite' }
         });
diff --git a/cli/src/codex/utils/permissionModeConfig.ts b/cli/src/codex/utils/permissionModeConfig.ts
index 7adc3c1b4e..576050d285 100644
--- a/cli/src/codex/utils/permissionModeConfig.ts
+++ b/cli/src/codex/utils/permissionModeConfig.ts
@@ -26,8 +26,10 @@ export function resolveCodexPermissionModeConfig(mode: CodexPermissionMode): Cod
             };
         case 'safe-yolo':
             return {
-                // Keep escalation available when the workspace-write sandbox blocks a command.
-                approvalPolicy: 'on-failure',
+                // Current Codex versions reject the removed `on-failure` policy. Keep
+                // escalation available through `on-request`; HAPI auto-approves these
+                // requests in safe-yolo mode.
+                approvalPolicy: 'on-request',
                 sandbox: 'workspace-write',
                 sandboxPolicy: { type: 'workspaceWrite' }
             };