feat(gateway): bridge managed Codex TUI approvals

[Nicecsh]

What does this PR do?

Bridges approval prompts from native Codex TUI processes that Hermes launches in an owned PTY back to the originating Discord session.

Today, a Hermes agent can launch codex with pty: true, but any later native TUI command/file/permission approval exists only on that hidden PTY. The user sees no actionable prompt in Discord, and the background process can remain blocked indefinitely.

This change gives eligible Codex PTYs process-local approval key bindings, recognizes fully rendered native approval screens, queues the request on Hermes' existing per-session approval FIFO, and sends the decision back through the PTY. It does not attach to unrelated/external Codex processes and does not change global Codex configuration.

Security and lifecycle properties:

• restricted to a direct interactive codex command launched by Hermes for a Discord session
• rejects compound shell commands and non-interactive Codex subcommands
• verifies Codex CLI >= 0.146 before enabling the documented keymap overrides
• binds approvals to the exact originating Discord session and managed process
• prevents public PTY stdin writes from racing a pending approval
• maps persistent Hermes choices only to Codex's process-local session scope, never a global rule
• denies on notification failure, timeout, process termination, or gateway shutdown

Related Issue

No issue filed. Related app-server approval work (#25889, #27636, and #66925) addresses the structured Codex app-server transport; this PR covers the separate native TUI PTY path.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• add tools/codex_tui_approval.py for safe command gating, version checks, process-local keymaps, screen detection, and decision-to-key mapping
• extend tools/process_registry.py to prepare managed Codex PTYs, detect approvals, block unsafe concurrent stdin, and clean up process-owned requests
• extend tools/approval.py with process-lifetime queue entries and source-scoped cancellation
• route managed Codex approval cards and text fallbacks through the exact Discord origin in gateway/run.py
• add focused process, routing, isolation, cleanup, and fallback tests

How to Test

1. From a Discord gateway session, launch a direct native Codex TUI with pty: true.
2. Trigger a native Codex command approval and confirm the approval card appears in the originating Discord channel/thread.
3. Approve or deny it and confirm only that managed PTY receives the mapped decision.

Automated validation:

• scripts/run_tests.sh tests/tools/test_codex_tui_approval.py tests/gateway/test_codex_pty_approval_bridge.py tests/tools/test_approval.py tests/gateway/test_discord_slash_commands.py tests/gateway/test_discord_exec_approval_content.py tests/gateway/test_discord_approval_mentions.py — 366 passed
• ruff check on all six changed files — passed
• python -m py_compile on all six changed files — passed
• git diff --check — passed
• Codex CLI 0.146 accepted all three keymap overrides in a real config-loading command
• Full repository suite smoke reached 7,899 passes with 0 failures before being interrupted due to its runtime; GitHub CI will run the complete matrix

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched existing open and merged PRs to make sure this isn't a duplicate
• My PR contains only changes related to this feature
• I've run pytest tests/ -q and all tests pass (targeted 366-test suite passes; full CI pending)
• I've added tests for my changes
• I've tested on Ubuntu 24.04

Documentation & Housekeeping

• Documentation update is N/A; behavior is internal and documented in module/class docstrings
• cli-config.yaml.example update is N/A; no Hermes config keys were added
• CONTRIBUTING.md / AGENTS.md update is N/A
• Cross-platform impact considered: Windows PTY writes use the existing string API; unsupported/non-owned paths remain unchanged
• Tool description/schema updates are N/A; no public tool schema changed

Screenshots / Logs

The focused test run completed with 366 tests passed, 0 failed.

[teknium1]

Thanks for isolating the native-PTY path from the existing app-server approval work. The current main PTY reader has no native Codex approval bridge, so the feature premise remains valid.

Problems

• tools/process_registry.py:731, :747 — this stale hunk bypasses current main's safe_command rewrite. Current main applies _rewrite_compound_background() at tools/process_registry.py:708-715 and passes safe_command to PTY spawn at :737, fixing the A && B & subshell-wait deadlock in commit d7512c8689a3 (#68915). Here, pty_command falls back to raw command whenever the Codex bridge is disabled, so unrelated PTYs lose that protection.

Suggested changes

• Build the Codex rewrite from safe_command, or otherwise preserve safe_command for every non-bridged PTY path; add a PTY regression test for the compound-background case.

Automated hermes-sweeper review.

[teknium1]

On current main this argument is safe_command, produced by _rewrite_compound_background() to fix #68915. Because pty_command falls back to raw command when the bridge is ineligible, this regresses that protection for every other PTY command. Preserve safe_command as the fallback/input to the Codex rewrite.