fix(sandbox): restore workspace-write for task --write (revert openai#471's danger-full-access)

openai#471 (commit a6e501a) mapped --write to danger-full-access. Under
approvalPolicy: never that removes all containment — --write silently
grants full host-filesystem authority. Adversarial review flagged it as
a privilege expansion (confidence 0.99). Reverting to workspace-write as
in upstream main; asked the openai#471 author for the intent behind the change
(openai#471 issuecomment-4991428428).

Author: axisrow

plugins/codex/scripts/codex-companion.mjs

@@ -491,7 +491,7 @@ async function executeTaskRun(request) {
     defaultPrompt: resumeThreadId ? DEFAULT_CONTINUE_PROMPT : "",
     model: request.model,
     effort: request.effort,
-    sandbox: request.write ? "danger-full-access" : "read-only",
+    sandbox: request.write ? "workspace-write" : "read-only",
     onProgress: request.onProgress,
     persistThread: true,
     threadName: resumeThreadId ? null : buildPersistentTaskThreadName(request.prompt || DEFAULT_CONTINUE_PROMPT)

tests/runtime.test.mjs

@@ -736,7 +736,7 @@ test("write task output focuses on the Codex result without generic follow-up hi
   assert.equal(result.stdout, "Handled the requested task.\nTask prompt accepted.\n");
 });
 
-test("task --write starts Codex with unrestricted sandbox access", () => {
+test("task --write starts Codex with workspace-write sandbox", () => {
   const repo = makeTempDir();
   const binDir = makeTempDir();
   const statePath = path.join(binDir, "fake-codex-state.json");
@@ -750,10 +750,10 @@ test("task --write starts Codex with unrestricted sandbox access", () => {
 
   assert.equal(result.status, 0, result.stderr);
   const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
-  assert.equal(state.lastThreadStart.sandbox, "danger-full-access");
+  assert.equal(state.lastThreadStart.sandbox, "workspace-write");
 });
 
-test("resuming task --write upgrades the thread to unrestricted sandbox access", () => {
+test("resuming task --write upgrades the thread to workspace-write sandbox", () => {
   const repo = makeTempDir();
   const binDir = makeTempDir();
   const statePath = path.join(binDir, "fake-codex-state.json");
@@ -773,7 +773,7 @@ test("resuming task --write upgrades the thread to unrestricted sandbox access",
 
   assert.equal(result.status, 0, result.stderr);
   const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
-  assert.equal(state.lastThreadResume.sandbox, "danger-full-access");
+  assert.equal(state.lastThreadResume.sandbox, "workspace-write");
 });
 
 test("task --resume acts like --resume-last without leaking the flag into the prompt", () => {