From c480dd012eed01f77cfd033c0abc30431020b0cb Mon Sep 17 00:00:00 2001
From: Petr Nyc <petr.nyc@oracle.com>
Date: Tue, 4 Aug 2026 17:21:05 +0200
Subject: [PATCH] august 2026

---
 .codex/config.toml         | 241 +++++++++++++++++++++++++++++++++----
 .ssh/config.oci            |  30 ++++-
 .ssh/config.solaris        |   6 +-
 .ssh/config.solaris-domain |  16 +++
 .zshrc                     |   4 +
 bin/codex-sso              |  22 +++-
 6 files changed, 286 insertions(+), 33 deletions(-)
 create mode 100644 .ssh/config.solaris-domain

diff --git a/.codex/config.toml b/.codex/config.toml
index 12b2372..cb1df72 100644
--- a/.codex/config.toml
+++ b/.codex/config.toml
@@ -1,4 +1,9 @@
-model_provider = "headroom"
+model_provider = "openai"
+model = "gpt-5.6-luna"
+openai_base_url = "http://127.0.0.1:8787/v1"
+
+# Work around Headroom 0.25.0 stripping Codex model metadata.
+model_catalog_json = "/Users/jetpac/.codex-test/models_cache.json"
 
 # doc: https://developers.openai.com/codex/config-advanced
 #      https://developers.openai.com/codex/config-reference
@@ -14,7 +19,7 @@ model_provider = "headroom"
 
 
 
-model = "gpt-5.5"
+# model = "gpt-5.6-sol"
 
 
 # web_search is deprecated
@@ -25,16 +30,18 @@ allowed_web_search_modes = [ "live" ]
 
 trust_level = "trusted"
 
-sandbox_mode = "workspace-write"
+# sandbox_mode = "workspace-write"
 personality = "pragmatic"
-model_reasoning_effort = "medium"
-plan_mode_reasoning_effort = "high"
+model_reasoning_effort = "low"
+plan_mode_reasoning_effort = "xhigh"
 
 
 
 notify = ["/Users/jetpac/.codex/computer-use/Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient", "turn-ended"]
 # approvals_reviewer = "guardian_subagent"
+# approvals_reviewer  = "user"
 approvals_reviewer  = "auto_review"
+service_tier = "default"
 
 
 [features]
@@ -42,6 +49,7 @@ multi_agent = true
 goals = true
 js_repl = false
 terminal_resize_reflow = true
+memories = true
 # remote_control = true
 
 [agents]
@@ -146,7 +154,7 @@ SLACK_MCP_ENABLE_WRITES = "true"
 # C0A71SCTQRM for Codex Slack MCP setup instructions,
 # C05RJJ18EAF for corparch-core-srv replies,
 # and D03AY0JMFDZ for this approved setup thread.
-SLACK_MCP_WRITE_CHANNEL_ALLOWLIST = "D7PT0SXMK,D9CF41WHG,DFYAKGQFL,D08G5NZAN2C,D090RLVUCUV,DEPU4A2QM,D02CNJ53H8X,C0A71SCTQRM,C05RJJ18EAF,D03AY0JMFDZ"
+SLACK_MCP_WRITE_CHANNEL_ALLOWLIST = "D7PT0SXMK,D9CF41WHG,DFYAKGQFL,D08G5NZAN2C,D090RLVUCUV,DEPU4A2QM,D02CNJ53H8X,C0A71SCTQRM,C05RJJ18EAF,D03AY0JMFDZ,D05B7C5F6AY"
 
 [mcp_servers.slack.tools.conversations_add_message]
 approval_mode = "approve"
@@ -354,6 +362,21 @@ approval_mode = "approve"
 [mcp_servers.webrti.tools."webrti.list_by_date"]
 approval_mode = "approve"
 
+[mcp_servers.webrti.tools."webrti.dump_raw_xml"]
+approval_mode = "approve"
+
+[mcp_servers.webrti.tools."webrti.get_packages_by_arch"]
+approval_mode = "approve"
+
+[mcp_servers.webrti.tools."webrti.get_objects_by_arch"]
+approval_mode = "approve"
+
+[mcp_servers.webrti.tools."webrti.create_rti"]
+approval_mode = "prompt"
+
+[mcp_servers.webrti.env]
+WEBRTI_ENABLE_WRITES = "true"
+
 [mcp_servers.bugdb]
 command = "/Users/jetpac/.codex/bin/bugdb-mcp"
 startup_timeout_sec = 30.0
@@ -429,6 +452,15 @@ approval_mode = "approve"
 [mcp_servers.central_confluence.tools.confluence_search_user]
 approval_mode = "approve"
 
