@lannguyensi/harness 0.51.0 → 0.53.0

package/dist/cli/doctor/auto-approve-mode.d.ts

@@ -0,0 +1,37 @@
+import type { Manifest } from "../../schema/index.js";
+export interface AutoApproveModeWarning {
+    /**
+     * The RESOLVED effective mode (`resolveModeFromConfig(pack).mode`);
+     * never the literal `pack.config.mode` value. Always a recognised
+     * Mode literal (the resolver always returns one, defaulting to
+     * `grill_me` when `config.mode` is absent or unrecognised).
+     */
+    mode: string;
+    /** Rendered as the `⚠` line itself. */
+    message: string;
+    /**
+     * Indented detail lines rendered directly under {@link message} by
+     * `format.ts`, mirroring `understandingModeEnv`'s detail-line idiom.
+     */
+    detail: string[];
+}
+/**
+ * Pure: manifest in, a warning out (or `undefined` when there is nothing
+ * to flag). Only fires when:
+ *   - the `understanding-before-execution` pack is declared AND enabled
+ *     (a pack that never runs has no live auto-approve path to warn
+ *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
+ *     `ug-auto-approvals.ts` use);
+ *   - `config.auto_approve` parses as a valid opt-in block (schema
+ *     validation already rejects a malformed block at lint time, so a
+ *     manifest that reaches doctor with an unparseable block has
+ *     already failed loud elsewhere; this mirrors that same fail-closed
+ *     "not opted in" reading rather than re-deriving a second opinion);
+ *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
+ *     is not `"grill_me"`. An absent or unrecognised `config.mode`
+ *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
+ *     this warning, see the module header for why that resolved value,
+ *     not the literal config key, is what the auto path's report
+ *     actually carries.
+ */
+export declare function checkAutoApproveMode(manifest: Manifest): AutoApproveModeWarning | undefined;

package/dist/cli/doctor/auto-approve-mode.js

@@ -0,0 +1,80 @@
+// Doctor advisory (agent-tasks abfad738, follow-up of ADR
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1): warn when
+// an operator has opted into the hook-written signed auto-marker path
+// (`policy_packs[understanding-before-execution].config.auto_approve`)
+// without also pairing it with `mode: grill_me`.
+//
+// Why this matters: the auto-approval path's report precondition reuses
+// `validatePersistedReport` (`src/cli/approve/understanding.ts`), which
+// only enforces the report's `mode` field when it is `grill_me`.
+// Outside that mode, report validation is structural only (the report
+// exists and belongs to the session, not that its contents reflect any
+// real understanding exchange). Both the ADR (recommendation 4) and the
+// pack doc recommend pairing `auto_approve` with `grill_me` for exactly
+// this reason. Nothing surfaced the gap before this check: an operator
+// who opts a non-grill_me mode into `auto_approve` gets no signal that
+// the auto path's report gate has degraded to a near-no-op.
+//
+// Deliberately advisory, never an error: `auto_approve` outside
+// `grill_me` is a real, if weaker, gate (the permission-mode allowlist
+// and the signed marker still apply), not a misconfiguration.
+//
+// This check reads `resolveModeFromConfig(pack).mode`, the same
+// GENERATION-path resolver `checkUnderstandingModeEnvDivergence` and
+// `resolveBuiltinDefaultConfig` use, NOT `pack.config.mode` verbatim.
+// A missing `config.mode` resolves to `DEFAULT_MODE` (`grill_me`), and
+// that resolved value is what the generated Stop-hook command actually
+// passes as `UNDERSTANDING_GATE_MODE`, so a report written under an
+// unset `mode` genuinely carries `grill_me` and IS the strict check;
+// there is no gap to warn about. An unrecognised `config.mode` literal
+// also resolves to `grill_me` this same way, with its own warning
+// already surfaced elsewhere (`resolveModeFromConfig`'s `warning`
+// return, consumed by `harness validate` / other doctor checks); this
+// check does not duplicate that.
+//
+// A session-level `UNDERSTANDING_GATE_MODE` env override that diverges
+// from the resolved `config.mode` is a SEPARATE gap, already covered by
+// `checkUnderstandingModeEnvDivergence` (`understanding-mode-env.ts`)'s
+// own advisory line, this check only ever reads the manifest, never
+// `process.env`.
