@parall/codex-agent 1.18.1 → 1.18.3

package/dist/config.d.ts

@@ -10,20 +10,42 @@ export type CodexAgentConfig = {
     workspaceDir: string;
     model?: string;
     reasoningEffort?: string;
-    sandbox: string;
+    /**
+     * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
+     * When undefined, the bridge deliberately does NOT pass `sandbox` on
+     * `thread/{start,resume}` so codex reads whatever the user configured
+     * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
+     * hosted philosophy: user's codex setup is authoritative; bridge only
+     * overrides when the user asks it to.
+     */
+    sandbox?: string;
+    /**
+     * Approval policy is forced to `"never"` by default (not configurable
+     * via config.toml override): Parall's HITL contract routes approvals
+     * through the app, not codex's own stdin-prompt mechanism, which the
+     * long-running app-server subprocess has no way to answer.
+     */
     approvalPolicy: string;
     runtimeKey?: string;
 };
 export declare function resolveCodexAgentConfig(env?: NodeJS.ProcessEnv): CodexAgentConfig;
 /**
- * Normalise a sandbox value (CLI docs use kebab-case like `workspace-write`,
- * but the app-server JSON-RPC protocol uses camelCase like `workspaceWrite`).
- * Accept both forms and emit the canonical protocol form.
+ * Normalise a sandbox value to the kebab-case form the app-server JSON-RPC
+ * enum expects (`read-only` / `workspace-write` / `danger-full-access`).
+ * The CLI-facing PRLL_CODEX_SANDBOX env var may come in as either kebab-case
+ * or camelCase (from docs that cite the Rust field names); accept both.
+ *
+ * Empirically verified: the app-server rejects `workspaceWrite` with
+ *   "unknown variant workspaceWrite, expected one of read-only,
+ *    workspace-write, danger-full-access"
+ * which is the Rust enum's serde kebab-case form.
  */
 export declare function normalizeSandbox(value: string): string;
 /**
- * Normalise an approval policy string to the camelCase form the app-server
- * JSON-RPC protocol uses (`never` / `onRequest` / `unlessTrusted`).
+ * Normalise an approval policy string to the kebab-case form the app-server
+ * JSON-RPC enum expects (`never` / `on-request` / `on-failure` /
+ * `unless-trusted`). Mirrors the sandbox enum — serde rename_all kebab-case
+ * applies across app-server protocol enums.
  */
 export declare function normalizeApprovalPolicy(value: string): string;
 export declare function resolveWsUrl(apiUrl: string, explicitWsUrl?: string, swimlaneName?: string): string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA6B9F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}

