Enhancement: support turn/start sandboxPolicy for task-like commands in externally sandboxed environments

Summary

In devcontainers and other externally sandboxed Linux environments, the plugin's task-like app-server path appears to rely on thread-level sandbox shorthands only.

runAppServerTurn() starts or resumes a thread with sandbox, but the subsequent turn/start request does not send sandboxPolicy. As a result, the plugin currently has no documented plugin-side path to use app-server's turn-level sandbox override surface for task-like flows.

This issue proposes a scoped plugin change: support forwarding sandboxPolicy on turn/start for task-like commands first, rather than treating this as a general native-review or Linux-sandbox fix.

Why this belongs in this repository

I understand that codex-plugin-cc is a thin client over the local Codex CLI / app-server, so some container sandbox failures are upstream.

However, the request-shaping logic for plugin commands lives here. A plugin-side change can decide when task-like commands should pass an explicit turn/start.sandboxPolicy instead of relying only on thread/start / thread/resume shorthand sandbox values.

Current behavior

• Native /codex:review uses a separate review path.
• /codex:adversarial-review goes through runAppServerTurn(..., sandbox: "read-only").
• task / rescue flows go through runAppServerTurn(..., sandbox: request.write ? "workspace-write" : "read-only").
• runAppServerTurn() then calls turn/start without sandboxPolicy.

From a plugin-client perspective, task-like flows are therefore limited to thread-level shorthand sandbox selection and cannot use the documented turn-level override surface.

Expected behavior

For task-like flows, the plugin should be able to express sandbox policy at the turn level, not only via thread shorthand.

In environments that are already isolated externally (for example, devcontainers), the plugin should have a path to send the documented app-server sandboxPolicy override instead of forcing Codex's built-in sandbox to be the only control surface.

Proposed change

1. Separate thread-level shorthand sandbox selection from turn-level sandbox policy selection in the plugin control plane.

2. Allow runAppServerTurn() callers to pass an explicit sandboxPolicy into turn/start.

3. Use that path for task-like flows first:

   • /codex:adversarial-review
   • /codex:rescue
   • task / resume flows

4. Preserve current behavior when no sandboxPolicy is provided.

Illustrative shape:

client.request("turn/start", {
  threadId,
  input: buildTurnInput(prompt),
  model: options.model ?? null,
  effort: options.effort ?? null,
  outputSchema: options.outputSchema ?? null,
  ...(options.sandboxPolicy ? { sandboxPolicy: options.sandboxPolicy } : {})
});

Out of scope

• Fixing Codex Linux sandbox failures inside containers
• Assuming .codex/config.toml or CLI should accept an external sandbox mode
• Claiming native /codex:review is fixed by this change
• Broker protocol/version compatibility hardening (could be a separate issue)

Why native /codex:review is intentionally excluded

Native review uses runAppServerReview() and review/start, which is a different control surface from task-like turn/start.

Because review-mode behavior also appears to have upstream sandbox-override inheritance issues, I think it is safer to keep this issue focused on task-like flows where the plugin clearly owns the turn/start payload shape.

Environment

• Host OS: Amazon Linux 2023
• Container runtime: Docker (devcontainer on EC2)
• Codex CLI version: 0.117.0 (@openai/codex)
• codex-plugin-cc version: 1.0.1
• Claude Code version: 2.1.89

Related context

Plugin repo:

• #18
• #3
• #62

Upstream context:

• openai/codex#14068
• openai/codex#15310
• openai/codex#15305
• openai/codex#8450
• openai/codex#15769

Trace runAppServerTurn() and its task, rescue, resume, and adversarial-review callers; inspect the turn/start payload and existing thread/start or thread/resume sandbox handling. Confirm the app-server contract for sandboxPolicy, then add forwarding only when provided while preserving current behavior otherwise. Validate that the listed task-like flows send the field and native review remains out of scope.