+[mcp_servers.central_confluence.tools.confluence_get_comments]
+approval_mode = "approve"
+
+[mcp_servers.central_confluence.tools.confluence_get_labels]
+approval_mode = "approve"
+
+[mcp_servers.central_confluence.tools.confluence_get_page_attachments]
+approval_mode = "approve"
+
 [mcp_servers.notmuch]
 command = "node"
 args = ["/Users/jetpac/Documents/codex-tools/MCPs/notmuch/dist/index.js"]
@@ -481,6 +513,8 @@ jenkins_get_job               = { approval_mode = "approve" }
 jenkins_get_job_config        = { approval_mode = "approve" }
 jenkins_get_log               = { approval_mode = "approve" }
 jenkins_get_node              = { approval_mode = "approve" }
+jenkins_runtime               = { approval_mode = "approve" }
+# jenkins_start_build           = { approval_mode = "approve" }
 jenkins_get_queue_item        = { approval_mode = "approve" }
 jenkins_get_stage_log         = { approval_mode = "approve" }
 jenkins_get_test_results      = { approval_mode = "approve" }
@@ -512,6 +546,9 @@ approval_mode = "approve"
 [mcp_servers.vm.tools.vm_get_resources]
 approval_mode = "approve"
 
+[mcp_servers.vm.tools.vm_list_templates]
+approval_mode = "approve"
+
 [mcp_servers.vcap]
 command = "node"
 args = ["/Users/jetpac/Documents/codex-tools/MCPs/vcap-mcp/dist/index.js"]
@@ -520,7 +557,7 @@ tool_timeout_sec = 60.0
 
 [mcp_servers.vcap.env]
 VCAP_MCP_USERNAME = "petr.nyc"
-VCAP_MCP_API_KEY = "b6e395b4-7e4b-4ba0-bdcd-a803c5dedbbb"
+VCAP_MCP_API_KEY = "8ee9fc5c-d826-4cbd-a1e5-f9857c9ab05a"
 VCAP_MCP_BASE_URL = "https://vcap.us.oracle.com/vcap"
 VCAP_MCP_ALLOW_MUTATIONS = "false"
 
@@ -1047,13 +1084,103 @@ trust_level = "trusted"
 [projects."/Users/jetpac/Documents/OSD/calico-scm"]
 trust_level = "trusted"
 
+[projects."/Users/jetpac/tmp/codex-ollama-test"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr/release-tools"]
+trust_level = "trusted"
+
+[projects."/private/tmp/ee"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/Solaris/ips-sru"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/on-sru/solaris/on/production"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/obsidian"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD-marketplace"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/Solaris/11.3-custom"]
+trust_level = "trusted"
+
+[projects."/private/tmp/empty/e"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/trainings"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-02/i-have-a-web-training-i-5"]
+trust_level = "trusted"
+
+[projects."/private/tmp/course"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/i-wa"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/use-chrome-go-to-https-eeho"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/computer-use-plugin-computer-use-openai"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/use-chrome-go-to-https-eeho-2"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr-review/oci-desktop-service-shepherd"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr-review/oci-desktop-service-console-plugin"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/userland-pipeline/solaris/akidr/scripts"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/codex-start-with-autoreview-from-command"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/codex-start-with-autoreview-from-command-2"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/are"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/are-2"]
+trust_level = "trusted"
+
+[projects."/Applications/ChatGPT.app/Contents/Resources"]
+trust_level = "trusted"
+
+[projects."/"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/marketplace_images"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/solaris-cluster/solaris/userland/sru"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Downloads"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/nginx-update-july-2026/oci-desktop-service-shepherd"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/nginx-update-july-2026"]
+trust_level = "trusted"
+
 [marketplaces.openai-bundled]
-last_updated = "2026-05-28T10:46:49Z"
+last_updated = "2026-08-03T08:15:24Z"
 source_type = "local"
 source = "/Users/jetpac/.codex/.tmp/bundled-marketplaces/openai-bundled"
 
 [marketplaces.openai-primary-runtime]
-last_updated = "2026-04-28T18:12:08Z"
+last_updated = "2026-08-03T08:16:52Z"
 source_type = "local"
 source = "/Users/jetpac/.cache/codex-runtimes/codex-primary-runtime/plugins/openai-primary-runtime"
 
@@ -1069,11 +1196,34 @@ enabled = true
 [plugins."browser@openai-bundled"]
 enabled = true
 
