feat(agent): relax agent guardrails

[fcoury-oai]

The current Agent policy can stop valid long-running work after an arbitrary number of tool calls and adds review or playback pauses even when Red still owns the mutation boundary. This change removes those behavioral ceilings while retaining the hard resource limits, read-only Codex sandbox, revision checks, workspace path validation, and editor-owned transactions.

What Changed

• Remove the 32-call full-Agent ceiling and the 12-read inline-context ceiling.
• Page full-Agent file listings and reads, expose continuation metadata, and report bounded-search truncation instead of failing long investigations.
• Run full-Agent tool calls without deliberate playback pauses by default, with agent.follow_tool_calls available to restore followed playback.
• Auto-apply exact-scope foreground inline edits as unsaved, undoable transactions by default; stale, background, and expanded-scope results still require review, and agent.auto_apply_inline_edits can restore review for exact-scope results.
• Add explicit opt-ins for secret-like paths, named MCP servers, and Codex extension categories. All remain disabled by default, and inline or commit-message sessions do not inherit extension grants.
• Update the Agent workflow and architecture documentation to describe the revised boundaries.

How to Test

1. Ask Agent to inspect a workspace deeply enough to exceed the former call ceilings, including paged list_files and read_file requests. The turn should continue, and responses should provide next_offset, next_line, or truncated metadata where applicable.
2. Run inline assist on an exact foreground selection and request a code edit. The result should apply immediately as an unsaved, undoable transaction. Set agent.auto_apply_inline_edits = false and repeat; the result should wait for review.
3. Leave the new capability settings at their defaults and confirm secret-like paths and Codex extensions remain unavailable. Enable one named MCP server or feature and confirm only the explicitly named capability is enabled; .git remains restricted even when sensitive paths are allowed.

Automated validation completed:

• cargo test --all-targets --all-features
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check

Focused regressions cover paged unsaved-buffer reads, paged and sensitive-path-aware listings/search, explicit capability policy, configurable inline review, and default exact-scope inline auto-apply.

[fcoury-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-20T23:50:04.767361Z	1b6caa3	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b6caa3f8b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".