[merefield]

Why

Reversible session settings currently need an extra review/confirmation step even when the selected value is explicit and easy to change back. This adds friction to common name, model/reasoning, speed and Plan changes. This PR removes that redundant UI step for a conservative allowlist, while retaining guarded defaults elsewhere and offering a launch-only opt-out for users who prefer fewer confirmations.

Default behaviour

• Apply /rename, model/reasoning choices, advertised speed changes such as /fast, and /plan on explicit selection, without a second confirmation.
• Navigation/highlighting does not change settings. Enter Apply or an option click does. Rename applies after explicitly submitting the edited name.
• Classify reversible commands in the shared Go adapter from known RPC methods and exact allowed field names, not translated labels or arbitrary slash names. Unknown operations, permission changes and directory changes remain guarded by default.
• Keep current advertised-option discovery, freshness/revision revalidation, working/idle restrictions, verified writes and cache invalidation.

Optional --no-confirm

• Skip Codexometer's other extra UI confirmations for this launch in terminal mode or --web --web-control mode. Includes explicit approval/grant choices, guarded slash choices, quota-profile decisions, browser prompt/schedule submission, scheduled Send now, native queue deletion, Close All dismissal and guarded benchmark launches.
• Quota-reset redemption always retains its confirmation, even with the flag. This exception was explicitly requested.
• Never select an incoming approval automatically, start work merely by displaying an option, change Codex sandbox/approval rules, or enable writes in a read-only browser launch.
• Retain separate protected server-side prepare/commit requests in web mode; a single user action can complete both phases. Do not relax pairing, same-origin/authentication, request identity, fresh capabilities, revision or replay validation. No automatic retries on uncertain writes.
• Ignore recognised command key-repeat submissions and protect composer-to-approval transitions from turning text entry into a permission grant. The opt-out is not persisted in preferences; older terminal key-repeat limitations are documented.

Interface and documentation

• Match clickable button labels to the next action: Enter Apply for direct choices, existing review/confirm controls for guarded choices. Preserve the inline expandable command menus and composer draft/focus behaviour.
• Regenerate embedded browser assets; standalone builds need no Node runtime.
• Update README, security guidance and the maintained intro post with the default allowlist, launch examples, consequences and permanent reset exception.

Validation

• Full core Go suite with race detection and coverage (the separate locale matrix is left to CI), plus go vet ./... and formatting checks.
• Shared policy and command allowlist tests; unknown/permission/mixed-field changes remain guarded.
• Terminal mouse targets at multiple widths, direct-choice duplicate suppression, unavailable/hidden-action guards, approval capability checks, session-scoped profile updates, queue deletion, scheduled Send now, benchmark launch and the reset exception.
• Native Windows execution of the new terminal policy regressions.
• Frontend type/format checks and production build; all 102 browser tests, including direct speed choices, no-confirm approvals/prompts/schedules, failed preparation preserving drafts, and the existing guarded flows.

This is separate from the already published v0.25.0 release and is based on its main-branch commit. It adds no new Codex RPC methods or automatic-approval mechanism.

[Copilot]

🟡 Changes recommended

Two unresolved moderate findings remain: the repeat guard blocks held Right-arrow movement in text-entry menus, and clicking a terminal picker option such as /fast only highlights it instead of applying the reversible choice as documented.

2 open issues

• Apply reversible picker choices on click · New
• Ignore Right repeats only in choice menus · New

What changed in this PR

This PR reduces confirmation friction in Codexometer's session controls. Reversible settings (/rename, model and reasoning, advertised speed such as /fast, and /plan) now apply when the user explicitly selects them. Permission changes, directory changes, and unknown actions keep their confirmation step by default. A new launch-only --no-confirm flag skips the other extra UI confirmations in terminal mode and in --web --web-control mode. Quota-reset redemption always keeps its confirmation.