package/dist/config.js

@@ -14,11 +14,20 @@ export function resolveCodexAgentConfig(env = process.env) {
     const apiUrl = requireEnv(env, "PRLL_API_URL");
     const apiKey = requireEnv(env, "PRLL_API_KEY");
     const orgId = requireEnv(env, "PRLL_ORG_ID");
+    // CODEX_HOME is where codex looks for `auth.json` / `config.toml`. Its
+    // own default is `$HOME/.codex`; falling back to `$HOME` here was wrong
+    // — it made the spawned app-server subprocess look for
+    // `$HOME/auth.json`, which silently doesn't exist, so every
+    // `thread/start` failed with `401 Unauthorized` against the OpenAI
+    // WebSocket endpoint. Default to `$HOME/.codex` so `codex login`'s
+    // credentials are picked up transparently.
     const codexHome = resolvePath(env.PRLL_CODEX_HOME?.trim()
         || env.CODEX_HOME?.trim()
-        || env.HOME
-        || os.homedir());
-    const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim() || path.join(codexHome, ".parall-agent"));
+        || path.join(env.HOME || os.homedir(), ".codex"));
+    // Bridge state lives outside CODEX_HOME to avoid polluting codex's own
+    // directory with non-codex files.
+    const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim()
+        || path.join(env.HOME || os.homedir(), ".parall-agent"));
     const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
     return {
         apiUrl,
@@ -32,40 +41,48 @@ export function resolveCodexAgentConfig(env = process.env) {
         workspaceDir,
         model: env.PRLL_CODEX_MODEL?.trim() || undefined,
         reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "workspace-write",
+        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
         approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
         runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
     };
 }
 /**
- * Normalise a sandbox value (CLI docs use kebab-case like `workspace-write`,
- * but the app-server JSON-RPC protocol uses camelCase like `workspaceWrite`).
- * Accept both forms and emit the canonical protocol form.
+ * Normalise a sandbox value to the kebab-case form the app-server JSON-RPC
+ * enum expects (`read-only` / `workspace-write` / `danger-full-access`).
+ * The CLI-facing PRLL_CODEX_SANDBOX env var may come in as either kebab-case
+ * or camelCase (from docs that cite the Rust field names); accept both.
+ *
+ * Empirically verified: the app-server rejects `workspaceWrite` with
+ *   "unknown variant workspaceWrite, expected one of read-only,
+ *    workspace-write, danger-full-access"
+ * which is the Rust enum's serde kebab-case form.
  */
 export function normalizeSandbox(value) {
     const map = {
-        "workspace-write": "workspaceWrite",
-        "workspacewrite": "workspaceWrite",
-        "danger-full-access": "dangerFullAccess",
-        "dangerfullaccess": "dangerFullAccess",
-        "read-only": "readOnly",
-        "readonly": "readOnly",
+        "workspace-write": "workspace-write",
+        "workspacewrite": "workspace-write",
+        "danger-full-access": "danger-full-access",
+        "dangerfullaccess": "danger-full-access",
+        "read-only": "read-only",
+        "readonly": "read-only",
     };
     return map[value.toLowerCase()] ?? value;
 }
 /**
- * Normalise an approval policy string to the camelCase form the app-server
- * JSON-RPC protocol uses (`never` / `onRequest` / `unlessTrusted`).
+ * Normalise an approval policy string to the kebab-case form the app-server
+ * JSON-RPC enum expects (`never` / `on-request` / `on-failure` /
+ * `unless-trusted`). Mirrors the sandbox enum — serde rename_all kebab-case
+ * applies across app-server protocol enums.
  */
 export function normalizeApprovalPolicy(value) {
     const map = {
         "never": "never",
-        "on-request": "onRequest",
-        "onrequest": "onRequest",
-        "unless-trusted": "unlessTrusted",
-        "unlesstrusted": "unlessTrusted",
-        "on-failure": "onFailure",
-        "onfailure": "onFailure",
+        "on-request": "on-request",
+        "onrequest": "on-request",
+        "unless-trusted": "unless-trusted",
+        "unlesstrusted": "unless-trusted",
+        "on-failure": "on-failure",
+        "onfailure": "on-failure",
     };
     return map[value.toLowerCase()] ?? value;
 }

package/dist/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAExD,QAAQ,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IA0J3F,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA2DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAuCxB,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAExD,QAAQ,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IA0J3F,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA2DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAgDxB,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/dispatch.js

@@ -353,13 +353,22 @@ export class CodexAppServerAdapter {
         // model, reasoningEffort). Passing them on resume lets the user change
         // PRLL_CODEX_* env vars and have the bridge pick them up on the next
         // restart instead of being stuck on the values baked into the persisted
-        // thread. Sandbox / approval values are normalised to the camelCase enum
-        // the protocol expects (`workspaceWrite`, `onRequest`, etc.), so users
-        // can supply either CLI-style or protocol-style env values.
+        // thread. Sandbox / approval values are normalised to the kebab-case
+        // enum form the protocol expects (`workspace-write`, `on-request`, etc.
+        // — serde rename_all kebab-case on the Rust enum); users can supply
+        // either kebab or camel and we always emit kebab.
         const commonParams = {
             approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
-            sandbox: normalizeSandbox(this.opts.sandbox),
         };
+        // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
+        // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
+        // user's own configuration is authoritative for a self-hosted bridge,
+        // and codex 0.120.0's workspace-write mode has a write_stdin bug that
+        // our previous `workspace-write` default tripped for users whose config
+        // had danger-full-access.
+        if (this.opts.sandbox) {
+            commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
+        }
         if (this.opts.model)
             commonParams.model = this.opts.model;
         if (this.opts.reasoningEffort) {

