feat: load defaults into Config and introduce ConfigOverrides (#677)

This changes how instantiating `Config` works and also adds
`approval_policy` and `sandbox_policy` as fields. The idea is:

* All fields of `Config` have appropriate default values.
* `Config` is initially loaded from `~/.codex/config.toml`, so values in
`config.toml` will override those defaults.
* Clients must instantiate `Config` via
`Config::load_with_overrides(ConfigOverrides)` where `ConfigOverrides`
has optional overrides that are expected to be settable based on CLI
flags.

The `Config` should be defined early in the program and then passed
down. Now functions like `init_codex()` take fewer individual parameters
because they can just take a `Config`.

Also, `Config::load()` used to fail silently if `~/.codex/config.toml`
had a parse error and fell back to the default config. This seemed
really bad because it wasn't clear why the values in my `config.toml`
weren't getting picked up. I changed things so that
`load_with_overrides()` returns `Result<Config>` and verified that the
various CLIs print a reasonable error if `config.toml` is malformed.

Finally, I also updated the TUI to show which **sandbox** value is being
used, as we do for other key values like **model** and **approval**.
This was also a reminder that the various values of `--sandbox` are
honored on Linux but not macOS today, so I added some TODOs about fixing
that.

codex-rs/core/src/config.rs

@@ -1,39 +1,98 @@
-use std::path::PathBuf;
-
+use crate::flags::OPENAI_DEFAULT_MODEL;
+use crate::protocol::AskForApproval;
+use crate::protocol::SandboxPolicy;
 use dirs::home_dir;
 use serde::Deserialize;
+use std::path::PathBuf;
 
-/// Embedded fallback instructions that mirror the TypeScript CLI’s default system prompt. These
-/// are compiled into the binary so a clean install behaves correctly even if the user has not
-/// created `~/.codex/instructions.md`.
+/// Embedded fallback instructions that mirror the TypeScript CLI’s default
+/// system prompt. These are compiled into the binary so a clean install behaves
+/// correctly even if the user has not created `~/.codex/instructions.md`.
 const EMBEDDED_INSTRUCTIONS: &str = include_str!("../prompt.md");
 
-#[derive(Default, Deserialize, Debug, Clone)]
+/// Application configuration loaded from disk and merged with overrides.
+#[derive(Deserialize, Debug, Clone)]
 pub struct Config {
-    pub model: Option<String>,
+    /// Optional override of model selection.
+    #[serde(default = "default_model")]
+    pub model: String,
+    /// Default approval policy for executing commands.
+    #[serde(default)]
+    pub approval_policy: AskForApproval,
+    #[serde(default)]
+    pub sandbox_policy: SandboxPolicy,
+    /// System instructions.
     pub instructions: Option<String>,
 }
 
+/// Optional overrides for user configuration (e.g., from CLI flags).
+#[derive(Default, Debug, Clone)]
+pub struct ConfigOverrides {
+    pub model: Option<String>,
+    pub approval_policy: Option<AskForApproval>,
+    pub sandbox_policy: Option<SandboxPolicy>,
+}
+
 impl Config {
-    /// Load ~/.codex/config.toml and ~/.codex/instructions.md (if present).
-    /// Returns `None` if neither file exists.
-    pub fn load() -> Option<Self> {
-        let mut cfg: Config = Self::load_from_toml().unwrap_or_default();
-
-        // Highest precedence → user‑provided ~/.codex/instructions.md (if present)
-        // Fallback           → embedded default instructions baked into the binary
+    /// Load configuration, optionally applying overrides (CLI flags). Merges
+    /// ~/.codex/config.toml, ~/.codex/instructions.md, embedded defaults, and
+    /// any values provided in `overrides` (highest precedence).
+    pub fn load_with_overrides(overrides: ConfigOverrides) -> std::io::Result<Self> {
+        let mut cfg: Config = Self::load_from_toml()?;
+        tracing::warn!("Config parsed from config.toml: {cfg:?}");
 
+        // Instructions: user-provided instructions.md > embedded default.
         cfg.instructions =
             Self::load_instructions().or_else(|| Some(EMBEDDED_INSTRUCTIONS.to_string()));
 
-        Some(cfg)
+        // Destructure ConfigOverrides fully to ensure all overrides are applied.
+        let ConfigOverrides {
+            model,
+            approval_policy,
+            sandbox_policy,
+        } = overrides;
+
+        if let Some(model) = model {
+            cfg.model = model;
+        }
+        if let Some(approval_policy) = approval_policy {
+            cfg.approval_policy = approval_policy;
+        }
+        if let Some(sandbox_policy) = sandbox_policy {
+            cfg.sandbox_policy = sandbox_policy;
+        }
+        Ok(cfg)
     }
 
-    fn load_from_toml() -> Option<Self> {
-        let mut p = codex_dir().ok()?;
-        p.push("config.toml");
-        let contents = std::fs::read_to_string(&p).ok()?;
-        toml::from_str(&contents).ok()
+    /// Attempt to parse the file at `~/.codex/config.toml` into a Config.
+    fn load_from_toml() -> std::io::Result<Self> {
+        let config_toml_path = codex_dir()?.join("config.toml");
+        match std::fs::read_to_string(&config_toml_path) {
+            Ok(contents) => toml::from_str::<Self>(&contents).map_err(|e| {
+                tracing::error!("Failed to parse config.toml: {e}");
+                std::io::Error::new(std::io::ErrorKind::InvalidData, e)
+            }),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                tracing::info!("config.toml not found, using defaults");
+                Ok(Self::load_default_config())
+            }
+            Err(e) => {
+                tracing::error!("Failed to read config.toml: {e}");
+                Err(e)
+            }
+        }
+    }
+
+    /// Meant to be used exclusively for tests: load_with_overrides() should be
+    /// used in all other cases.
+    pub fn load_default_config_for_test() -> Self {
+        Self::load_default_config()
+    }
+
+    fn load_default_config() -> Self {
+        // Load from an empty string to exercise #[serde(default)] to
+        // get the default values for each field.
+        toml::from_str::<Self>("").expect("empty string should parse as TOML")
     }
 
     fn load_instructions() -> Option<String> {
@@ -43,6 +102,10 @@ impl Config {
     }
 }
 
+fn default_model() -> String {
+    OPENAI_DEFAULT_MODEL.to_string()
+}
+
 /// Returns the path to the Codex configuration directory, which is `~/.codex`.
 /// Does not verify that the directory exists.
 pub fn codex_dir() -> std::io::Result<PathBuf> {