fix(codex): use supported safe-yolo approval policy

cli/src/codex/codexLocalLauncher.test.ts

@@ -247,7 +247,7 @@ describe('codexLocalLauncher', () => {
         expect(harness.launches).toHaveLength(1);
         expect(harness.launches[0]?.codexArgs).toEqual([
             '--ask-for-approval',
-            'on-failure',
+            'on-request',
             '--sandbox',
             'workspace-write',
             '--model',

cli/src/codex/utils/appServerConfig.test.ts

@@ -98,15 +98,15 @@ describe('appServerConfig', () => {
         });
     });
 
-    it('keeps on-failure approvals for safe-yolo threads', () => {
+    it('keeps supported escalation approvals for safe-yolo threads', () => {
         const params = buildThreadStartParams({
             cwd: '/workspace/project',
             mode: { permissionMode: 'safe-yolo', collaborationMode: 'default' },
             mcpServers
         });
 
         expect(params.sandbox).toBe('workspace-write');
-        expect(params.approvalPolicy).toBe('on-failure');
+        expect(params.approvalPolicy).toBe('on-request');
     });
 
     it('allows MCP elicitation without enabling sandbox prompts for read-only threads', () => {
@@ -460,7 +460,7 @@ describe('appServerConfig', () => {
             cliOverrides: { sandbox: 'read-only', approvalPolicy: 'never' }
         });
 
-        expect(params.approvalPolicy).toBe('on-failure');
+        expect(params.approvalPolicy).toBe('on-request');
         expect(params.sandboxPolicy).toEqual({ type: 'workspaceWrite' });
         expect(params.collaborationMode).toEqual({
             mode: 'default',

cli/src/codex/utils/permissionModeConfig.test.ts

@@ -10,9 +10,9 @@ describe('resolveCodexPermissionModeConfig', () => {
         });
     });
 
-    it('keeps safe-yolo escalation on failure', () => {
+    it('keeps safe-yolo escalation available with a supported approval policy', () => {
         expect(resolveCodexPermissionModeConfig('safe-yolo')).toEqual({
-            approvalPolicy: 'on-failure',
+            approvalPolicy: 'on-request',
             sandbox: 'workspace-write',
             sandboxPolicy: { type: 'workspaceWrite' }
         });

cli/src/codex/utils/permissionModeConfig.ts

@@ -26,8 +26,10 @@ export function resolveCodexPermissionModeConfig(mode: CodexPermissionMode): Cod
             };
         case 'safe-yolo':
             return {
-                // Keep escalation available when the workspace-write sandbox blocks a command.
-                approvalPolicy: 'on-failure',
+                // Current Codex versions reject the removed `on-failure` policy. Keep
+                // escalation available through `on-request`; HAPI auto-approves these
+                // requests in safe-yolo mode.
+                approvalPolicy: 'on-request',
                 sandbox: 'workspace-write',
                 sandboxPolicy: { type: 'workspaceWrite' }
             };