+import { resolveModeFromConfig } from "../../policy-packs/builtin/understanding-before-execution.js";
+import { parseAutoApprove } from "../../policy-packs/builtin/understanding-before-execution/index.js";
+import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
+/**
+ * Pure: manifest in, a warning out (or `undefined` when there is nothing
+ * to flag). Only fires when:
+ *   - the `understanding-before-execution` pack is declared AND enabled
+ *     (a pack that never runs has no live auto-approve path to warn
+ *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
+ *     `ug-auto-approvals.ts` use);
+ *   - `config.auto_approve` parses as a valid opt-in block (schema
+ *     validation already rejects a malformed block at lint time, so a
+ *     manifest that reaches doctor with an unparseable block has
+ *     already failed loud elsewhere; this mirrors that same fail-closed
+ *     "not opted in" reading rather than re-deriving a second opinion);
+ *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
+ *     is not `"grill_me"`. An absent or unrecognised `config.mode`
+ *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
+ *     this warning, see the module header for why that resolved value,
+ *     not the literal config key, is what the auto path's report
+ *     actually carries.
+ */
+export function checkAutoApproveMode(manifest) {
+    const pack = findEnabledUnderstandingPack(manifest);
+    if (!pack)
+        return undefined;
+    const autoApprove = parseAutoApprove(pack.config["auto_approve"]);
+    if (autoApprove === null)
+        return undefined;
+    const { mode } = resolveModeFromConfig(pack);
+    if (mode === "grill_me")
+        return undefined;
+    return {
+        mode,
+        message: `auto_approve is configured with mode ${mode} (policy_packs[understanding-before-execution].config.mode); report validation is structural only outside grill_me`,
+        detail: [
+            "set config.mode: grill_me, or accept the weaker report gate; see docs/policy-packs/understanding-before-execution.md",
+        ],
+    };
+}
+//# sourceMappingURL=auto-approve-mode.js.map

package/dist/cli/doctor/auto-approve-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-approve-mode.js","sourceRoot":"","sources":["../../../src/cli/doctor/auto-approve-mode.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,iDAAiD;AACjD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,8DAA8D;AAC9D,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,iBAAiB;AAEjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oEAAoE,CAAC;AAEtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAmB3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAE1C,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,wCAAwC,IAAI,oHAAoH;QACzK,MAAM,EAAE;YACN,sHAAsH;SACvH;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/bypass-without-auto-approve.d.ts

@@ -0,0 +1,38 @@
+import type { Manifest } from "../../schema/index.js";
+export interface BypassWithoutAutoApproveFinding {
+    /** The newest observed session that tripped this finding. */
+    sessionId: string;
+    /** That observation's `observedAt` (ISO). */
+    observedAt: string;
+    /** Rendered as the `⚠` line itself. */
+    message: string;
+    /**
+     * Indented detail lines rendered directly under {@link message},
+     * mirroring the other advisory checks' idiom. Ends with the exact
+     * `auto_approve` snippet (the same one `harness init` ships and
+     * `harness pack upgrade understanding-before-execution` inserts, see
+     * auto-approve-default.ts) and names the upgrade command.
+     */
+    detail: string[];
+}
+/**
+ * Pure(-ish): manifest + `generatedDir` in, a finding out (or
+ * `undefined` when there is nothing to flag). Only fires when:
+ *   - the `understanding-before-execution` pack is declared AND enabled
+ *     (mirrors every sibling advisory's gate: a pack that never runs
+ *     has no auto-approve path to be missing);
+ *   - at least one of the newest `recentSessions` hook-written
+ *     observations records `permissionMode === "bypassPermissions"`;
+ *   - `auto_approve` does NOT cover that combination today: either the
+ *     block is absent/malformed (`parseAutoApprove` returns `null`), or
+ *     `bypassPermissions` is not in `when`, or `claude-code` is not in
+ *     `harnesses` (an operator who opted Codex in alone, dropping
+ *     Claude Code, still has this exact gap on the Claude Code side).
+ *
+ * Reports the NEWEST qualifying observation only: this is a "you have
+ * at least one gap" flag, not a per-session audit; `ugAutoApprovals`
+ * already owns the full listing idiom for that.
