[tahadx]

Closes #7873.

What

The Codex collector spawned the app-server with -a untrusted, and Codex CLI 0.149.0 removed that value from --ask-for-approval:

error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]

The process exited on argument parsing before ever answering initialize, so every subscription-limit meter read "Codex Limits Unavailable / initialize".

Fix

Spawn with -a never instead. Two reasons for that specific value over dropping the flag or using on-request:

1. Valid across versions — both old CLIs (where all four policies existed) and 0.149+ accept it.
2. Cannot stall a detached poller — this collector runs detached with no UI; an approval policy that can prompt is one that can hang the poll forever. Combined with the existing -s read-only sandbox, never is the only policy that can never block.

Verification

• Reproduced the argparse failure locally on codex 0.149.0, then confirmed -a never app-server answers the initialize RPC (both never and on-request do).
• The collector now completes its RPC handshake against real codex 0.149.0 (usageStatusText empty instead of "limits unavailable"); limit meters populate wherever the CLI is authenticated.
• agent-usage-codex-scanner-test.sh extended: the stubbed codex logs its spawn args, and the test asserts -a never is present and untrusted never returns.

[Copilot]

Pull request overview

Fixes Codex limit collection with Codex CLI 0.149.0 by using a supported, non-interactive approval policy.

Changes:

• Replaces -a untrusted with -a never.
• Adds regression coverage for the spawned arguments.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
bin/omarchy-agent-usage-codex	Uses the compatible, prompt-free Codex approval policy.
test/shell.d/agent-usage-codex-scanner-test.sh	Verifies -a never is used and untrusted is absent.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tahadx]

Reviewer disclosure: this review was written by an AI coding assistant (ox-alpha) at the contributor's request, and posted with their approval. Please weigh it alongside human review.

What I checked

Swapping -a untrusted for -a never is the right call, and the reasoning in the comment earns its place in the source: the value is accepted by both pre-0.149 and current CLIs, and a detached poller with no UI must never run under a policy that can prompt — combined with the existing -s read-only sandbox, never is the only choice that cannot wedge the collector waiting for an approval that can never arrive.

Observations

• Test directionality is good: the spawn-arg log asserts both that never is present and that untrusted never returns, so a future regression in either direction trips the suite. Logging the stub's argv rather than mocking the RPC layer keeps the assertion honest against argparse changes.
• One observation, not for this PR: stderr=subprocess.DEVNULL on the Popen is why an argparse failure like this one stayed invisible until users hit "Codex Limits Unavailable". If you ever want faster diagnosis of similar breakage, teeing collector stderr to a debug file would surface it immediately. Out of scope here.

Focused fix, correct value chosen for principled reasons, verified against the real CLI version that broke. LGTM as far as I can tell.

[Milofax]

Independently confirmed this fix on Omarchy 4.0.0-1 with codex-cli 0.149.0.

Before the change, codex -s read-only -a untrusted app-server exits immediately because untrusted is no longer accepted, and the Agents panel displays Codex limits unavailable / initialize while local token statistics continue to work.

I tested the collector with the proposed prompt-free -a never policy against a live ChatGPT-authenticated Codex installation. The RPC handshake completed and returned:

• tierLabel: "pro"
• a populated 7-day limit window
• an empty usageStatusText

I also verified the result in the running Omarchy panel: the Codex tab showed the Pro plan and weekly limit meter, with the red initialize card gone. This matches the intended behavior of this PR.

[tahadx]

Thanks for independently verifying this

…

On Tue, Aug 25, 2026 at 1:17 AM Milofax ***@***.***> wrote: *Milofax* left a comment (omacom/omarchy#7908) <#7908 (comment)> Independently confirmed this fix on Omarchy 4.0.0-1 with codex-cli 0.149.0. Before the change, codex -s read-only -a untrusted app-server exits immediately because untrusted is no longer accepted, and the Agents panel displays Codex limits unavailable / initialize while local token statistics continue to work. I tested the collector with the proposed prompt-free -a never policy against a live ChatGPT-authenticated Codex installation. The RPC handshake completed and returned: - tierLabel: "pro" - a populated 7-day limit window - an empty usageStatusText I also verified the result in the running Omarchy panel: the Codex tab showed the Pro plan and weekly limit meter, with the red initialize card gone. This matches the intended behavior of this PR. — Reply to this email directly, view it on GitHub <#7908>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BEMTEDZQBF7OP7NYEHQ6IAT5LSZVPAVCNFSNUABFKJSXA33TNF2G64TZHM4TSNBQHEZTCNRWHNEXG43VMU5TKMRSG42TOMJVGU4KC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BEMTEDZCLILY2S5Z2M5D2O35LSZVPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNBQGE3TSNJRGM3KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BEMTEDYBVVDZ67TQUIQ7QST5LSZVPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNBQGE3TSNJRGM3KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[omarchybot]

#7649 is merged (4cd8a08) and makes this same fix: the collector now launches app-server with -a on-request instead of the retired untrusted, with the launch arguments asserted in the collector test.

Closing as superseded. #7873, which this closed, is closed too. The argument for never over on-request was a fair one — on-request won because nothing in the collector's read-only RPC path can raise an approval request, so it can't stall either.