Codex 0.144.1 --strict-config rejects app-managed projects.<path>.sandbox_mode

Environment

• Codex Desktop on Windows
• codex-cli 0.144.1
• ChatGPT authentication

Issue

Codex Desktop's existing global config.toml contains app-managed per-project entries of the form:

[projects."<redacted-project-path>"]
sandbox_mode = "..."

Normal Codex and app-server startup accept the config. Starting app-server with strict validation fails before binding:

Error: ~/.codex/config.toml:<line>:1: unknown configuration field
`projects.<redacted-project-path>.sandbox_mode`

Reproduction:

codex app-server --strict-config --listen ws://127.0.0.1:4510

Removing --strict-config starts app-server successfully. I did not delete or rewrite the project entry because it is existing Codex Desktop state, not application config owned by the integration being tested.

Expected behavior

One of these should hold:

1. --strict-config accepts every field the current official Codex Desktop writes or preserves.
2. Codex migrates/removes obsolete app-managed fields before strict validation.
3. The diagnostic identifies an obsolete official field and provides a safe migration command.

Strict validation should not fail on state/config produced by another current surface of the same product.

Why it matters

App-server integrations need strict validation to catch misspelled provider/auth settings. They currently have to disable strict mode because unrelated Desktop-managed project entries fail the whole config.