fix(agent): guard codex reviewer pin from override

Author: rnegron

packages/agent/src/adapters/codex-app-server/spawn.test.ts

@@ -42,6 +42,20 @@ describe("buildAppServerArgs", () => {
     );
   });
 
+  it("lets a caller override the reviewer pin without emitting a shadowed duplicate", () => {
+    const args = buildAppServerArgs({
+      binaryPath: "/bundle/codex",
+      apiBaseUrl: "https://gateway.example/v1",
+      configOverrides: { approvals_reviewer: "auto_review" },
+    });
+
+    // codex's `-c` is last-wins, so the default pin must not be emitted alongside
+    // the caller's value — exactly one reviewer entry, and it's the caller's.
+    expect(args.filter((arg) => arg.startsWith("approvals_reviewer="))).toEqual(
+      ['approvals_reviewer="auto_review"'],
+    );
+  });
+
   it("forwards http headers as a quoted TOML inline table on the posthog provider", () => {
     const args = buildAppServerArgs({
       binaryPath: "/bundle/codex",

packages/agent/src/adapters/codex-app-server/spawn.ts

@@ -126,9 +126,13 @@ export function buildAppServerArgs(
   // The host owns approvals (surfaced via approvals.ts → requestPermission). Codex's
   // guardian reviewer is enabled by default and routes approvals to its dedicated
   // `codex-auto-review` model, which our gateway's posthog_code allowlist doesn't
-  // serve — so every command review 403s. Pin codex's own default `user` reviewer
-  // so approval decisions stay with the host.
-  args.push("-c", `approvals_reviewer="user"`);
+  // serve — so every command review 403s. Default codex's own `user` reviewer so
+  // approval decisions stay with the host. Skipped when a caller sets the reviewer
+  // via configOverrides (appended last, and codex's `-c` is last-wins) so we never
+  // emit a conflicting duplicate that could shadow the pin back to the auto reviewer.
+  if (options.configOverrides?.approvals_reviewer === undefined) {
+    args.push("-c", `approvals_reviewer="user"`);
+  }
 
   // Disable the user's ambient ~/.codex MCP servers so the adapter only exposes
   // MCP servers PostHog injects per-thread; otherwise codex fails connecting to them.