@agentconnect.md/codex-acp 1.10.0-agentconnect.1 → 1.10.0-agentconnect.2

package/dist/index.js

@@ -25641,14 +25641,16 @@ function unique(values) {
 
 // src/permissions/CodexApprovalHandler.ts
 var CodexApprovalHandler = class {
-  constructor(connection, permissionContext, cancellationSignal) {
+  constructor(connection, permissionContext, cancellationSignal, denyRequests) {
     this.connection = connection;
     this.permissionContext = permissionContext;
     this.cancellationSignal = cancellationSignal;
+    this.denyRequests = denyRequests;
   }
   connection;
   permissionContext;
   cancellationSignal;
+  denyRequests;
   async handleCommandExecution(params) {
     const authoritativeParams = params;
     const decisions = commandDecisionOptions(authoritativeParams);
@@ -25707,6 +25709,7 @@ var CodexApprovalHandler = class {
     }
   }
   requestPermission(request) {
+    if (this.denyRequests?.()) return Promise.resolve({ outcome: { outcome: "cancelled" } });
     return this.connection.request(
       methods.client.session.requestPermission,
       request,
@@ -26099,31 +26102,20 @@ function userInputResponseValue(content, fieldId) {
   return value;
 }
 var CodexElicitationHandler = class {
-  connection;
-  permissionContext;
-  clientCapabilities;
-  cancellationSignal;
-  // In Rust, the MCP elicitation handler receives ElicitationRequestEvent directly from the MCP
-  // protocol layer, where id is set to "mcp_tool_call_approval_<call_id>" — the call ID is extracted
-  // by stripping that prefix.
-  //
-  // In TypeScript, Codex speaks the app-server JSON-RPC protocol (v2), where
-  // McpServerElicitationRequestParams omits elicitationId for form mode, so the MCP-level ID never
-  // reaches the client.
-  //
-  // Workaround: before requesting approval, Codex emits an item/started notification with an
-  // mcpToolCall item carrying the call id and server name. The shared permission lifecycle stores
-  // (threadId, serverName) → callId so this request can correlate to the rendered tool call item.
-  //
-  // The app-server handler exposes URL elicitationId, while serverRequest/resolved only exposes
-  // threadId here, so accepted URL elicitations are completed at thread scope.
-  pendingUrlElicitations = /* @__PURE__ */ new Map();
-  constructor(connection, permissionContext, clientCapabilities = null, cancellationSignal) {
+  constructor(connection, permissionContext, clientCapabilities = null, cancellationSignal, fullAccessHttpServers) {
+    this.fullAccessHttpServers = fullAccessHttpServers;
     this.connection = connection;
     this.permissionContext = permissionContext;
     this.clientCapabilities = clientCapabilities;
     this.cancellationSignal = cancellationSignal;
   }
+  fullAccessHttpServers;
+  connection;
+  permissionContext;
+  clientCapabilities;
+  cancellationSignal;
+  // App-server omits form elicitation IDs, so item/started correlates MCP approvals to tool calls.
+  pendingUrlElicitations = /* @__PURE__ */ new Map();
   async handleNotification(notification) {
     switch (notification.method) {
       case "serverRequest/resolved":
@@ -26136,6 +26128,12 @@ var CodexElicitationHandler = class {
   async handleElicitation(params) {
     try {
       const context = this.createMcpElicitationContext(params);
+      const httpServers = this.fullAccessHttpServers?.(params);
+      if (httpServers !== void 0) {
+        const accepted = !this.cancellationSignal?.aborted && params.mode === "form" && context.isToolApproval && context.persistOptions.has("session") && httpServers.has(params.serverName);
+        await this.publishAcceptedMcpToolApproval(params.threadId, context, accepted);
+        return { action: accepted ? "accept" : "cancel", content: accepted ? {} : null, _meta: null };
+      }
       if (this.shouldUseAcpElicitation(params)) {
         const response2 = await this.connection.request(
           methods.client.elicitation.create,
@@ -26181,6 +26179,9 @@ var CodexElicitationHandler = class {
     }
   }
   async handleUserInput(params) {
+    if (this.fullAccessHttpServers?.(params) !== void 0 && params.itemId === `mcp-deps-${params.turnId}` && params.questions.some((question) => question.id === "skill_mcp_dependency_install")) {
+      return { answers: {} };
+    }
     if (!clientSupportsFormElicitation(this.clientCapabilities)) {
       return { answers: {} };
     }
@@ -27329,7 +27330,7 @@ var package_default = {
   publishConfig: {
     access: "public"
   },
-  version: "1.10.0-agentconnect.1",
+  version: "1.10.0-agentconnect.2",
   description: "",
   main: "dist/index.js",
   bin: {
@@ -27897,12 +27898,9 @@ import { createHash } from "node:crypto";
 async function forkSession(request, additionalDirectories, dependencies) {
   await dependencies.refreshSkills(request.cwd, additionalDirectories);
   const lastTurnId = await resolveForkTurnId(request, dependencies.codexClient);
+  const prepared = await dependencies.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers ?? []);
   const response = await dependencies.codexClient.threadFork({
-    config: await dependencies.createSessionConfig(
-      request.cwd,
-      additionalDirectories,
-      request.mcpServers ?? []
-    ),
+    config: prepared.config,
     cwd: request.cwd,
     ...lastTurnId !== void 0 && { lastTurnId },
     modelProvider: await dependencies.getResumeModelProvider(),
@@ -27917,7 +27915,8 @@ async function forkSession(request, additionalDirectories, dependencies) {
     collaborationMode: dependencies.getCollaborationMode(response.thread.id),
     modelProvider: response.modelProvider,
     currentServiceTier: response.serviceTier ?? null,
-    additionalDirectories
