Add config-driven external approval handling in core, surface handler failures in the TUI, and share thread labels across core and TUI.
Check in the macOS approval dialog helper under scripts/, document the config path, and fix handler stdin delivery by dropping the child stdin handle after writes so EOF reaches the helper promptly.
Co-authored-by: Codex <noreply@openai.com>
