Keep Codex-assisted analysis working when new CLI features appear

[thrr87]

Problem

Codex-assisted metadata analysis fails before starting a Codex task when the CLI advertises a newly enabled feature that is absent from the app’s hard-coded feature allowlists.

Codex CLI 0.146.0 advertises in_app_updates and item_ids as enabled. isolationConfiguration treats them as unknown capabilities, throws toolUseBlocked, and the UI reports only “Codex could not analyze this metadata.”

Production history shows successful analyses before the CLI update and consecutive sub-second failures afterwards. The model is never invoked.

Expected behavior

New advertised feature names must not break analysis. The analysis thread must still run without tools, network, workspace roots, MCP servers, apps, or inherited instructions.

Implementation

• Collect every valid feature name returned by experimentalFeature/list.
• Pass every advertised feature to thread/start with an explicit false override.
• Remove the maintenance-sensitive benign/tool feature-name allowlists where they are no longer needed.
• Continue to fail closed when the feature-list response is missing, malformed, or unreadable.
• Preserve existing validation of sandbox, model, approval policy, workspace roots, tools, MCP servers, and empty instruction sources.

Acceptance criteria

• An unknown enabled feature is explicitly disabled and analysis reaches thread/start and turn/start.
• Future valid feature names do not require application changes.
• Malformed feature entries and failed feature-list requests still stop analysis.
• Existing no-tools/no-network isolation tests continue to pass.
• Replace the current test expecting an unknown enabled feature to fail with a test proving it is disabled and analysis succeeds.

[thrr87]

Implemented in #64.

The isolated analysis task now disables every feature name advertised by the installed Codex CLI, so newly introduced features are ignored safely without maintaining an allowlist. Malformed or failed feature discovery still prevents the task from starting.

Verified with protocol tests, the current CLI feature set, and a real isolated Codex analysis.