Harden Codex unattended launch: apps connector, hook trust, flag order, alt-screen

Four fixes to make Codex spawn reliably without an operator in the container:

- `features.apps = false` in config.toml disables the built-in apps connector,
  which cannot start in a container and stalls every spawn on its 30 s MCP timeout.
  The `[mcp_servers.codex_apps] enabled = false` alternative is invalid config that
  crash-loops Codex — the feature flag is the only safe disable.

- `--dangerously-bypass-hook-trust` added to launch_argv (first run and resume):
  since PR #387 wired Stop/UserPromptSubmit hooks into config.toml, Codex prompts
  interactively to trust each hook hash; with no operator this hangs indefinitely.

- Bypass flags moved after the `resume` subcommand (`codex resume --last --flags`),
  matching the reference implementation's required argument order.

- `--no-alt-screen` on every launch so Codex renders into tmux scrollback instead
  of the alternate screen, keeping `tmux attach` history accessible.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Panopticon Agent

src/panopticon/container/cli/codex.py

@@ -119,13 +119,19 @@ def write_mcp_config(self, config_dir: Path, service_url: str) -> Path:
         plane claude connects to, at ``<service_url>/mcp`` — no auth token (the server is the
         container's own task service). Older codex builds only pick up HTTP MCP with
         ``experimental_use_rmcp_client`` set, so we enable it defensively (a no-op on builds with
-        native support). Merged into ``config.toml`` so it coexists with the trust/overview keys.
+        native support). ``features.apps = false`` disables codex's built-in apps connector, which
+        cannot start in the container and otherwise stalls every spawn on its 30 s MCP timeout
+        (the ``[mcp_servers.codex_apps] enabled = false`` alternative is invalid config that
+        crash-loops codex — the feature flag is the only safe disable). Merged into ``config.toml``
+        so it coexists with the trust/overview keys.
         """
         config = config_dir / self.CONFIG_FILE
         with update_toml_config(config) as data:
             servers = data.setdefault("mcp_servers", {})
             servers["panopticon"] = {"url": f"{service_url.rstrip('/')}/mcp"}
-            data.setdefault("features", {})["experimental_use_rmcp_client"] = True
+            features = data.setdefault("features", {})
+            features["experimental_use_rmcp_client"] = True
+            features["apps"] = False
         return config
 
     def write_workflow_overview(self, config_dir: Path, overview: str) -> Path | None:
@@ -230,22 +236,36 @@ def launch_argv(
         instead of starting fresh. The config dir is a **per-task volume**, so this resumes both
         within a container's life and **across respawn/recreate**.
 
-        On a **first run** (no prior session) the ``starting_model`` tier is resolved via
-        :meth:`resolve_model` and passed as ``--model`` (on resume codex uses the session's model),
-        and an ``initial_prompt`` is appended as codex's first message. ``turn`` is accepted for
-        signature parity with the claude adapter; auto-continuing a resumed session on the agent's
-        turn (claude's interrupt prompt) is deferred with the rest of the turn wiring to M3.6, since
-        injecting a prompt into a resumed codex session isn't yet verified.
+        ``--dangerously-bypass-hook-trust`` bypasses codex's per-hash interactive trust prompt for
+        unrecognised hooks (our Stop/UserPromptSubmit hooks, wired in :meth:`write_settings`). On
+        resume the bypass flags go **after** the subcommand (``codex resume --last --flags``), as
+        codex's parser requires; on first run they are global flags before the prompt. ``--no-alt-screen``
+        renders codex output into the tmux scrollback (not the alternate screen) so ``tmux attach``
+        history stays useful. On a **first run** (no prior session) the ``starting_model`` tier is
+        resolved via :meth:`resolve_model` and passed as ``--model`` (on resume codex uses the
+        session's model), and an ``initial_prompt`` is appended as codex's first message. ``turn`` is
+        accepted for signature parity with the claude adapter.
         """
-        argv = ["codex", "--dangerously-bypass-approvals-and-sandbox"]
         sessions = config_dir / self.SESSIONS_DIRNAME
         if sessions.exists() and any(sessions.rglob("*.jsonl")):
-            argv += ["resume", "--last"]  # resume the config dir's most recent session
-        else:
-            if starting_model:  # first run only — on resume codex uses the session's model
-                argv += ["--model", self.resolve_model(starting_model)]
-            if initial_prompt:
-                argv.append(initial_prompt)  # positional: codex's first message
+            return [
+                "codex",
+                "--no-alt-screen",
+                "resume",
+                "--last",
+                "--dangerously-bypass-approvals-and-sandbox",
+                "--dangerously-bypass-hook-trust",
+            ]
+        argv = [
+            "codex",
+            "--dangerously-bypass-approvals-and-sandbox",
+            "--dangerously-bypass-hook-trust",
+            "--no-alt-screen",
+        ]
+        if starting_model:  # first run only — on resume codex uses the session's model
+            argv += ["--model", self.resolve_model(starting_model)]
+        if initial_prompt:
+            argv.append(initial_prompt)  # positional: codex's first message
         return argv
 