Changes:

• Adds a shared confirmation policy and a strict allowlist that marks reversible session commands (rename, and settings updates limited to model, effort, service tier, and collaboration mode).
• Adds the --no-confirm flag, passes it through the terminal and web launch paths, and applies it to approvals, queue deletion, scheduled sends, Close All, benchmark launches, and quota profiles. Quota resets are excluded.
• Updates the terminal and browser UI button labels (for example "ENTER APPLY"), regenerates the embedded web assets, and updates the README, SECURITY.md, and intro post.

File	Description
web/​tests/​browser.spec.ts	Adds browser tests for direct speed choices, no-confirm approvals, prompts, schedules, and failed preparation.
web/​src/​state.svelte.ts	Adds the noConfirm field to the snapshot type.
web/​src/​SessionCommands.svelte	Applies reversible or no-confirm choices on selection and changes the button labels.
web/​src/​SessionActions.svelte	Commits no-confirm actions after preparation and changes the send button label.
SECURITY.md	Documents the default allowlist, the --no-confirm opt-out, and the reset exception.
README.md	Documents the new apply behaviour, the flag, and its consequences.
main.go	Parses --no-confirm and passes it to the terminal and web launchers.
main_web_test.go	Tests that the flag reaches each launch mode and does not enable web writes.
main_test.go	Updates launcher stubs for the new noConfirm parameter.
main_logging_test.go	Updates launcher stubs for the new noConfirm parameter.
intro-post.md	Describes the new apply behaviour and the --no-confirm option.
internal/​web/​state.go	Adds the noConfirm field to the web state snapshot.
internal/​web/​server.go	Adds Options and sets the no-confirm state for writable web sessions.
internal/​web/​dist/​index.html	Points to the regenerated browser script bundle.
internal/​web/​dist/​assets/​index-D12p0CYy.js	Regenerated embedded browser bundle with the new behaviour.
internal/​web/​control_commands_test.go	Tests that no-confirm does not bypass server-side preparation or replay checks.
internal/​ui/​quota_step_down.go	Applies quota profile changes directly when no-confirm is set.
internal/​ui/​quota_reset_test.go	Tests that no-confirm still requires confirmation for quota resets.
internal/​ui/​monitor_schedule_panel.go	Sends scheduled prompts directly when no-confirm is set.
internal/​ui/​monitor_queue.go	Deletes queued items directly when no-confirm is set.
internal/​ui/​monitor_prompt.go	Stops composer-to-approval focus changes from turning typing into a grant.
internal/​ui/​monitor_commands.go	Applies reversible and no-confirm command choices and adds the repeat-key guard.
internal/​ui/​monitor_commands_test.go	Tests direct application, unavailable-choice guards, and click targets.
internal/​ui/​monitor_close_all.go	Dismisses all sessions in one step when no-confirm is set.
internal/​ui/​monitor_approval.go	Skips the grant confirmation step when no-confirm is set, but still requires an explicit choice.
internal/​ui/​monitor_approval_test.go	Tests that no-confirm still requires an explicit approval and a live capability.
internal/​ui/​model.go	Adds the confirmation policy to the model and applies it to benchmark launches.
internal/​ui/​confirmations.go	Adds the SetNoConfirm setter for the launch-scoped policy.
internal/​ui/​confirmations_test.go	Tests queue deletion, profile selection, Send now, Run All, and composer typing.
internal/​confirmation/​policy.go	Defines the shared policy and the reversible, guarded, and quota-reset action types.
internal/​confirmation/​policy_test.go	Tests the policy table and that unknown commands stay guarded.
internal/​codex/​session_confirmation_unix_test.go	Tests the reversible-command allowlist, including mixed and unknown fields.
internal/​codex/​session_commands.go	Adds the Reversible and ReversibleInput fields and updates the menu type.
internal/​codex/​session_commands_unix.go	Classifies reversible commands from known RPC methods and exact field names, and updates the help text.

_{Review effort: Lite}