Fix Codex invocation and add auto-approval wrapper modes

Author: Dremig

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+- Fixed default agent invocation to use valid Codex CLI arguments.
+- Added `scripts/invoke-codex-agent.sh` wrapper.
+- Added support for two execution modes:
+  - `-a never` default (no manual approvals)
+  - `--dangerously-bypass-approvals-and-sandbox` via `CODEX_SELF_ITER_AGENT_MODE=bypass`
+
 ## 0.1.0 - 2026-04-21
 
 - Initial public repository structure for `codex-self-iter`.

README.md

@@ -42,7 +42,7 @@ python3 -m codex_self_iter \
   --task-file TASK.md \
   --plan-file plan.md \
   --state-dir .codex-self-iter \
-  --agent-command-template "codex exec --auto --prompt-file {prompt_file}"
+  --agent-command-template "scripts/invoke-codex-agent.sh {prompt_file} {workspace}"
 ```
 
 Or use:
@@ -73,6 +73,24 @@ Important fields:
 - `max_iterations = 0` means unbounded loop
 - `max_stagnation` prevents infinite cycling on identical `next_focus`
 
+## Approval and Privilege Mode
+
+Default wrapper `scripts/invoke-codex-agent.sh` uses:
+
+- `codex -a never exec ...`  
+  This means the run does not ask for manual approval prompts.
+
+Optional bypass mode:
+
+```bash
+export CODEX_SELF_ITER_AGENT_MODE=bypass
+```
+
+In bypass mode, wrapper uses:
+
+- `codex --dangerously-bypass-approvals-and-sandbox exec ...`  
+  This disables approvals and sandboxing entirely. Use only in externally sandboxed environments.
+
 ## Development
 
 Run tests:

config.example.toml

@@ -1,6 +1,6 @@
 # Required:
 # Must include {prompt_file}; may include {workspace}.
-agent_command_template = "codex exec --auto --prompt-file {prompt_file}"
+agent_command_template = "scripts/invoke-codex-agent.sh {prompt_file} {workspace}"
 
 # 0 means unbounded loop until stop condition.
 max_iterations = 0

scripts/invoke-codex-agent.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "usage: $0 <prompt-file> <workspace>" >&2
+  exit 2
+fi
+
+prompt_file="$1"
+workspace="$2"
+
+# Default mode: auto-confirm approval requests while keeping sandboxing.
+if [[ "${CODEX_SELF_ITER_AGENT_MODE:-}" == "bypass" ]]; then
+  # Extremely dangerous: no approval prompts and no sandbox.
+  cat "$prompt_file" | codex --dangerously-bypass-approvals-and-sandbox exec -C "$workspace" -
+else
+  # No manual confirmation; command failures are returned directly to the model.
+  cat "$prompt_file" | codex -a never exec -C "$workspace" -
+fi

src/codex_self_iter/__main__.py

@@ -15,7 +15,7 @@ def main() -> int:
     parser.add_argument("--state-dir", default=".codex-self-iter", help="State/log directory")
     parser.add_argument(
         "--agent-command-template",
-        default="codex exec --auto --prompt-file {prompt_file}",
+        default="scripts/invoke-codex-agent.sh {prompt_file} {workspace}",
         help="Command template; supports {prompt_file} and {workspace}",
     )
     parser.add_argument("--config", default="", help="TOML config path (optional)")

src/codex_self_iter/runner.py

@@ -98,7 +98,7 @@ def run(
     task_file_name: str = "TASK.md",
     plan_file_name: str = "plan.md",
     state_dir_name: str = ".codex-self-iter",
-    agent_command_template: str = "codex exec --auto --prompt-file {prompt_file}",
+    agent_command_template: str = "scripts/invoke-codex-agent.sh {prompt_file} {workspace}",
     config_path: Path | None = None,
 ) -> int:
     task_file = workspace / task_file_name