Fix implementation of --dangerously-auto-approve-everything flag

[blocksorg]

Summary

This PR fixes a bug where the --dangerously-auto-approve-everything flag was defined in the CLI but not properly implemented in the approval policy logic. This caused users in Docker containers or environments without seccomp/landlock support to still encounter the sandboxing error even when using the intended bypass flag.

Problem

The error message "The combination of seccomp/landlock that Codex uses for sandboxing is not supported in this environment" would appear even when using --dangerously-auto-approve-everything, because:

1. The flag was defined in CLI options but missing from approval policy logic
2. The approval policy only checked for fullAuto and autoEdit, not the dangerous flag
3. The canAutoApprove() function had no handling for the "dangerous-auto" mode

Solution

• Added "dangerous-auto" to the ApprovalPolicy type definition
• Added DANGEROUS_AUTO to the AutoApprovalMode enum
• Updated CLI approval policy logic to prioritize --dangerously-auto-approve-everything flag
• Updated canAutoApprove() function to auto-approve all commands without sandboxing in dangerous-auto mode
• Updated canAutoApproveApplyPatch() to handle dangerous-auto mode properly
• Added comprehensive tests covering all dangerous-auto scenarios

Testing

Added tests/dangerous-auto-approve.test.ts with 4 test cases:

• Auto-approval of dangerous commands without sandbox
• Auto-approval of apply_patch commands without sandbox
• Auto-approval of unsafe commands without sandbox
• Contrast with full-auto mode that still requires sandbox

Test plan

• All existing tests pass
• New tests for dangerous-auto mode pass
• Manual verification that the flag now bypasses sandboxing requirements
• Verified that the fix resolves the original seccomp/landlock error

🤖 Generated with Claude Code