+ */
+export declare function checkBypassWithoutAutoApprove(manifest: Manifest, generatedDir: string, opts: {
+    recentSessions: number;
+}): BypassWithoutAutoApproveFinding | undefined;

package/dist/cli/doctor/bypass-without-auto-approve.js

@@ -0,0 +1,89 @@
+// Doctor finding for the Mac-mini incident shape (task 8f637efd,
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Amendment: install
+// default"): a session ran under `bypassPermissions` (observed on the
+// PreToolUse payload by the hook itself, see
+// permission-mode-observations.ts) but `auto_approve` is missing, or
+// present without covering `bypassPermissions` for `claude-code`. In
+// that shape every gated call in the session falls through to the manual
+// `harness approve understanding` prompt, which is exactly the gap the
+// operator hit: the pack expects an unattended session under
+// `bypassPermissions` to have opted in, and nothing said otherwise.
+//
+// This check reads ONLY the hook-written observation
+// (`.permission-mode-observations/`), never the ledger and never the
+// persisted report: both are agent-writable, and the evidence-ledger
+// trust boundary this pack already enforces for approval
+// (docs/okf/evidence-ledger-trust-boundary.md) applies to a doctor
+// finding just as much as to a gate decision: a fact the AGENT can write
+// must not be what tells the operator "you meant to opt in and didn't".
+//
+// Deliberately advisory (⚠), never an error: an operator who runs
+// `bypassPermissions` sessions on the manual approval path on purpose
+// (never wanting unattended auto-approval) is not misconfigured.
+//
+// THE OBSERVATION IS UNSIGNED (review round 3, F2). "Never the ledger,
+// never the persisted report" above is about the WRITE PATH (this
+// finding does not trust an agent-writable ledger row or report field),
+// not a claim that the observation itself is tamper-proof: unlike the
+// approval marker, `permission-mode-observations.ts`'s record carries no
+// signature, so it is evidence that `harness pack hook pre-tool-use` was
+// invoked with a given `session_id`/`permission_mode` on its stdin, not
+// proof that a particular session actually ran under that mode: an
+// already-approved session (or anything else able to invoke the hook
+// binary directly) can write, or forge, one. That is exactly why this
+// finding stays advisory-only and never feeds a gate or an approval: the
+// operator who reads it decides what it means. A possible future
+// hardening is signing the observation the way approval markers are
+// signed.
+import { CLAUDE_CODE_HARNESS, harnessAllowed, listPermissionModeObservations, parseAutoApprove, permissionModeAllowed, renderAutoApproveSnippet, sanitizeForDisplay, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
+/** The one payload literal this finding cares about (T1, see the ADR's signal table). */
+const BYPASS_MODE = "bypassPermissions";
+/**
+ * Pure(-ish): manifest + `generatedDir` in, a finding out (or
+ * `undefined` when there is nothing to flag). Only fires when:
+ *   - the `understanding-before-execution` pack is declared AND enabled
+ *     (mirrors every sibling advisory's gate: a pack that never runs
+ *     has no auto-approve path to be missing);
+ *   - at least one of the newest `recentSessions` hook-written
+ *     observations records `permissionMode === "bypassPermissions"`;
+ *   - `auto_approve` does NOT cover that combination today: either the
+ *     block is absent/malformed (`parseAutoApprove` returns `null`), or
+ *     `bypassPermissions` is not in `when`, or `claude-code` is not in
+ *     `harnesses` (an operator who opted Codex in alone, dropping
+ *     Claude Code, still has this exact gap on the Claude Code side).
+ *
+ * Reports the NEWEST qualifying observation only: this is a "you have
+ * at least one gap" flag, not a per-session audit; `ugAutoApprovals`
+ * already owns the full listing idiom for that.
+ */
+export function checkBypassWithoutAutoApprove(manifest, generatedDir, opts) {
+    const pack = findEnabledUnderstandingPack(manifest);
+    if (!pack)
+        return undefined;
+    const observations = listPermissionModeObservations(generatedDir, {
+        windowSize: opts.recentSessions,
+    });
+    const bypassObserved = observations.entries.find((e) => e.permissionMode === BYPASS_MODE);
+    if (!bypassObserved)
+        return undefined;
+    const autoApprove = parseAutoApprove(pack.config["auto_approve"]);
+    const covered = permissionModeAllowed(autoApprove, BYPASS_MODE) &&
+        harnessAllowed(autoApprove, CLAUDE_CODE_HARNESS);
+    if (covered)
+        return undefined;
+    // Sanitise at the render boundary as well, not only in the reader
+    // (mirrors persisted-reports.ts): both fields are payload-controlled.