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import * as os from "node:os";
-import { ParallAgentGateway } from "@parall/agent-core";
+import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ParallClient, ParallWs } from "@parall/sdk";
 import { buildCodexRuntimeKey, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
 import { CodexAppServerAdapter } from "./dispatch.js";
@@ -65,6 +65,7 @@ async function main() {
         },
         dispatchAdapter: adapter,
         log,
+        shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
         stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
     });
     const abortController = new AbortController();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/codex-agent",
-  "version": "1.18.1",
+  "version": "1.18.3",
   "description": "Codex CLI bridge runtime for self-hosted Parall agents",
   "license": "MIT",
   "repository": {

package/src/config.ts

@@ -13,7 +13,21 @@ export type CodexAgentConfig = {
   workspaceDir: string;
   model?: string;
   reasoningEffort?: string;
-  sandbox: string;
+  /**
+   * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
+   * When undefined, the bridge deliberately does NOT pass `sandbox` on
+   * `thread/{start,resume}` so codex reads whatever the user configured
+   * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
+   * hosted philosophy: user's codex setup is authoritative; bridge only
+   * overrides when the user asks it to.
+   */
+  sandbox?: string;
+  /**
+   * Approval policy is forced to `"never"` by default (not configurable
+   * via config.toml override): Parall's HITL contract routes approvals
+   * through the app, not codex's own stdin-prompt mechanism, which the
+   * long-running app-server subprocess has no way to answer.
+   */
   approvalPolicy: string;
   runtimeKey?: string;
 };
@@ -34,13 +48,24 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
   const apiUrl = requireEnv(env, "PRLL_API_URL");
   const apiKey = requireEnv(env, "PRLL_API_KEY");
   const orgId = requireEnv(env, "PRLL_ORG_ID");
+  // CODEX_HOME is where codex looks for `auth.json` / `config.toml`. Its
+  // own default is `$HOME/.codex`; falling back to `$HOME` here was wrong
+  // — it made the spawned app-server subprocess look for
+  // `$HOME/auth.json`, which silently doesn't exist, so every
+  // `thread/start` failed with `401 Unauthorized` against the OpenAI
+  // WebSocket endpoint. Default to `$HOME/.codex` so `codex login`'s
+  // credentials are picked up transparently.
   const codexHome = resolvePath(
     env.PRLL_CODEX_HOME?.trim()
       || env.CODEX_HOME?.trim()
-      || env.HOME
-      || os.homedir(),
+      || path.join(env.HOME || os.homedir(), ".codex"),
+  );
+  // Bridge state lives outside CODEX_HOME to avoid polluting codex's own
+  // directory with non-codex files.
+  const stateDir = resolvePath(
+    env.PRLL_CODEX_STATE_DIR?.trim()
+      || path.join(env.HOME || os.homedir(), ".parall-agent"),
   );
-  const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim() || path.join(codexHome, ".parall-agent"));
   const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
 
   return {
@@ -55,42 +80,50 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
     workspaceDir,
     model: env.PRLL_CODEX_MODEL?.trim() || undefined,
     reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "workspace-write",
+    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
     approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
     runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
   };
 }
 
