fix(cli): support legacy use_linux_sandbox_bwrap flag (#14473)

## Summary
- restore `use_linux_sandbox_bwrap` as a removed feature key so older
`--enable` callers parse again
- keep it as a no-op by leaving runtime behavior unchanged
- add regression coverage for the legacy `--enable` path

## Testing
- Not run (updated and pushed quickly)

codex-rs/cli/src/main.rs

@@ -1516,6 +1516,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn feature_toggles_accept_legacy_linux_sandbox_flag() {
+        let toggles = FeatureToggles {
+            enable: vec!["use_linux_sandbox_bwrap".to_string()],
+            disable: Vec::new(),
+        };
+        let overrides = toggles.to_overrides().expect("valid features");
+        assert_eq!(
+            overrides,
+            vec!["features.use_linux_sandbox_bwrap=true".to_string(),]
+        );
+    }
+
     #[test]
     fn feature_toggles_unknown_feature_errors() {
         let toggles = FeatureToggles {

codex-rs/core/config.schema.json

@@ -483,6 +483,9 @@
             "use_legacy_landlock": {
               "type": "boolean"
             },
+            "use_linux_sandbox_bwrap": {
+              "type": "boolean"
+            },
             "voice_transcription": {
               "type": "boolean"
             },
@@ -1988,6 +1991,9 @@
         "use_legacy_landlock": {
           "type": "boolean"
         },
+        "use_linux_sandbox_bwrap": {
+          "type": "boolean"
+        },
         "voice_transcription": {
           "type": "boolean"
         },

codex-rs/core/src/features.rs

@@ -108,6 +108,9 @@ pub enum Feature {
     WebSearchCached,
     /// Legacy search-tool feature flag kept for backward compatibility.
     SearchTool,
+    /// Removed legacy Linux bubblewrap opt-in flag retained as a no-op so old
+    /// wrappers and config can still parse it.
+    UseLinuxSandboxBwrap,
     /// Use the legacy Landlock Linux sandbox fallback instead of the default
     /// bubblewrap pipeline.
     UseLegacyLandlock,
@@ -640,6 +643,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::UnderDevelopment,
         default_enabled: false,
     },
+    FeatureSpec {
+        id: Feature::UseLinuxSandboxBwrap,
+        key: "use_linux_sandbox_bwrap",
+        stage: Stage::Removed,
+        default_enabled: false,
+    },
     FeatureSpec {
         id: Feature::UseLegacyLandlock,
         key: "use_legacy_landlock",

codex-rs/core/src/features_tests.rs

@@ -35,6 +35,12 @@ fn use_legacy_landlock_is_stable_and_disabled_by_default() {
     assert_eq!(Feature::UseLegacyLandlock.default_enabled(), false);
 }
 
+#[test]
+fn use_linux_sandbox_bwrap_is_removed_and_disabled_by_default() {
+    assert_eq!(Feature::UseLinuxSandboxBwrap.stage(), Stage::Removed);
+    assert_eq!(Feature::UseLinuxSandboxBwrap.default_enabled(), false);
+}
+
 #[test]
 fn js_repl_is_experimental_and_user_toggleable() {
     let spec = Feature::JsRepl.info();
@@ -93,6 +99,18 @@ fn tool_suggest_is_under_development() {
     assert_eq!(Feature::ToolSuggest.default_enabled(), false);
 }
 
+#[test]
+fn use_linux_sandbox_bwrap_is_a_removed_feature_key() {
+    assert_eq!(
+        feature_for_key("use_legacy_landlock"),
+        Some(Feature::UseLegacyLandlock)
+    );
+    assert_eq!(
+        feature_for_key("use_linux_sandbox_bwrap"),
+        Some(Feature::UseLinuxSandboxBwrap)
+    );
+}
+
 #[test]
 fn image_generation_is_under_development() {
     assert_eq!(Feature::ImageGeneration.stage(), Stage::UnderDevelopment);