+    const sessionId = sanitizeForDisplay(bypassObserved.sessionId);
+    const observedAt = sanitizeForDisplay(bypassObserved.observedAt);
+    return {
+        sessionId,
+        observedAt,
+        message: `bypassPermissions observed for session ${sessionId} (${observedAt}) but auto_approve does not cover it; every gated call in that session needed a manual approval`,
+        detail: [
+            "run `harness pack upgrade understanding-before-execution` to insert the block below, or add it by hand under policy_packs[understanding-before-execution].config:",
+            ...renderAutoApproveSnippet(0).split("\n"),
+        ],
+    };
+}
+//# sourceMappingURL=bypass-without-auto-approve.js.map

package/dist/cli/doctor/bypass-without-auto-approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bypass-without-auto-approve.js","sourceRoot":"","sources":["../../../src/cli/doctor/bypass-without-auto-approve.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,0EAA0E;AAC1E,sEAAsE;AACtE,6CAA6C;AAC7C,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,EAAE;AACF,qDAAqD;AACrD,qEAAqE;AACrE,qEAAqE;AACrE,yDAAyD;AACzD,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,iEAAiE;AACjE,oEAAoE;AACpE,UAAU;AAEV,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,8BAA8B,EAC9B,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sEAAsE,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,yFAAyF;AACzF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAmBxC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAkB,EAClB,YAAoB,EACpB,IAAgC;IAEhC,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,YAAY,GAAG,8BAA8B,CAAC,YAAY,EAAE;QAChE,UAAU,EAAE,IAAI,CAAC,cAAc;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC;IAC1F,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC/C,cAAc,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAE9B,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACjE,OAAO;QACL,SAAS;QACT,UAAU;QACV,OAAO,EAAE,0CAA0C,SAAS,KAAK,UAAU,iGAAiG;QAC5K,MAAM,EAAE;YACN,mKAAmK;YACnK,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/codex-config-drift.d.ts

@@ -0,0 +1,28 @@
+import type { Manifest } from "../../schema/index.js";
+export interface CodexConfigDriftSection {
+    /** ⚠ lines; each rolls into warningCount. */
+    warnings: string[];
+}
+/**
+ * Whether the manifest's `understanding-before-execution` pack has opted
+ * Codex into the `auto_approve` path (`auto_approve.harnesses` contains
+ * `"codex"`). Pure and side-effect-free: reuses the same fail-closed
+ * parser the Codex PreToolUse hook itself consults
+ * (`attemptAutoApproval` in `../pack/auto-approve-path.ts`), so a
+ * malformed `auto_approve` block resolves to "not opted in" here too,
+ * never a guess.
+ */
+export declare function isCodexOptedIntoAutoApprove(manifest: Manifest): boolean;
+export interface BuildCodexConfigDriftOptions {
+    /** `harness.generated/` for the manifest in use; kept for shape-parity with `BuildSettingsDriftOptions` (`driftCheckOpts` in index.ts is shared between both), unused by this check (see module header: no baseline exists to read here). */
+    generatedDir: string;
+    /** `harness.lock` path for the manifest in use; kept for the same shape-parity reason as `generatedDir`, unused by this check. */
+    lockPath: string;
+    /** Resolves the repo-scoped candidate file (`<cwd>/.codex/config.toml`). */
+    cwd: string;
+    /** Operator home; resolves the default `$CODEX_HOME` when the env var is unset. */
+    home: string;
+    /** Env for `CODEX_HOME` resolution. */
+    env: NodeJS.ProcessEnv;
+}
+export declare function buildCodexConfigDrift(opts: BuildCodexConfigDriftOptions): CodexConfigDriftSection;

package/dist/cli/doctor/codex-config-drift.js

@@ -0,0 +1,240 @@
+// Codex counterpart of settings-drift.ts (ADR
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md, threat model (c),
+// "Audit and doctor"), follow-up of slice 2 (agent-tasks f59ea0eb).