+[plugins."sites@openai-bundled"]
+enabled = true
+
+[plugins."chrome@openai-bundled"]
+enabled = true
+
+[plugins."pdf@openai-primary-runtime"]
+enabled = true
+
+[plugins."template-creator@openai-primary-runtime"]
+enabled = true
+
+[plugins."computer-use@openai-bundled"]
+enabled = true
+
+[plugins."visualize@openai-bundled"]
+enabled = true
+
 [desktop]
 appearanceTheme = "system"
 composerEnterBehavior = "cmdIfMultiline"
-preventSleepWhileRunning = false
+preventSleepWhileRunning = true
 keepRemoteControlAwakeWhilePluggedIn = false
+conversationDetailMode = "STEPS_COMMANDS"
+ambient-suggestions-enabled = false
+followUpQueueMode = "queue"
+dock-icon-preference = "codex-system"
+show-context-window-usage = true
 
 [desktop.open-in-target-preferences]
 global = "iterm2"
@@ -1085,6 +1235,19 @@ global = "iterm2"
 [apps.connector_4aaab2856305417b993eca9a216aaf6e.tools."microsoft outlook email_send_email"]
 approval_mode = "approve"
 
+[shell_environment_policy.set]
+BROWSER_USE_AVAILABLE_BACKENDS = "chrome,iab"
+NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "028a14b6eaa6d98dac2aae00764345ab9f244801ed8493d42b9af3be5575006e,f204d340535055781952b10ed396de20b842f00a19e430852f7e121ad1ce91f6"
+NODE_REPL_TRUSTED_CODE_PATHS = "/Users/jetpac/.codex"
+
+[hooks.state]
+
+[hooks.state."/Users/jetpac/.codex/hooks.json:post_tool_use:0:0"]
+trusted_hash = "sha256:ac371f260e4b23ba1d1b7a4ad68a44a323a8470b61f38471a47aceac1b7a5a7c"
+
+[hooks.state."/Users/jetpac/.codex/hooks.json:pre_tool_use:0:0"]
+trusted_hash = "sha256:fc87dbee1cb8a9be4f78ba094c4fa8d5e2fd38cb800854e3717f9b6a52fe2a47"
+
 # [projects."/Users/jetpac/Documents/codex-tools/MCPs/ident-scm-mcp"]
 # trust_level = "trusted"
 
@@ -1334,6 +1497,30 @@ approval_mode = "approve"
 [mcp_servers.mcp_gateway.tools.devops__get_property_defaults]
 approval_mode = "approve"
 
+[mcp_servers.mcp_gateway.tools.scm__oci_devops_pr_activities]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_tenancy_by_id]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_shepherd_compartments_by_phonebook]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__list_shepherd_compartments]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.bitbucket__search]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.jira__jira_get_user_profile]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.bitbucket__get_comments]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_shepherd_region_details]
+approval_mode = "approve"
+
 [mcp_servers.headroom]
 command = "headroom"
 args = ["mcp", "serve"]
@@ -1345,21 +1532,31 @@ args = ["--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-s
 
 [mcp_servers.node_repl]
 args = []
-command = "/Applications/Codex.app/Contents/Resources/node_repl"
+command = "/Applications/Codex.app/Contents/Resources/cua_node/bin/node_repl"
 startup_timeout_sec = 120
 
 [mcp_servers.node_repl.env]
 NODE_REPL_NATIVE_PIPE_CONNECT_TIMEOUT_MS = "1000"
-NODE_REPL_NODE_MODULE_DIRS = ""
-NODE_REPL_NODE_PATH = "/Applications/Codex.app/Contents/Resources/node"
+NODE_REPL_NODE_MODULE_DIRS = "/Applications/Codex.app/Contents/Resources/cua_node/lib/node_modules"
+NODE_REPL_NODE_PATH = "/Applications/Codex.app/Contents/Resources/cua_node/bin/node"
 NODE_REPL_TRUSTED_CODE_PATHS = "/Users/jetpac/.codex"
 CODEX_HOME = "/Users/jetpac/.codex"
-NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "496c7b3cb95b4bc20cff49b513150606e0da0000c92bf752206bee5a6c248423"
-BROWSER_USE_AVAILABLE_BACKENDS = "iab"
-BROWSER_USE_MARKETPLACE_NAME = "openai-bundled"
-NODE_REPL_UNTRUSTED_ENV_ALLOWLIST = "BROWSER_USE_MARKETPLACE_NAME"
+NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "028a14b6eaa6d98dac2aae00764345ab9f244801ed8493d42b9af3be5575006e,f204d340535055781952b10ed396de20b842f00a19e430852f7e121ad1ce91f6"
+BROWSER_USE_AVAILABLE_BACKENDS = "chrome,iab"
+NODE_REPL_INSTRUCTIONS_USE_CASE_BROWSER = "Control the in-app browser in conjunction with the Browser Plugin."
+NODE_REPL_INSTRUCTIONS_USE_CASE_CHROME = "Control the Chrome browser in conjunction with the Chrome Plugin. Prefer this method of controlling Chrome over alternatives (such as Computer Use) unless the user explicitly mentions an alternative."
+NODE_REPL_INSTRUCTIONS_USE_CASE_COMPUTER_USE = "Control desktop apps on macOS through Computer Use."
+BROWSER_USE_CODEX_APP_BUILD_FLAVOR = "prod"
+BROWSER_USE_CODEX_APP_VERSION = "26.727.51351"
+SKY_CUA_SERVICE_PATH = "/Users/jetpac/.codex/computer-use/Codex Computer Use.app"
 CODEX_CLI_PATH = "/Applications/Codex.app/Contents/Resources/codex"
 
