Codex resume silently drops sandbox and auto_approve policy

[ScottRBK]

Summary

The Codex adapter builds resumed commands without the sandbox policy used for fresh calls and
without the bypass flag requested by auto_approve=True.

As a result, resuming a Codex session silently changes the execution policy from the first call.

Affected versions checked:

• Published agent-shell-py==0.2.0
• Current main at a5efa86
• Codex CLI 0.145.0

Current behavior

CodexAdapter._build_command() handles resumed sessions in an early branch:

if session_id:
    cmd = ["codex", "exec", "resume", "--json", "--skip-git-repo-check"]
    # model, effort, and web_search are forwarded
    cmd.extend([session_id, prompt])
    return cmd

The fresh-call branch applies the execution policy:

cmd = [
    "codex",
    "exec",
    "--json",
    "--skip-git-repo-check",
    "--sandbox",
    "workspace-write",
]
if auto_approve:
    cmd.append("--dangerously-bypass-approvals-and-sandbox")

Therefore:

• auto_approve=False does not enforce AgentShell's workspace-write sandbox on resume. The
  resumed call instead inherits Codex configuration/defaults, which may be stricter or more
  permissive.
• auto_approve=True does not add --dangerously-bypass-approvals-and-sandbox on resume.
• No warning tells the caller that the requested policy was not preserved.

Reproduction

Build otherwise-identical fresh and resumed commands for each auto_approve value:

adapter = CodexAdapter()

fresh = adapter._build_command(
    prompt="continue",
    model=None,
    effort=None,
    auto_approve=False,
    session_id=None,
)
resumed = adapter._build_command(
    prompt="continue",
    model=None,
    effort=None,
    auto_approve=False,
    session_id="019fa7e6-d58a-7250-89a4-b2f2e2569269",
)

fresh contains --sandbox workspace-write; resumed does not.

Repeating with auto_approve=True shows that only fresh contains
--dangerously-bypass-approvals-and-sandbox.

Expected behavior

A resumed call should preserve the requested execution policy:

• auto_approve=False should retain the explicit workspace-write sandbox.
• auto_approve=True should retain the dangerous approval/sandbox bypass.

If Codex cannot enforce either option on resume, AgentShell should emit an explicit warning rather
than silently changing behavior.

Codex CLI 0.145.0 exposes --dangerously-bypass-approvals-and-sandbox on
codex exec resume. The parent codex exec command exposes --sandbox, so its placement relative
to the resume subcommand may need verification.

Suggested regression coverage

Add command-construction tests for resumed calls that assert:

1. auto_approve=False preserves workspace-write.
2. auto_approve=True preserves --dangerously-bypass-approvals-and-sandbox.
3. Fresh and resumed calls apply equivalent policy for both values.