     def launch(self, config_dir: Path) -> None:  # pragma: no cover - real LLM; skipif-gated / live

tests/container/test_codex.py

@@ -64,6 +64,8 @@ def test_write_mcp_config_points_codex_at_the_task_service_over_http(tmp_path: P
     assert data["mcp_servers"]["panopticon"] == {"url": "http://host.docker.internal:8000/mcp"}
     # older codex only picks up HTTP MCP with the rmcp client enabled (a no-op where it's native)
     assert data["features"]["experimental_use_rmcp_client"] is True
+    # built-in apps connector cannot start in the container — disable it to avoid the 30 s stall
+    assert data["features"]["apps"] is False
 
 
 def test_write_mcp_config_strips_a_trailing_slash(tmp_path: Path) -> None:
@@ -152,24 +154,35 @@ def test_launch_argv_starts_fresh_without_a_session(tmp_path: Path) -> None:
     assert CodexAgentCLI().launch_argv(tmp_path, Path("/workspace")) == [
         "codex",
         "--dangerously-bypass-approvals-and-sandbox",
+        "--dangerously-bypass-hook-trust",
+        "--no-alt-screen",
     ]
 
 
 def test_launch_argv_resumes_when_a_session_transcript_exists(tmp_path: Path) -> None:
     sessions = tmp_path / "sessions" / "2026" / "08"
     sessions.mkdir(parents=True)
     (sessions / "rollout-abc.jsonl").write_text("{}")
+    # bypass flags go *after* the subcommand on resume (codex's parser requires it)
     assert CodexAgentCLI().launch_argv(tmp_path, Path("/workspace")) == [
         "codex",
-        "--dangerously-bypass-approvals-and-sandbox",
+        "--no-alt-screen",
         "resume",
         "--last",
+        "--dangerously-bypass-approvals-and-sandbox",
+        "--dangerously-bypass-hook-trust",
     ]
 
 
 def test_launch_argv_appends_initial_prompt_on_first_run(tmp_path: Path) -> None:
     argv = CodexAgentCLI().launch_argv(tmp_path, Path("/workspace"), initial_prompt="review plan")
-    assert argv == ["codex", "--dangerously-bypass-approvals-and-sandbox", "review plan"]
+    assert argv == [
+        "codex",
+        "--dangerously-bypass-approvals-and-sandbox",
+        "--dangerously-bypass-hook-trust",
+        "--no-alt-screen",
+        "review plan",
+    ]
 
 
 def test_launch_argv_omits_initial_prompt_when_resuming(tmp_path: Path) -> None:
@@ -184,6 +197,8 @@ def test_launch_argv_passes_the_resolved_model_on_first_run(tmp_path: Path) -> N
     assert argv == [
         "codex",
         "--dangerously-bypass-approvals-and-sandbox",
+        "--dangerously-bypass-hook-trust",
+        "--no-alt-screen",
         "--model",
         "gpt-5.6-codex",
     ]
@@ -203,6 +218,8 @@ def test_launch_argv_passes_model_before_initial_prompt_on_first_run(tmp_path: P
     assert argv == [
         "codex",
         "--dangerously-bypass-approvals-and-sandbox",
+        "--dangerously-bypass-hook-trust",
+        "--no-alt-screen",
         "--model",
         "gpt-5.6-codex",
         "start now",