+[mcp_servers.computer-use]
+command = "./Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient"
+args = ["mcp"]
+cwd = "."
+enabled = false
+
 # [mcp_servers.remote_ssh]
 # command = "/Users/jetpac/.codex/remote-ssh-mcp/node_modules/.bin/tsx"
 # args = ["/Users/jetpac/.codex/remote-ssh-mcp/src/index.ts"]
@@ -1388,8 +1585,8 @@ CODEX_CLI_PATH = "/Applications/Codex.app/Contents/Resources/codex"
 # [mcp_servers.local_exec.tools.local_exec_run]
 # approval_mode = "approve"
 
-[model_providers.headroom]
-name = "OpenAI via Headroom proxy"
-base_url = "http://127.0.0.1:8787/v1"
-supports_websockets = true
-env_http_headers = { "X-Headroom-Project" = "HEADROOM_PROJECT" }
+# [model_providers.headroom]
+# name = "OpenAI via Headroom proxy"
+# base_url = "http://127.0.0.1:8787/v1"
+# supports_websockets = true
+# env_http_headers = { "X-Headroom-Project" = "HEADROOM_PROJECT" }
diff --git a/.ssh/config.oci b/.ssh/config.oci
index 00ef7a6..9a30637 100644
--- a/.ssh/config.oci
+++ b/.ssh/config.oci
@@ -3,17 +3,35 @@ Include ssh_configs/config
 Include osd_configs/config
 Include user
 
+Host *
+  WarnWeakCrypto no
+
+# Host bitbucket.oci.oraclecorp.com
+# 	IdentityFile ~/.ssh/orabucket
+# 	HostkeyAlgorithms +ssh-rsa
+#	PubkeyAcceptedAlgorithms +ssh-rsa
+
+Include config.solaris-domain
+
 Host bitbucket.oci.oraclecorp.com
-	IdentityFile ~/.ssh/orabucket
-	HostkeyAlgorithms +ssh-rsa
-	PubkeyAcceptedAlgorithms +ssh-rsa
+    HostName bitbucket.oci.oraclecorp.com
+    Port 7999
+    IdentityFile ~/.ssh/orabucket
+    IdentitiesOnly yes
+    AddKeysToAgent yes
+    UseKeychain yes
+
+Host s11sru-x01 s11sru-x01.us.oracle.com
+     KexAlgorithms +diffie-hellman-group1-sha1
+
 
 Host github.com
   IdentityFile ~/.ssh/github.com
 
 Host dabel dabel.us.oracle.com andel andel.us.oracle.com gates gates.us.oracle.com on10-patch.us.oracle.com scapen*
-	User pnyc
-	IdentityFile ~/.ssh/dabel.key
+  User pnyc
+  IdentityFile ~/.ssh/dabel.key
+  ForwardAgent yes
   RequestTTY yes
 
 Host codex.webad1phx.solarisx86phx.oraclevcn.com
@@ -51,4 +69,4 @@ Host pnyc-ws
   IdentityFile ~/.ssh/id_pnyc-ws
   IdentitiesOnly yes
   WarnWeakCrypto no
-  ForwardAgent yes
\ No newline at end of file
+  ForwardAgent yes
diff --git a/.ssh/config.solaris b/.ssh/config.solaris
index 9827740..57f20ad 100644
--- a/.ssh/config.solaris
+++ b/.ssh/config.solaris
@@ -1,5 +1,6 @@
 # Include config-scm
 
+Include config.solaris-domain
 
 Host *
 # 	UseKeychain yes
@@ -18,6 +19,8 @@ Host *
 Host 192.168.2.*
 	IdentitiesOnly yes
 
