[codex] improve Codex plan mode compatibility

[dsus4wang]

Summary

Improves Codex plan-mode compatibility when using the app-server runtime.

Changes

• Probes collaborationMode/list after app-server initialization and keeps native plan-mode attempts enabled until the runtime rejects the field.
• Retries plan turns once without collaborationMode when the runtime reports the field is unsupported or invalid, with a user-visible fallback message.
• Adds generic item/tool/requestApproval handling so exit_plan_mode requests flow through Codex permissions.
• Resets Codex collaboration mode to default after an approved exit_plan_mode / ExitPlanMode request and immediately emits updated keepalive state.

Validation

• cd cli && PATH=$HOME/.bun/bin:$PATH bun run test codexRemoteLauncher.test.ts appServerConfig.test.ts appServerPermissionAdapter.test.ts permissionHandler.test.ts
• PATH=$HOME/.bun/bin:$PATH bun typecheck

[github-actions]

Findings

• [Major] Retry predicate catches every collaborationMode error — message.includes("mode") is always true after the guard accepts collaborationMode, so unrelated app-server failures that merely mention the field are retried without collaboration mode. That silently downgrades a plan turn into a normal turn instead of surfacing the real failure. Evidence cli/src/codex/codexRemoteLauncher.ts:52
  Suggested fix:

  return message.includes("experimentalapi")
      || message.includes("unsupported")
      || message.includes("unknown")
      || message.includes("unexpected")
      || message.includes("unrecognized")
      || message.includes("invalid field");

Summary

• Review mode: initial
• Found one issue in the fallback detection for Codex collaboration mode. Residual test gap: add a negative test where startTurn fails with a non-compatibility error mentioning collaborationMode, and assert HAPI does not retry as a normal turn.

Testing

• Not run: bun not found on PATH in this runner.

HAPI Bot

[github-actions]

[Major] message.includes("mode") is always true once the guard has matched collaborationMode, so this retries any app-server error that mentions the field, including non-compatibility failures. That silently resends a plan turn as a normal turn instead of surfacing the actual error.

Suggested fix:

return message.includes("experimentalapi")
    || message.includes("unsupported")
    || message.includes("unknown")
    || message.includes("unexpected")
    || message.includes("unrecognized")
    || message.includes("invalid field");