+//
+// `approval_policy = "never"` is the MEASURED signal: dogfood/ug-auto-
+// mode-signals/README.md section (l) (Codex TUI) shows `tui-config-never`
+// (`config.toml`: `approval_policy = "never"`) reports `bypassPermissions`
+// where the otherwise-comparable `tui-default` shape (no `approval_policy`
+// set) reports `default`, and section (k) (Codex exec) shows the same
+// key discriminating `exec-onrequest`/`exec-onfailure` (`bypassPermissions`
+// regardless, exec auto-approves almost everything headless) from nothing
+// special, i.e. exec's own vocabulary does not turn on this key either
+// way there. The `default_permissions` full-access check below is NOT a
+// measured signal in the same sense: section (k)'s exec rows show
+// `config-perm-fullaccess` (`default_permissions = ":danger-full-access"`)
+// and `config-perm-readonly` (`default_permissions = ":read-only"`) both
+// reporting `bypassPermissions`, i.e. this key does not discriminate
+// `permission_mode` at all under `codex exec`, and section (l)'s TUI
+// table has no `default_permissions`-via-`config.toml` row at all (the
+// one full-access TUI shape, `tui-perm-full-access`, was set through the
+// `/permissions` menu, not this config key, per
+// `payloads/codex-tui-perm-full-access.config.toml`). This check flags
+// `default_permissions` as a threat-model heuristic on a key the operator
+// can set (it is documented Codex config surface that plausibly feeds a
+// yet-unmeasured code path), not because measurement showed it moving
+// `permission_mode`.
+//
+// Either key pre-sets the trusted `when`-allowlist signal the Codex
+// auto-approval path (`src/cli/pack/auto-approve-path.ts`,
+// `CODEX_HARNESS`) consumes, the same way `permissions.defaultMode` does
+// for Claude Code (settings-drift.ts's module header, threat model (c)).
+//
+// Gated on the pack's `auto_approve.harnesses` actually listing `codex`
+// (`isCodexOptedIntoAutoApprove` below): a repo that never opted Codex
+// into the auto path has no live Codex `permission_mode` signal for this
+// key to pre-set, so warning there would be noise unconnected to any
+// live risk (mirrors the per-harness gate `attemptAutoApproval` itself
+// applies before the `when` allowlist, `auto-approve.ts`'s module
+// header).
+//
+// Unlike settings-drift.ts's `permissions.defaultMode` check, this is
+// NOT drift-gated (warn only when the live value differs from the
+// apply-time baseline): `approval_policy = "never"` is a real live risk
+// the moment it is present, whether or not it was already there at the
+// last `harness apply`, so this check always warns while present and
+// opted in. There is no apply-time three-way distinction to annotate
+// with either: harness never snapshots the operator's live, whole
+// `config.toml` (only `harness apply --runtime codex --install`'s own
+// generated hook block, merged in place by `install-codex-config.ts`,
+// ever lands in `.last-apply`'s `"codex/config.toml"` entry), and
+// `apply.ts` never records a `kind: "target"` lock entry for the
+// installed Codex config path the way it does for Claude Code's
+// `--target` write, so there is no baseline to compare the live value
+// against and no lock entry to tell a harness-touched file apart from
+// one it has never seen. Every warning below therefore carries the same
+// constant `NO_SNAPSHOT_SUFFIX`, reporting presence, not drift.
+//
+// Fail-open, like every other doctor check in this family: a missing or
+// unreadable candidate file resolves to "nothing to report" for that
+// file, and a candidate whose TOML this module's minimal scanner cannot
+// make sense of (an unterminated quoted string) adds ONE diagnostic
+// line, never a thrown error; the keys that did parse from the rest of
+// that same file are still evaluated and can still warn.
+//
+// No full TOML parser: none is a dependency of this package (checked
+// before writing this file), and `install-codex-config.ts` itself never
+// parses the operator's config.toml into an object either, it locates
+// harness's own managed block by string search. This module only needs
+// two ROOT-LEVEL (not inside any `[table]`) string-valued keys, so a
+// small line-oriented scanner is enough: it accepts a bare or quoted key
+// (`approval_policy = ...` and `"approval_policy" = ...`), skips over
+// multi-line basic/literal string bodies (`"""`/`'''`) so a body line
+// that happens to look like `key = "value"` inside one is never
+// mistaken for a root-level assignment, and does not attempt custom
+// `[profiles.*]` tables: a profile-scoped `approval_policy` under
+// `[profiles.<name>]` is out of scope and not detected today (see the
+// task's constraints).
