Agents panel: Codex tab shows "initialize" error — codex-cli 0.149.0 rejects the collector's --ask-for-approval value #7842

What happened

The Codex tab in the agents bar widget/panel shows a red error card with the literal text "initialize" instead of usage limits, and usageStatusText reads "Codex limits unavailable".

Root cause

/usr/share/omarchy/bin/omarchy-agent-usage-codex launches the Codex app-server with:

subprocess.Popen(
  [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
  ...
)

codex-cli 0.149.0 no longer accepts untrusted for --ask-for-approval:

$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]

The app-server process exits immediately (exit code 2) instead of starting the RPC loop. rpc_request() then blocks on a closed pipe until its select() loop times out and raises TimeoutError(method) — whose string representation is just the method name, "initialize". That exception message becomes authHelpText, which the panel renders verbatim, producing the confusing "initialize" card.

Fix

Swap "untrusted" for "never" (an equivalent "don't auto-approve" policy — this app-server session only ever issues the read-only account/read and account/rateLimits/read RPCs, so nothing here ever needs approval either way):

- [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
+ [codex, "-s", "read-only", "-a", "never", "app-server"],

Verified this resolves it — full RPC handshake against codex -s read-only -a never app-server returns real account/plan and rate-limit data:

init: {'result': {'userAgent': '.../0.149.0 ...', ...}}
account: {'result': {'account': {'type': 'chatgpt', 'planType': 'plus'}, ...}}
limits: {'result': {'rateLimits': {'primary': {'usedPercent': 3, 'windowDurationMins': 10080, ...}, 'planType': 'plus', ...}}}

Separately, it'd be worth having fetch_codex_rpc()'s except block use a friendlier message than str(exc) for a bare TimeoutError — a raw RPC method name leaking into the UI as the entire error text is confusing regardless of what breaks the app-server invocation next time.

Steps to reproduce

1. Have codex CLI >= 0.149.0 installed and logged in.
2. Open the agents panel (bar icon), switch to the Codex tab.
3. Observe the "initialize" error card instead of limits.

Or directly: codex -s read-only -a untrusted app-server — exits immediately with the CLI's invalid value error instead of starting the server.

System

• Omarchy 4.0.0-1
• codex-cli 0.149.0 (via mise)
• Arch Linux, kernel 7.1.8-arch1-3