fix: pass on-request approval policy for write-capable task runs

[mvanhorn]

Summary

Write-capable task runs now send approvalPolicy: "on-request" to the app server, so --write actually gets a writable sandbox. Previously every run sent never, and the Codex CLI silently downgrades a workspace-write sandbox to effectively read-only under approval_policy=never.

Why this matters

The reporter of #412 isolated this with a plugin-free repro (Windows 11, Codex CLI 0.142.4, plugin 1.0.5):

codex exec -s workspace-write -c approval_policy=never fails to write; approval_policy=on-request succeeds with no prompt, because in-sandbox writes never escalate.

The plugin only toggled sandbox between read-only and workspace-write and hardcoded approvalPolicy: "never" everywhere, so even a trivial "create test.txt" rescue task failed with a read-only sandbox error. Two threading gaps caused it: runAppServerTurn in plugins/codex/scripts/lib/codex.mjs built its startThread/resumeThread options without approvalPolicy (so buildThreadParams' existing options.approvalPolicy ?? "never" could never see a value), and executeTaskRun in codex-companion.mjs never passed one.

Changes

• approvalPolicy is forwarded through both runAppServerTurn branches (start and resume), and executeTaskRun sets it from the run mode: on-request for --write (including --resume-last resumes), never for read-only runs - reviews and other read-only paths are behaviorally unchanged.

Testing

node --test tests/runtime.test.mjs: new assertions verify the fake app-server records approvalPolicy: "on-request" + sandbox: "workspace-write" on write runs, never + read-only on read-only runs, and on-request on the --resume-last --write resume path. Full suite matches the baseline commit exactly in a clean checkout (the only failures in my environment are three pre-existing status/result tests that also fail on the base commit due to a live shared app-server on this machine).

Fixes #412

[rajpratham1]

This is a focused bug fix with good test coverage.

What's good
Fixes the root cause by forwarding approvalPolicy to both:
startThread()
resumeThread()
Keeps behavior unchanged for read-only tasks (never).
Enables the intended behavior for write tasks (on-request).
Adds regression tests for:
new write thread
read-only thread
resumed write thread
Updates the fake Codex fixture so tests validate the actual parameters being sent.
Code quality

The implementation is small and consistent:

approvalPolicy: options.approvalPolicy,
sandbox: options.sandbox,

is now passed in both thread creation and resume paths, eliminating the inconsistency.

The companion also correctly maps:

request.write

to

approvalPolicy = on-request
sandbox = workspace-write

which matches expected behavior.

Tests

The new tests verify exactly what the fix intends:

✅ write task → on-request
✅ read-only task → never
✅ resume write task → on-request

This provides good regression coverage.