+
+
 Host osd-fra
   User desktopuser
   HostName 100.109.60.126
@@ -89,7 +92,7 @@ Host 192.168.2.1 gw gw.doma.jetpac.org
 Host github.com
 	IdentityFile ~/.ssh/github.com
 
-Host bitbucket.oci.oraclecorp.com
+Host bitbucket.oci.oraclecorp.com sig-ul-sru11-3-x01.us.oracle.com sig-ul-sru11-3-s01.us.oracle.com
 	IdentityFile ~/.ssh/orabucket
 	HostkeyAlgorithms +ssh-rsa
 	PubkeyAcceptedAlgorithms +ssh-rsa
@@ -182,4 +185,3 @@ Host nori sfzfs-nori.commonsub.zsphx.oraclevcn.com
 Include ossh_configs/*.ossh
 Include ssh_configs/config
 Include osd_configs/config
-
diff --git a/.ssh/config.solaris-domain b/.ssh/config.solaris-domain
new file mode 100644
index 0000000..61e491a
--- /dev/null
+++ b/.ssh/config.solaris-domain
@@ -0,0 +1,16 @@
+# config for Solaris domains
+Host andel dabel on-11u4-bld-* re-userland-build-*01 gates s11sru-gate sig-kz-*-sc hubbins scapen-* bea100 bei100 sig-*-sru11-3-*01 s11sru-x0* s11sru-x02-sc s11sru-x01-sc
+  CanonicalizeHostname yes
+  CanonicalDomains us.oracle.com
+  PKCS11Provider none
+
+# config for service processors - requires password
+# password stored in OCI wallet - 'ops' command
+Host s11sru-x02-sc sig-kz-*-sc on-11u4-bld-*-sc s11sru-x02-sc s11sru-x01-sc
+  User root
+  HostKeyAlgorithms +ssh-rsa
+  PubkeyAuthentication no
+  PreferredAuthentications keyboard-interactive,password
+  KbdInteractiveAuthentication yes
+  # NumberOfPasswordPrompts 1
+
diff --git a/.zshrc b/.zshrc
index 2049030..9f82e2e 100644
--- a/.zshrc
+++ b/.zshrc
@@ -283,3 +283,7 @@ unset -f _profile_add_plugin _profile_add_plugin_if_command_exists 2>/dev/null |
 ### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
 export PATH="/Users/jetpac/.rd/bin:$PATH"
 ### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
+
+. "$HOME/.atuin/bin/env"
+
+eval "$(atuin init zsh --disable-up-arrow)"
diff --git a/bin/codex-sso b/bin/codex-sso
index 29a561b..a6b2947 100755
--- a/bin/codex-sso
+++ b/bin/codex-sso
@@ -10,6 +10,7 @@ HEADROOM_HOST="${HEADROOM_HOST:-127.0.0.1}"
 HEADROOM_PORT="${HEADROOM_PORT:-8787}"
 HEADROOM_LOG_FILE="${HEADROOM_LOG_FILE:-${HOME}/.headroom/logs/proxy.log}"
 CODEX_SSO_DIRECT_MODEL_PROVIDER="${CODEX_SSO_DIRECT_MODEL_PROVIDER:-openai}"
+CODEX_SSO_APPROVAL_MODE="${CODEX_SSO_APPROVAL_MODE:-config}"
 CODEX_SSO_HEADROOM_PROXY_PID=""
 
 if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
@@ -81,17 +82,32 @@ codex_sso_toml_string() {
   print -r -- "\"${value}\""
 }
 
+codex_sso_approval_args() {
+  case "${CODEX_SSO_APPROVAL_MODE}" in
+    config)
+      ;;
+    untrusted)
+      approval_args=(--disable guardian_approval -a untrusted)
+      ;;
+    *)
+      print -u2 -- "Invalid CODEX_SSO_APPROVAL_MODE: ${CODEX_SSO_APPROVAL_MODE} (expected config or untrusted)"
+      exit 2
+      ;;
+  esac
+}
+
 trap codex_sso_cleanup EXIT INT TERM
 
 codex_auth_preflight
 
 unset OPENAI_API_KEY
 unset CODEX_ACCESS_TOKEN
+approval_args=()
+codex_sso_approval_args
 
 if [[ "${CODEX_SSO_NO_HEADROOM:-}" == "1" ]]; then
-  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" --disable guardian_approval -a untrusted "$@"
+  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" "${approval_args[@]}" "$@"
 else
   codex_sso_start_headroom
-  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" "${approval_args[@]}" "$@"
 fi
-# "${CODEX_BIN}" "$@"