[VS Code extension] chatgpt.implementTodo bypasses configured approval reviewer

Description

chatgpt.implementTodo sessions started by the VS Code IDE extension do not inherit configured approval reviewer settings. Normal sessions in the same workspace correctly use approvals_reviewer = "auto_review", but sessions created through chatgpt.implementTodo default to manual user approval.

This affects extension-driven handoff workflows that call:

{
  "fileName": "/path/to/prompt.md",
  "cwd": "/path/to/workspace",
  "line": 1,
  "comment": "..."
}

Environment

• Component: Codex IDE extension for VS Code
• Extension id: openai.chatgpt
• Extension version observed locally: 26.5901.22334
• Platform: macOS arm64
• Codex CLI/app-server reported in rollout: 0.153.0
• Workspace config contains approval_policy = "on-request" and approvals_reviewer = "auto_review"

Reproduction

1. Configure Codex so the current project or ~/.codex/config.toml uses:

   approval_policy = "on-request"
   approvals_reviewer = "auto_review"
   

2. Reload VS Code.

3. Start a normal Codex IDE extension session in the workspace.

4. Confirm the extension log resolves:

   useAppServerPermissionDefault=true
   resolvedApprovalPolicy=on-request
   resolvedApprovalsReviewer=auto_review
   

5. Start a session through the extension command chatgpt.implementTodo, passing only fileName, cwd, line, and comment.

6. Inspect the rollout turn_context or extension log for the new session.

Actual behavior

Before a local patch, fresh chatgpt.implementTodo sessions wrote:

thread_source=implement_todo
approval_policy=on-request
approvals_reviewer=user

That means the same workspace setting that works for normal sessions is bypassed for handoff-created sessions.

Expected behavior

chatgpt.implementTodo should inherit the same effective permission defaults as a normal new Codex IDE session unless the caller explicitly supplies permission overrides.

For the config above, a fresh chatgpt.implementTodo session should write:

thread_source=implement_todo
approval_policy=on-request
approvals_reviewer=auto_review

Local root-cause evidence

In the shipped extension bundle, the implementTodo path constructs a conversation with an explicit permissions profile object. That profile defaults the reviewer to user. A nearby explicit approvalsReviewer value does not fix the issue because the later start path consumes the permissions config, not that separate top-level field.

Changing the implementTodo conversation start options to use the app-server permission defaults, matching normal new session behavior, fixed the issue locally.

After patching and reloading the same VS Code window, a fresh handoff-produced rollout wrote:

thread_source=implement_todo
approval_policy='on-request'
approvals_reviewer='auto_review'
sandbox_policy={'type': 'workspace-write', 'network_access': False, ...}

The extension log for the same fresh session wrote:

requestApprovalPolicy=null
requestApprovalsReviewer=null
requestPermissionProfile=null
resolvedApprovalPolicy=on-request
resolvedApprovalsReviewer=auto_review
useAppServerPermissionDefault=true

Suggested fix

Make chatgpt.implementTodo inherit configured app-server permission defaults when the command caller does not provide explicit permission settings. In implementation terms, this appears to mean using the same default-permission path as normal new sessions instead of constructing an explicit default workspace permissions config for implementTodo.

Related but not duplicate

This is related to #33084 because both are VS Code extension permission-default issues involving approvals_reviewer, but #33084 is about manually selecting a named custom permission profile. This bug is specifically about chatgpt.implementTodo session startup bypassing otherwise-working project/user config.

Start at the VS Code extension's chatgpt.implementTodo command and compare its conversation-start options with the normal new-session path, focusing on how app-server permission defaults are selected. Reproduce with approval_policy = "on-request" and approvals_reviewer = "auto_review", then inspect the extension log or rollout turn_context; done when implementTodo reports and records auto_review without explicit overrides.