fix(cli): preserve analytics settings in finding workflows

[mldangelo-oai]

Summary

validate, patch, and verify-fix currently reject --codex 'analytics.enabled=false', so disabling Codex analytics for a scan does not cover standalone follow-up commands. Accept this setting through their existing --codex option and carry the scan's explicit analytics setting into automatic patching.

Changes

• Forward analytics.enabled to the native Codex runtime for finding validation, patching, fix verification, and patch risk assessment.
• Preserve an explicitly configured true or false when scan --patch starts its patch workflow.
• Document CLI and SDK usage, configuration isolation, and the limits of this opt-out.
• Cover argument forwarding, automatic patching, SDK configuration, and native app-server configuration precedence.

Testing

• Focused CLI and SDK tests: 389 passed, 2 platform skips.
• Native app-server configuration and trust tests: 5 passed.
• pnpm run types and pnpm run format: passed.
• pnpm run test --seed 12345: 2,307 passed, 41 skipped, 0 failed.
• pnpm run test (random seed 949832507): 2,307 passed, 41 skipped, 0 failed.

Risk and rollout

This extends the accepted keys of the existing --codex option on validate, patch, and verify-fix; it adds no flags and changes no telemetry defaults. Existing model and reasoning-effort overrides, configuration isolation, and patch project-trust behavior are preserved. analytics.enabled=false disables Codex analytics and metrics; model requests, authentication, enabled integrations, explicitly configured OpenTelemetry log or trace exporters, and the CLI update check remain separate.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T07:20:44.846725Z	2909d13	Manual request
🔒 Security Review	✅ Completed 2026-09-03T07:21:36.514809Z	2909d13	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2909d137d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sylvesterkaczmarek]

Validation uses parsed TOML, but forwarding re-filters the raw --codex string by prefix. Valid inputs like analytics.enabled = false or analytics = { enabled = false } pass validation but are dropped here, leaving the native runtime unchanged. Please forward the normalized parsed analytics.enabled value and add a spaced/inline-table regression.