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { PACK_NAME as UNDERSTANDING_PACK_NAME } from "../../policy-packs/builtin/understanding-before-execution.js";
+import { CODEX_HARNESS, harnessAllowed, parseAutoApprove, } from "../../policy-packs/builtin/understanding-before-execution/auto-approve.js";
+import { tildeize } from "./settings-drift.js";
+/** Every warning line carries this: harness keeps no apply-time snapshot of a live Codex config.toml (see module header). */
+const NO_SNAPSHOT_SUFFIX = " (harness keeps no apply-time snapshot of this file; presence only)";
+/**
+ * Whether the manifest's `understanding-before-execution` pack has opted
+ * Codex into the `auto_approve` path (`auto_approve.harnesses` contains
+ * `"codex"`). Pure and side-effect-free: reuses the same fail-closed
+ * parser the Codex PreToolUse hook itself consults
+ * (`attemptAutoApproval` in `../pack/auto-approve-path.ts`), so a
+ * malformed `auto_approve` block resolves to "not opted in" here too,
+ * never a guess.
+ */
+export function isCodexOptedIntoAutoApprove(manifest) {
+    const pack = manifest.policy_packs.find((p) => p.name === UNDERSTANDING_PACK_NAME && p.enabled !== false);
+    if (!pack)
+        return false;
+    const cfg = parseAutoApprove(pack.config["auto_approve"], null);
+    return harnessAllowed(cfg, CODEX_HARNESS);
+}
+/**
+ * Scan the ROOT-LEVEL (before the first `[table]` header) `key = "..."`
+ * assignments in a Codex `config.toml` body. Returns the string-valued
+ * keys found, plus `malformed: true` when a candidate assignment opens a
+ * single-line quoted string that never closes on the same line (the one
+ * shape this scanner treats as broken TOML rather than "not a string /
+ * not a key we track"). A multi-line basic/literal string (`"""`/`'''`)
+ * is a different, valid TOML shape: every line up to and including its
+ * closing delimiter is skipped rather than scanned as assignments, and
+ * skipping it never sets `malformed`. Non-string values (numbers,
+ * booleans, arrays, inline tables) are silently skipped too, not flagged
+ * malformed: this scanner has no opinion about them. The key itself may
+ * be bare (`approval_policy`) or a quoted TOML key
+ * (`"approval_policy"` / `'approval_policy'`); either form is accepted.
+ */
+function scanRootLevelStringKeys(raw) {
+    const values = {};
+    let malformed = false;
+    let multilineDelim = null;
+    for (const rawLine of raw.split(/\r?\n/)) {
+        if (multilineDelim !== null) {
+            // Inside a multi-line basic/literal string body: this line is
+            // string content, never a root-level assignment, however much it
+            // may look like one. Only the closing delimiter ends the skip.
+            if (rawLine.includes(multilineDelim))
+                multilineDelim = null;
+            continue;
+        }
+        const line = rawLine.trim();
+        if (line.length === 0 || line.startsWith("#"))
+            continue;
+        // A `[table]` or `[[array-of-tables]]` header ends the root-level
+        // scope for every key from here on; this module only tracks
+        // root-level keys.
+        if (line.startsWith("["))
+            break;
+        const eq = line.indexOf("=");
+        if (eq === -1)
+            continue;
+        let key = line.slice(0, eq).trim();
+        if ((key.startsWith('"') && key.endsWith('"') && key.length >= 2) ||
+            (key.startsWith("'") && key.endsWith("'") && key.length >= 2)) {
+            key = key.slice(1, -1);
+        }
+        if (!/^[A-Za-z0-9_-]+$/.test(key))
+            continue;
+        const valuePart = line.slice(eq + 1).trim();
+        if (valuePart.startsWith('"""') || valuePart.startsWith("'''")) {
+            const delim = valuePart.slice(0, 3);
+            // A closing delimiter later on this same line makes it a
+            // single-line multi-line-string literal; this scanner does not
+            // track such values (out of scope, same as any other value shape
+            // it has no opinion about), it just must not treat the rest of
+            // the file as still inside the string.
