fix: keep permission profile helper backward compatible (#116)

## Why

PR #113 added `--permission-profile` to the internal `run-codex-exec`
helper as a required Commander option. Existing callers that invoke the
helper with the pre-#113 argument set now fail during option parsing,
before the existing permission-selection fallback can preserve the
legacy `workspace-write` behavior.

The established `--sandbox` helper option was already required. Making
both helper options optional, as proposed in #115, would broaden the
internal interface unnecessarily; only the newly introduced option needs
a backward-compatible default.

## What changed

- Make `--permission-profile` optional with an empty-string default.
- Keep `--sandbox` required so malformed helper invocations still fail
early.
- Add regression coverage for omitting `--permission-profile` while
preserving the legacy `workspace-write` fallback.
- Rebuild the checked-in `dist/main.js` bundle.

## Testing

- `corepack pnpm test`
- `corepack pnpm run check`

src/main.ts

@@ -150,9 +150,10 @@ export async function main() {
       "--sandbox <SANDBOX>",
       "Legacy sandbox mode override to pass to `codex exec` (may be empty)."
     )
-    .requiredOption(
+    .option(
       "--permission-profile <PROFILE>",
-      "Permission profile to select through `default_permissions` (may be empty)."
+      "Permission profile to select through `default_permissions` (may be empty).",
+      ""
     )
     .requiredOption("--model <model>", "Model the agent should use")
     .requiredOption("--effort <effort>", "Reasoning effort the agent should use")

test/runCodexExec.test.mjs

@@ -79,8 +79,9 @@ writeFileSync(args[outputIndex + 1], "fake final message\\n");
       "",
       "--sandbox",
       sandbox,
-      "--permission-profile",
-      permissionProfile,
+      ...(permissionProfile == null
+        ? []
+        : ["--permission-profile", permissionProfile]),
       "--model",
       "",
       "--effort",
@@ -117,6 +118,15 @@ test("preserves workspace-write as the default legacy sandbox", () => {
   assert.deepEqual(capturedArgs.slice(-2), ["--sandbox", "workspace-write"]);
 });
 
+test("allows permission-profile to be omitted", () => {
+  const { result, capturedArgs } = runCodexExecWithFakeCodex({
+    permissionProfile: null,
+  });
+
+  assert.equal(result.status, 0, result.stderr);
+  assert.deepEqual(capturedArgs.slice(-2), ["--sandbox", "workspace-write"]);
+});
+
 test("selects a permission profile without passing --sandbox", () => {
   const { result, capturedArgs } = runCodexExecWithFakeCodex({
     permissionProfile: "public-review",