codex: allow-list --profile by subcommand; omit it where codex rejects it

[Edwinhe03]

What

ucode codex's launch always ran codex --profile ucode <args>. But codex only accepts the global --profile on runtime subcommands (the interactive TUI, exec / review / resume / archive / delete / unarchive / fork / mcp / sandbox). Server-family subcommands (app-server, mcp-server, exec-server, remote-control) and utilities reject it immediately:

Error: --profile only applies to runtime commands and `codex mcp`: `codex`, `codex exec`, ...

So ucode codex app-server (and the other server subcommands) was functionally broken.

Change

• Allow-list the subcommands that accept --profile (a deny-list would break the next codex server subcommand by default; the allow-list fails safe) and attach it only for those.
• For subcommands that reject it, omit --profile and pass the caller's args through untouched. Those are caller-configured — omnigent runs codex app-server with its own CODEX_HOME, and ucode's config isn't even read when CODEX_HOME is set — so ucode just stays out of the way rather than injecting a named profile codex won't accept.

Scoped to the minimum: just the --profile guard in the codex agent (_codex_subcommand + the allow-list). No config-override machinery, no passthrough.

Verification

• Full unit suite green (859 passed, 8 skipped); ruff + ty clean.
• E2E against real codex (0.137.0 and 0.141):
  • codex app-server --listen … (no --profile) binds cleanly.
  • codex --profile ucode exec still works (runtime subcommand).
  • codex app-server --profile ucode reproduces the original error (negative control).

This pull request and its description were written by Isaac.

[lilly-luo]

am i testing this right? it seems to error on start?

i checked out your branch

no app-server:

$ uv run ucode codex
✔ Databricks auth already available for https://dbc-a5d4177a-49dc.cloud.databricks.com
✔ Unity AI Gateway detected      
                                
╭──────────────────╮
│ ucode with Codex │
╰──────────────────╯
  Model: system.ai.gpt-5-5
✔ Starting Codex
╭────────────────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.143.0-alpha.14)                    │
│                                                        │
│ model:     system.ai.gpt-5-5 medium   /model to change │
│ directory: ~/ucode                                     │
╰────────────────────────────────────────────────────────╯

  Tip: New Build faster with Codex.

⚠ MCP startup interrupted. The following servers were not initialized: confluence, databricks-v2, devportal, github, glean,
  google, jira, logs-summariser, pagerduty, slack

with app-server

# lilly.luo at ip-10-93-41-23 in ~/ucode (git:edwin-he/ucode-composable-flag-injection) [14:50:55]
$ uv run ucode codex app-server
2026-07-08T14:50:56.919524Z ERROR codex_app_server: Project-local config, hooks, and exec policies are disabled in the following folders until the project is trusted, but skills still load.
    1. /home/lilly.luo/ucode/.codex
       To load project-local config, hooks, and exec policies, add /home/lilly.luo/ucode as a trusted project in /home/lilly.luo/.codex/config.toml.

2026-07-08T14:50:57.317311Z ERROR codex_models_manager::manager: failed to refresh available models: {"error_code":"BAD_REQUEST","message":"Request path '/codex/v1/models?client_version=0.143.0' doesn't match any known API type and is classified as an unmanaged api request. Set the Databricks-Model-Provider-Service header to the name of the model provider service to forward this request to."}

[lilly-luo]

1. could you help me understand why omnigent is even using ucode if it just wants the codex pass thru? why doesn't omnigent just call codex instead of ucode codex app-server
2. instead of making this a separate command, would we make this a flag? something like the below. it could be nice for people to use ucode directlyucode codex --skip-init

[lilly-luo]

follow up:
Edwin: temp bump omnigent timeout
Lilly: introduce new config setting that skips all initialization, doesnt pull fresh models, doesn't test the tools