august 2026

bin/codex-sso

@@ -10,6 +10,7 @@ HEADROOM_HOST="${HEADROOM_HOST:-127.0.0.1}"
 HEADROOM_PORT="${HEADROOM_PORT:-8787}"
 HEADROOM_LOG_FILE="${HEADROOM_LOG_FILE:-${HOME}/.headroom/logs/proxy.log}"
 CODEX_SSO_DIRECT_MODEL_PROVIDER="${CODEX_SSO_DIRECT_MODEL_PROVIDER:-openai}"
+CODEX_SSO_APPROVAL_MODE="${CODEX_SSO_APPROVAL_MODE:-config}"
 CODEX_SSO_HEADROOM_PROXY_PID=""
 
 if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
@@ -81,17 +82,32 @@ codex_sso_toml_string() {
   print -r -- "\"${value}\""
 }
 
+codex_sso_approval_args() {
+  case "${CODEX_SSO_APPROVAL_MODE}" in
+    config)
+      ;;
+    untrusted)
+      approval_args=(--disable guardian_approval -a untrusted)
+      ;;
+    *)
+      print -u2 -- "Invalid CODEX_SSO_APPROVAL_MODE: ${CODEX_SSO_APPROVAL_MODE} (expected config or untrusted)"
+      exit 2
+      ;;
+  esac
+}
+
 trap codex_sso_cleanup EXIT INT TERM
 
 codex_auth_preflight
 
 unset OPENAI_API_KEY
 unset CODEX_ACCESS_TOKEN
+approval_args=()
+codex_sso_approval_args
 
 if [[ "${CODEX_SSO_NO_HEADROOM:-}" == "1" ]]; then
-  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" --disable guardian_approval -a untrusted "$@"
+  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" "${approval_args[@]}" "$@"
 else
   codex_sso_start_headroom
-  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" "${approval_args[@]}" "$@"
 fi
-# "${CODEX_BIN}" "$@"