Fix Codex limits collector approval policy

[purple-monkey-dishwasher]

Codex limits unavailable because collector uses removed untrusted approval policy

What happened

On Omarchy 4.0.0-1 with Codex CLI 0.149.0, the Agents toolbar panel shows Codex limits unavailable and a red initialize error even though codex login status reports Logged in using ChatGPT.

The panel still shows historical local usage, but the plan and rate-limit windows are absent.

Root cause

bin/omarchy-agent-usage-codex launches the app server with:

codex -s read-only -a untrusted app-server

Codex CLI 0.149.0 rejects untrusted:

error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]

Because stderr is discarded, the collector waits for the initialize RPC until it times out. It then exposes the exception method name as authHelpText, producing the misleading red initialize message.

Expected behavior

The collector should start the current Codex app server non-interactively and return the authenticated account's plan and rate-limit windows.

Proposed fix

Replace -a untrusted with -a never and add a regression assertion covering the exact app-server launch arguments.

With this change, the collector returned the authenticated plan and a populated 7-day limit window on the affected machine, with an empty usageStatusText.

Reproduction

1. Install Omarchy 4.0.0-1 and Codex CLI 0.149.0.
2. Authenticate using codex login.
3. Run omarchy agent usage-update --force codex.
4. Open the Agents toolbar panel.

Verification

• bash test/shell.d/agent-usage-codex-scanner-test.sh passes.
• git diff --check passes.
• Live authenticated collector probe returns the plan and limit window.
• The broader ./test/shell suite reaches the changed test successfully; four unrelated environment/checkout-dependent tests fail because the separate omarchy-pkgs checkout is unavailable (plus its dependent coverage checks).

[Copilot]

Pull request overview

Updates the Codex usage collector for current Codex CLI approval-policy support.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

• Replaces the removed untrusted policy with non-interactive never.
• Adds regression coverage for the exact app-server arguments.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
bin/omarchy-agent-usage-codex	Uses the supported Codex approval policy.
test/shell.d/agent-usage-codex-scanner-test.sh	Verifies collector launch arguments.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[s0up4200]

Dupe of #7649

[omarchybot]

#7649 is merged (4cd8a08) and makes this same fix: the collector now launches app-server with -a on-request instead of the retired untrusted, with the launch arguments asserted in the collector test.

Closing as superseded — the diagnosis in this PR was right, thank you.