+            if (valuePart.indexOf(delim, 3) === -1)
+                multilineDelim = delim;
+            continue;
+        }
+        const parsed = matchTomlString(valuePart);
+        if (parsed === null) {
+            if (valuePart.startsWith('"') || valuePart.startsWith("'"))
+                malformed = true;
+            continue;
+        }
+        values[key] = parsed;
+    }
+    return { values, malformed };
+}
+/** A basic (`"..."`) or literal (`'...'`) single-line TOML string, or `null` if `value` is not one. */
+function matchTomlString(value) {
+    if (value.startsWith('"')) {
+        const m = /^"((?:[^"\\]|\\.)*)"/.exec(value);
+        if (!m)
+            return null;
+        return (m[1] ?? "")
+            .replace(/\\"/g, '"')
+            .replace(/\\n/g, "\n")
+            .replace(/\\t/g, "\t")
+            .replace(/\\\\/g, "\\");
+    }
+    if (value.startsWith("'")) {
+        const m = /^'([^']*)'/.exec(value);
+        if (!m)
+            return null;
+        return m[1] ?? "";
+    }
+    return null;
+}
+function checkOneFile(file, warnings) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file.absolutePath, "utf8");
+    }
+    catch {
+        return;
+    }
+    const scan = scanRootLevelStringKeys(raw);
+    if (scan.malformed) {
+        warnings.push(`${file.displayLabel}: unreadable/invalid Codex config TOML`);
+        // Keep going: a malformed line elsewhere in the file must not hide a
+        // risky key that DID parse from a different line of the same file.
+    }
+    const approvalPolicy = scan.values["approval_policy"];
+    if (approvalPolicy === "never") {
+        warnings.push(`approval_policy = "never" set in ${file.displayLabel}${NO_SNAPSHOT_SUFFIX}`);
+    }
+    const defaultPermissions = scan.values["default_permissions"];
+    if (defaultPermissions !== undefined) {
+        const stripped = defaultPermissions.startsWith(":")
+            ? defaultPermissions.slice(1)
+            : defaultPermissions;
+        if (stripped === "danger-full-access") {
+            warnings.push(`default_permissions = ${JSON.stringify(defaultPermissions)} (full access) set in ${file.displayLabel}${NO_SNAPSHOT_SUFFIX}`);
+        }
+    }
+}
+export function buildCodexConfigDrift(opts) {
+    const warnings = [];
+    const codexHomeEnv = opts.env["CODEX_HOME"];
+    const codexHomeFromEnv = typeof codexHomeEnv === "string" && codexHomeEnv.trim().length > 0;
+    const codexHomeDir = codexHomeFromEnv ? codexHomeEnv : path.join(opts.home, ".codex");
+    const codexHomeConfigPath = path.join(codexHomeDir, "config.toml");
+    const candidates = [
+        {
+            absolutePath: path.resolve(codexHomeConfigPath),
+            displayLabel: codexHomeFromEnv
+                ? "$CODEX_HOME/config.toml"
+                : tildeize(codexHomeConfigPath, opts.home),
+        },
+        {
+            absolutePath: path.resolve(opts.cwd, ".codex", "config.toml"),
+            displayLabel: ".codex/config.toml",
+        },
+    ];
+    for (const c of candidates) {
+        checkOneFile(c, warnings);
+    }
+    return { warnings };
+}
+//# sourceMappingURL=codex-config-drift.js.map

package/dist/cli/doctor/codex-config-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-config-drift.js","sourceRoot":"","sources":["../../../src/cli/doctor/codex-config-drift.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,wEAAwE;AACxE,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,gDAAgD;AAChD,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,qBAAqB;AACrB,EAAE;AACF,oEAAoE;AACpE,2DAA2D;AAC3D,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,sEAAsE;AACtE,sEAAsE;AACtE,kEAAkE;AAClE,iEAAiE;AACjE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AACzE,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,uBAAuB;AAEvB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,IAAI,uBAAuB,EAAE,MAAM,8DAA8D,CAAC;AACpH,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,2EAA2E,CAAC;AAEnF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAa/C,6HAA6H;AAC7H,MAAM,kBAAkB,GAAG,qEAAqE,CAAC;AAEjG;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CACjE,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,iEAAiE;YACjE,+DAA+D;YAC/D,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,cAAc,GAAG,IAAI,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,kEAAkE;QAClE,4DAA4D;QAC5D,mBAAmB;QACnB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC7D,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,EAC7D,CAAC;YACD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,yDAAyD;YACzD,+DAA+D;YAC/D,iEAAiE;YACjE,+DAA+D;YAC/D,uCAAuC;YACvC,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,cAAc,GAAG,KAAK,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED,uGAAuG;AACvG,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAChB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;aACrB,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;aACrB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAA0B,EAAE,QAAkB;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,wCAAwC,CAAC,CAAC;QAC5E,qEAAqE;QACrE,mEAAmE;IACrE,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC9D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC;YACjD,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,kBAAkB,CAAC;QACvB,IAAI,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CACX,yBAAyB,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,yBAAyB,IAAI,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAeD,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAE,YAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClG,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAEnE,MAAM,UAAU,GAA2B;QACzC;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC/C,YAAY,EAAE,gBAAgB;gBAC5B,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC;SAC7C;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC;YAC7D,YAAY,EAAE,oBAAoB;SACnC;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/dist/cli/doctor/format.js

@@ -60,13 +60,30 @@ function formatEnvironmentSection(report) {
     const bin = report.npmGlobalBin;
     const modeEnv = report.understandingModeEnv;
     const ugAuto = report.ugAutoApprovals;
+    const autoApproveMode = report.ugAutoApproveMode;
+    const bypassWithoutAutoApprove = report.ugBypassWithoutAutoApprove;
     // "nothing when `.approvals/` is absent" (ug-auto-approvals.ts's AC 1):
     // stay silent unless the directory actually exists, mirroring the rest
     // of this section's "no line for a check that found nothing" style.
