fix(timeline): honor deployment codex sandbox

Author: AnkushMalaker

backends/advanced/src/advanced_omi_backend/services/timeline/codex_executor.py

@@ -48,6 +48,7 @@ async def analyze(
         available, detail = codex_executor_available()
         if not available:
             raise RuntimeError(detail)
+        sandbox_mode = str(self.settings.get("sandbox_mode") or "workspace-write")
         schema_path = workspace / "output-schema.json"
         output_path = workspace / "timeline-result.json"
         schema_path.write_text(json.dumps(OUTPUT_SCHEMA), encoding="utf-8")
@@ -65,7 +66,7 @@ async def analyze(
             "--color",
             "never",
             "--sandbox",
-            "workspace-write",
+            sandbox_mode,
             "--cd",
             str(workspace),
             "--output-schema",

config/defaults.yml

@@ -910,6 +910,10 @@ timeline:
   codex:
     model: null
     reasoning_effort: medium
+    # Reuse the memory agent's container-aware sandbox choice. Rootless Podman
+    # deployments set that to danger-full-access because the container itself is
+    # the isolation boundary and nested bubblewrap cannot start there.
+    sandbox_mode: ${memory.codex.sandbox_mode}
     timeout_seconds: 1800
     max_used_percent: 80
     retry_hours: 6