sync: HP_BOWEI 2026-09-09

langgraph-plan-review/scripts/review_task.py

@@ -121,13 +121,35 @@ def main() -> int:
     os.close(fd)
     last_message_path = Path(last_message_name)
     try:
-        # read-only sandbox: review needs no writes, and on Windows the
-        # config.toml "elevated" sandbox hangs every shell command when codex
-        # runs outside the ChatGPT app (probed 2026-08-26). Use -c because
-        # "codex exec resume" does not accept the --sandbox flag.
+        # Sandbox mode: default "read-only" -- review needs no writes, and on
+        # Windows the config.toml "elevated" sandbox hangs every shell command
+        # when codex runs outside the ChatGPT app (probed 2026-08-26).
+        # Pass it with -c, NOT -s: `codex exec` accepts -s but `codex exec
+        # resume` does not, and the second and later review passes go through
+        # resume -- an -s here fails with a bare
+        #     For more information, try '--help'
+        # two seconds in, on exactly the passes that matter.
         # (unquoted value: fails TOML parse -> codex falls back to the raw
         # string, which survives cmd /c quoting untouched)
-        flags = ["--json", "--skip-git-repo-check", "-c", "sandbox_mode=read-only",
+        #
+        # Overridable via CODEX_SANDBOX because codex's Windows sandbox cannot
+        # start on every machine.  Observed with codex-cli 0.147.0:
+        #
+        #   execution error: Io(Custom { kind: Other, error: "windows sandbox:
+        #   orchestrator_helper_launch_canceled: ShellExecuteExW failed to
+        #   launch setup helper: 1223" })
+        #
+        # 1223 is ERROR_CANCELLED -- the helper's UAC elevation prompt was
+        # declined.  The sandbox then never comes up, every shell command the
+        # reviewer issues fails, and codex answers "Unable to read file."
+        #
+        # THAT FAILURE IS INDISTINGUISHABLE FROM A CLEAN REVIEW unless someone
+        # reads the discuss file: the workflow still completes, still writes a
+        # discuss file, and the text inside is a polite sentence rather than an
+        # error.  Same class as the known "instant NO_SERIOUS_ISSUE" trap.
+        # On such a machine set CODEX_SANDBOX=danger-full-access.
+        sandbox = os.environ.get("CODEX_SANDBOX", "").strip() or "read-only"
+        flags = ["--json", "--skip-git-repo-check", "-c", "sandbox_mode=" + sandbox,
                  "--output-last-message", str(last_message_path)]
         if codex_session_id:
             command_args = ["cmd", "/c", codex, "exec", "resume"] + flags + [codex_session_id, "-"]