     const showUgAuto = ugAuto !== undefined && ugAuto.approvalsDirPresent;
+    const ugDeleg = report.ugDelegations;
+    // Same "no line for a check that found nothing" convention as
+    // showUgAuto: silent unless `.delegations/` actually exists. A
+    // present-but-empty directory still renders the zero-count line
+    // (ug-delegations.ts's own doc comment on `delegationsDirPresent`).
+    const showUgDeleg = ugDeleg !== undefined && ugDeleg.delegationsDirPresent;
     const drift = report.settingsDrift;
     const hasDriftContent = drift !== undefined && (drift.notes.length > 0 || drift.warnings.length > 0);
-    if ((!bin || bin.status !== "warn") && !modeEnv && !showUgAuto && !hasDriftContent)
+    const codexDrift = report.codexConfigDrift;
+    const hasCodexDriftContent = codexDrift !== undefined && codexDrift.warnings.length > 0;
+    if ((!bin || bin.status !== "warn") &&
+        !modeEnv &&
+        !autoApproveMode &&
+        !bypassWithoutAutoApprove &&
+        !showUgAuto &&
+        !showUgDeleg &&
+        !hasDriftContent &&
+        !hasCodexDriftContent)
         return [];
     const out = ["", "Environment"];
     if (bin && bin.status === "warn") {
@@ -77,6 +94,16 @@ function formatEnvironmentSection(report) {
         for (const line of modeEnv.detail)
             out.push(`      ${line}`);
     }
+    if (autoApproveMode) {
+        out.push(`  ⚠ ${autoApproveMode.message}`);
+        for (const line of autoApproveMode.detail)
+            out.push(`      ${line}`);
+    }
+    if (bypassWithoutAutoApprove) {
+        out.push(`  ⚠ ${bypassWithoutAutoApprove.message}`);
+        for (const line of bypassWithoutAutoApprove.detail)
+            out.push(`      ${line}`);
+    }
     if (showUgAuto && ugAuto) {
         const modeParts = Object.keys(ugAuto.byMode)
             .sort()
@@ -99,12 +126,23 @@ function formatEnvironmentSection(report) {
             out.push(`      ${ugAuto.unreadableCount} marker${ugAuto.unreadableCount === 1 ? "" : "s"} unreadable, excluded from the count`);
         }
     }
+    if (showUgDeleg && ugDeleg) {
+        const marker = ugDeleg.unreadable > 0 ? "⚠" : "ℹ";
+        const line = ugDeleg.total === 0
+            ? `  ${marker} delegations on disk: 0`
+            : `  ${marker} delegations on disk: ${ugDeleg.total} (${ugDeleg.expired} expired, ${ugDeleg.unreadable} unreadable)`;
+        out.push(line);
+    }
     if (drift) {
         for (const n of drift.notes)
             out.push(`  ℹ ${n}`);
         for (const w of drift.warnings)
             out.push(`  ⚠ ${w}`);
     }
+    if (codexDrift) {
+        for (const w of codexDrift.warnings)
+            out.push(`  ⚠ ${w}`);
+    }
     return out;
 }
 function formatToolsSection(report) {