fix: Codex sandbox compatibility and command line accuracy

[wesm]

Summary

• Inline snapshot diffs for sandboxed Codex: Codex --sandbox read-only blocks .git/ access, making large-diff snapshot files unreadable. The worker now reads the .git/ snapshot and inlines the diff content into the prompt sent via stdin. The DB keeps the truncated prompt; only the agent sees the full diff. Non-Codex agents continue using .git/ snapshots directly.
• disable_codex_sandbox config option: On systems where bwrap fails (missing unprivileged user namespace support), add a global config toggle that switches Codex from --sandbox read-only to --dangerously-bypass-approvals-and-sandbox. Hot-reloadable via config watcher.
• Store actual command line on jobs: The daemon worker now saves the real CommandLine() to the job record when starting each run. The TUI displays this stored value instead of reconstructing it client-side, which missed daemon-only config like disable_codex_sandbox.

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (2486ae7)

Verdict: Changes introduce one high-severity prompt-size regression and two medium-severity correctness/security issues that should be addressed before merge.

High

• internal/daemon/worker.go:507, internal/daemon/worker.go:1071

  Re-inlining the full snapshot content into the agent prompt bypasses the existing oversized-diff guard. That defeats the reason the snapshot file was created and can push Codex requests back over prompt/context limits, causing large reviews to fail or lose context.

  Suggested fix: preserve a hard size/token cap before inlining, or keep the file-reference flow for oversized diffs by making the snapshot available through a sandbox-readable path instead of always expanding it inline.

Medium

• internal/daemon/worker.go:1063, internal/daemon/worker.go:1075

  expandSnapshotInline only replaces the first roborev-snapshot-*.diff reference in the prompt. If a prompt contains multiple oversized-diff sections, later snapshot references remain unresolved, so sandboxed Codex can still review incomplete input.

  Suggested fix: replace all matching snapshot-reference blocks and add a test covering multiple snapshot references in one prompt.

• internal/daemon/worker.go:1069

  expandSnapshotInline recovers the snapshot path by regex-parsing the free-form reviewPrompt and passes the extracted backtick-quoted path directly to os.ReadFile. Because prompt content can include externally sourced repository text, a crafted prompt fragment could steer this toward a different local snapshot file than intended, creating an unintended local file-read primitive and potentially leaking local data into the model prompt.

  Suggested fix: carry the snapshot path as structured trusted state instead of extracting it from prompt text. If text parsing must remain, constrain extraction to the exact daemon-generated fallback block and verify the resolved path stays within the expected snapshot directory for the current job before reading it.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (f3d62af)

Summary verdict: One medium-severity correctness issue should be addressed before merge.

Medium

• internal/daemon/worker.go:1090: expandSnapshotInline finds the fallback block start with strings.Index(reviewPrompt, "(Diff too large") (or the alternate fallback text) from the beginning of the prompt. If that phrase appears earlier in repo-sourced text such as a PR description or commit message, the function can delete unrelated prompt content before the real snapshot reference. Anchor the replacement to the matched snapshot reference instead: locate the snapshot reference first, then use strings.LastIndex on the prefix before that reference to find the actual fallback block start. A regression test covering an earlier incidental (Diff too large...) string in the prompt would lock this down.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (9139c70)

Verdict: No Medium, High, or Critical issues found.

All review outputs were clean after deduplication.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)