feat(codex): hand off plans to implementation

[tatoalo]

Problem

Codex Plan mode can stream its proposal outside regular assistant-message deltas, so users could see no plan and never receive the prompt to begin implementation. Cloud runs also downgraded Codex Plan to Read only because the backend contract did not yet accept the native mode.

Stacked on #3340. The cloud API contract is added by PostHog/posthog#69947.

Changes

• Stream Codex plan deltas as agent prose and replay persisted plan items on reload.
• Capture both streamed and completed plan proposals.
• Offer the existing mode-switch approval when a Plan turn completes.
• Switch to Auto or Full access after approval and immediately run the implementation turn in the same prompt.
• Loop rejected plans back through feedback, validate offered choices, and handle cancellation safely.
• Defer the cloud idle signal until the handoff or implementation turn is actually complete.
• Preserve native Codex Plan mode when creating cloud runs.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit f661c53.}

[stamphog]

Zero reviews on a T1d-complex PR with a behavioral API contract change: plan mode is now passed through to the cloud API as initial_permission_mode: "plan" for Codex task runs instead of being degraded to read-only. The generated.ts edit adds "plan" to the server enum, but it's unclear whether the backend has deployed support for this value. If not, cloud plan-mode task creation will fail with a server validation error.

[greptile-apps]

Security Review

A pending plan approval can override a newer restrictive mode selection and start the implementation turn with broader permissions.

_{Reviews (1): Last reviewed commit: "fix(tasks): preserve Codex plan mode in ..." | Re-trigger Greptile}

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

Could not verify team-posthog-code membership (GitHub API error). Auto-release is limited to Team PostHog Code members, so this will ship with the next scheduled release instead.