 /**
- * Normalise a sandbox value (CLI docs use kebab-case like `workspace-write`,
- * but the app-server JSON-RPC protocol uses camelCase like `workspaceWrite`).
- * Accept both forms and emit the canonical protocol form.
+ * Normalise a sandbox value to the kebab-case form the app-server JSON-RPC
+ * enum expects (`read-only` / `workspace-write` / `danger-full-access`).
+ * The CLI-facing PRLL_CODEX_SANDBOX env var may come in as either kebab-case
+ * or camelCase (from docs that cite the Rust field names); accept both.
+ *
+ * Empirically verified: the app-server rejects `workspaceWrite` with
+ *   "unknown variant workspaceWrite, expected one of read-only,
+ *    workspace-write, danger-full-access"
+ * which is the Rust enum's serde kebab-case form.
  */
 export function normalizeSandbox(value: string): string {
   const map: Record<string, string> = {
-    "workspace-write": "workspaceWrite",
-    "workspacewrite": "workspaceWrite",
-    "danger-full-access": "dangerFullAccess",
-    "dangerfullaccess": "dangerFullAccess",
-    "read-only": "readOnly",
-    "readonly": "readOnly",
+    "workspace-write": "workspace-write",
+    "workspacewrite": "workspace-write",
+    "danger-full-access": "danger-full-access",
+    "dangerfullaccess": "danger-full-access",
+    "read-only": "read-only",
+    "readonly": "read-only",
   };
   return map[value.toLowerCase()] ?? value;
 }
 
 /**
- * Normalise an approval policy string to the camelCase form the app-server
- * JSON-RPC protocol uses (`never` / `onRequest` / `unlessTrusted`).
+ * Normalise an approval policy string to the kebab-case form the app-server
+ * JSON-RPC enum expects (`never` / `on-request` / `on-failure` /
+ * `unless-trusted`). Mirrors the sandbox enum — serde rename_all kebab-case
+ * applies across app-server protocol enums.
  */
 export function normalizeApprovalPolicy(value: string): string {
   const map: Record<string, string> = {
     "never": "never",
-    "on-request": "onRequest",
-    "onrequest": "onRequest",
-    "unless-trusted": "unlessTrusted",
-    "unlesstrusted": "unlessTrusted",
-    "on-failure": "onFailure",
-    "onfailure": "onFailure",
+    "on-request": "on-request",
+    "onrequest": "on-request",
+    "unless-trusted": "unless-trusted",
+    "unlesstrusted": "unless-trusted",
+    "on-failure": "on-failure",
+    "onfailure": "on-failure",
   };
   return map[value.toLowerCase()] ?? value;
 }

package/src/dispatch.ts

@@ -396,13 +396,22 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     // model, reasoningEffort). Passing them on resume lets the user change
     // PRLL_CODEX_* env vars and have the bridge pick them up on the next
     // restart instead of being stuck on the values baked into the persisted
-    // thread. Sandbox / approval values are normalised to the camelCase enum
-    // the protocol expects (`workspaceWrite`, `onRequest`, etc.), so users
-    // can supply either CLI-style or protocol-style env values.
+    // thread. Sandbox / approval values are normalised to the kebab-case
+    // enum form the protocol expects (`workspace-write`, `on-request`, etc.
+    // — serde rename_all kebab-case on the Rust enum); users can supply
+    // either kebab or camel and we always emit kebab.
     const commonParams: Record<string, unknown> = {
       approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
-      sandbox: normalizeSandbox(this.opts.sandbox),
     };
+    // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
+    // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
+    // user's own configuration is authoritative for a self-hosted bridge,
+    // and codex 0.120.0's workspace-write mode has a write_stdin bug that
+    // our previous `workspace-write` default tripped for users whose config
+    // had danger-full-access.
+    if (this.opts.sandbox) {
+      commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
+    }
     if (this.opts.model) commonParams.model = this.opts.model;
     if (this.opts.reasoningEffort) {
       // The app-server JSON-RPC surface uses camelCase for overrides —

package/src/index.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import * as os from "node:os";
-import { ParallAgentGateway } from "@parall/agent-core";
+import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ParallClient, ParallWs } from "@parall/sdk";
 import {
   buildCodexRuntimeKey,
@@ -83,6 +83,7 @@ async function main() {
     },
     dispatchAdapter: adapter,
     log,
+    shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
     stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
   });