fix(config): harden doctor checks and enable Codex full access

scripts/tests/test-command-summaries.ps1

@@ -2,6 +2,18 @@
 param([switch]$Summary)
 $ErrorActionPreference = 'Stop'
 $root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+$doctorPath = Join-Path $root 'scripts/commands/doctor.ps1'
+$doctorAst = [System.Management.Automation.Language.Parser]::ParseFile($doctorPath, [ref]$null, [ref]$null)
+$probe = $doctorAst.Find({ param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Invoke-DoctorCommand' }, $true)
+if (-not $probe) { throw 'Doctor command probe is missing.' }
+Invoke-Expression $probe.Extent.Text
+foreach ($code in @(0, 7)) {
+    $result = Invoke-DoctorCommand -Command 'python' -Arguments @('-c', "import sys; print('fixture 1.0'); print('fixture warning', file=sys.stderr); sys.exit($code)")
+    if ($result.ExitCode -ne $code -or ($result.Output -join ' ') -notmatch 'fixture warning' -or ($result.Output -join ' ') -notmatch 'fixture 1.0') { throw 'Doctor must capture native warnings and preserve the exit code.' }
+    if ($ErrorActionPreference -ne 'Stop') { throw 'Doctor command probe changed the caller error preference.' }
+}
+$missing = Invoke-DoctorCommand -Command 'ai-config-missing-doctor-test-command'
+if ($missing.ExitCode -eq 0) { throw 'Doctor must not report a missing command as successful.' }
 $doctorSummaryOutput = & (Join-Path $root 'scripts/commands/doctor.ps1') -Summary
 if (@($doctorSummaryOutput | Where-Object { $_ -match '^PASS ' }).Count -ne 0) { throw 'Doctor summary mode must not print individual PASS lines.' }
 if (@($doctorSummaryOutput | Where-Object { $_ -match '^Doctor: PASS \| \d+ checks$' }).Count -ne 1) { throw "Doctor summary mode must print one 'Doctor: PASS | N checks' line: $($doctorSummaryOutput -join '; ')" }

scripts/tests/test-command-summaries.sh

@@ -8,6 +8,22 @@ while [ $# -gt 0 ]; do
   esac
 done
 root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
+(
+  codex() { printf 'fixture warning\n' >&2; printf 'fixture 1.0\n'; return "$DOCTOR_TEST_CODE"; }
+  export -f codex
+  for DOCTOR_TEST_CODE in 0 7; do
+    export DOCTOR_TEST_CODE
+    if probe_output=$(bash "$root/scripts/commands/doctor.sh" --summary); then probe_status=0; else probe_status=$?; fi
+    if [ "$DOCTOR_TEST_CODE" -eq 0 ]; then
+      test "$probe_status" -eq 0
+      printf '%s\n' "$probe_output" | grep -Eq '^Doctor: PASS \| [0-9]+ checks$'
+    else
+      test "$probe_status" -eq 1
+      printf '%s\n' "$probe_output" | grep -Fq 'FAIL codex --version failed (exit 7): fixture warning'
+      printf '%s\n' "$probe_output" | grep -Eq '^Doctor: FAIL \| [0-9]+ checks$'
+    fi
+  done
+)
 doctor_summary_output=$(bash "$root/scripts/commands/doctor.sh" --summary)
 if printf '%s\n' "$doctor_summary_output" | grep -q '^PASS '; then
   printf 'Doctor summary mode must not print individual PASS lines.\n' >&2

scripts/tests/test-install-options.py

@@ -18,6 +18,21 @@ SPEC.loader.exec_module(OPTIONS)
 
 
 class InstallOptionsTests(unittest.TestCase):
+    def test_codex_update_replaces_old_sandbox_mode_and_preserves_user_settings(self):
+        current = ('sandbox_mode = "workspace-write"\nmodel = "custom-model"\n'
+                   '[windows]\nsandbox = "elevated"\n'
+                   '[sandbox_workspace_write]\nnetwork_access = false\n'
+                   '[mcp_servers.demo]\ncommand = "demo"\n')
+        managed = (ROOT / 'adapters/codex/config/config.toml').read_text(encoding='utf-8')
+
+        result = tomllib.loads(OPTIONS.merge_toml(current, managed))
+
+        self.assertEqual(result['sandbox_mode'], 'danger-full-access')
+        self.assertEqual(result['approval_policy'], 'on-request')
+        self.assertEqual(result['approvals_reviewer'], 'auto_review')
+        self.assertEqual(result['model'], 'custom-model')
+        self.assertEqual(result['mcp_servers']['demo'], {'command': 'demo'})
+
     def test_merge_toml_preserves_local_plugin_table_indentation(self):
         plugin_state = ('  [marketplaces.ponytail]\n'
                         '    source_type = "git"\n'

scripts/tests/test-shell-packages.ps1

@@ -63,6 +63,7 @@ foreach ($shell in @('powershell','bash')) {
             $events = @([regex]::Matches($content, '(?m)^\[\[hooks\.([^.\]]+)\]\]\s*$') | ForEach-Object { $_.Groups[1].Value })
             if ((($events | Sort-Object) -join ',') -ne 'SessionStart,Stop' -or $content -match 'flashbang-if-input' -or $content -match '(?m)^async\s*=\s*true\s*$') { throw "Codex finish hook is incorrect in $package" }
             if ($content -notmatch 'approvals_reviewer\s*=\s*"auto_review"') { throw "Codex auto review is missing in $package" }
+            if ($content -notmatch '(?m)^sandbox_mode\s*=\s*"danger-full-access"\s*$') { throw "Codex full access is missing in $package" }
             if ($content -notmatch '(?m)^max_depth\s*=\s*1\s*$') { throw "Codex agent depth limit is missing in $package" }
             if ($content -notmatch 'status_line\s*=\s*\["model", "reasoning", "fast-mode", "approval-mode", "five-hour-limit", "weekly-limit", "project-name", "git-branch", "context-window-size", "context-used", "used-tokens"\]') { throw "Codex status line is incorrect in $package" }
         } elseif ((($settings.hooks.PSObject.Properties.Name | Sort-Object) -join ',') -ne 'PreCompact,SessionStart,Stop' -or $content -match 'flashbang-if-input' -or $settings.hooks.Stop[0].hooks[0].async) {

scripts/tests/test-shell-packages.sh

@@ -83,6 +83,7 @@ for shell in powershell bash; do
       ! grep -q 'flashbang-if-input' "$package/$file"
       ! grep -Eq '^async[[:space:]]*=[[:space:]]*true[[:space:]]*$' "$package/$file"
       grep -q 'approvals_reviewer[[:space:]]*=[[:space:]]*"auto_review"' "$package/$file"
+      grep -Eq '^sandbox_mode[[:space:]]*=[[:space:]]*"danger-full-access"[[:space:]]*$' "$package/$file"
       grep -Eq '^max_depth[[:space:]]*=[[:space:]]*1[[:space:]]*$' "$package/$file"
       grep -Fq 'status_line = ["model", "reasoning", "fast-mode", "approval-mode", "five-hour-limit", "weekly-limit", "project-name", "git-branch", "context-window-size", "context-used", "used-tokens"]' "$package/$file"
     else