+    additionalDirectories,
+    fullAccessHttpMcpServers: prepared.fullAccessHttpMcpServers
   };
 }
 async function resolveForkTurnId(request, codexClient) {
@@ -28378,8 +28377,10 @@ var CodexAcpClient = class {
     const additionalDirectories = readAdditionalDirectories(request.cwd, request.additionalDirectories, request._meta);
     const initialAgentMode = AgentMode.getInitialAgentMode();
     await this.refreshSkills(request.cwd, additionalDirectories);
+    const prepared = await this.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers ?? []);
+    await this.restrictResumedHttpMcpServers(request.sessionId, prepared);
     const response = await this.codexClient.threadResume({
-      config: await this.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers ?? []),
+      config: prepared.config,
       cwd: request.cwd,
       modelProvider: await this.getResumeModelProvider(),
       threadId: request.sessionId,
@@ -28395,7 +28396,8 @@ var CodexAcpClient = class {
       collaborationMode: this.getCollaborationMode(response.thread.id),
       modelProvider: response.modelProvider,
       currentServiceTier: response.serviceTier ?? null,
-      additionalDirectories
+      additionalDirectories,
+      fullAccessHttpMcpServers: prepared.fullAccessHttpMcpServers
     };
   }
   async forkSession(request) {
@@ -28414,8 +28416,10 @@ var CodexAcpClient = class {
     const additionalDirectories = readAdditionalDirectories(request.cwd, request.additionalDirectories, request._meta);
     const initialAgentMode = AgentMode.getInitialAgentMode();
     await this.refreshSkills(request.cwd, additionalDirectories);
+    const prepared = await this.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers ?? []);
+    await this.restrictResumedHttpMcpServers(request.sessionId, prepared);
     const response = await this.codexClient.threadResume({
-      config: await this.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers ?? []),
+      config: prepared.config,
       cwd: request.cwd,
       modelProvider: await this.getResumeModelProvider(),
       threadId: request.sessionId,
@@ -28436,7 +28440,8 @@ var CodexAcpClient = class {
       modelProvider: response.modelProvider,
       currentServiceTier: response.serviceTier ?? null,
       thread: historyResponse.thread,
-      additionalDirectories
+      additionalDirectories,
+      fullAccessHttpMcpServers: prepared.fullAccessHttpMcpServers
     };
   }
   async readSessionThread(sessionId) {
@@ -28449,8 +28454,9 @@ var CodexAcpClient = class {
     const additionalDirectories = readAdditionalDirectories(request.cwd, request.additionalDirectories, request._meta);
     const initialAgentMode = AgentMode.getInitialAgentMode();
     await this.refreshSkills(request.cwd, additionalDirectories);
+    const prepared = await this.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers);
     const response = await this.codexClient.threadStart({
-      config: await this.createSessionConfig(request.cwd, additionalDirectories, request.mcpServers),
+      config: prepared.config,
       modelProvider: this.getModelProvider(),
       cwd: request.cwd,
       ...this.permissionProfileSelection(initialAgentMode, request.cwd, additionalDirectories)
@@ -28467,7 +28473,8 @@ var CodexAcpClient = class {
       collaborationMode: this.getCollaborationMode(response.thread.id),
       modelProvider: response.modelProvider,
       currentServiceTier: response.serviceTier ?? null,
-      additionalDirectories
+      additionalDirectories,
+      fullAccessHttpMcpServers: prepared.fullAccessHttpMcpServers
     };
   }
   async closeSession(sessionId) {
@@ -28482,11 +28489,23 @@ var CodexAcpClient = class {
     const config2 = this.permissionProfileConfig;
     if (!config2) return {};
     return {
-      approvalPolicy: agentMode.approvalPolicy,
+      approvalPolicy: this.approvalPolicyForMode(agentMode),
       permissions: permissionProfileForMode(config2, agentMode.id),
       runtimeWorkspaceRoots: sessionRoots(cwd, additionalDirectories)
     };
   }
+  isProtectedFullAccess(agentMode) {
+    return this.permissionProfileConfig !== void 0 && agentMode.kind === "full_access";
+  }
+  approvalPolicyForMode(agentMode) {
+    if (!this.isProtectedFullAccess(agentMode)) return agentMode.approvalPolicy;
+    return { granular: { sandbox_approval: false, rules: false, skill_approval: false, request_permissions: false, mcp_elicitations: false } };
+  }
+  async restrictResumedHttpMcpServers(sessionId, prepared) {
+    if (prepared.fullAccessHttpMcpServers.length === 0) return;
+    const loaded = await this.codexClient.threadLoadedList({});
+    if (loaded.data.includes(sessionId) || loaded.nextCursor !== null) prepared.fullAccessHttpMcpServers = [];
+  }
   async deleteSession(sessionId) {
     await this.codexClient.threadArchive({ threadId: sessionId });
   }
@@ -28571,23 +28590,25 @@ var CodexAcpClient = class {
     };
     const configWithWorkspaceRoots = mergeSandboxWorkspaceWriteRoots(mergedConfig, additionalDirectories);
     if (mcpServers.length === 0) {
-      return configWithWorkspaceRoots;
+      return { config: configWithWorkspaceRoots, fullAccessHttpMcpServers: [] };
     }
     const requestedServers = mcpServers.map((mcp) => ({
       name: sanitizeMcpServerName(mcp.name),
       server: mcp
     }));
     let serversToConfigure = requestedServers;
+    const existingNames = shouldDeduplicateMcpConflicts() || this.permissionProfileConfig ? await this.getConfigMcpServerNames(projectPath) : /* @__PURE__ */ new Set();
     if (shouldDeduplicateMcpConflicts()) {
-      const existingNames = await this.getConfigMcpServerNames(projectPath);
       serversToConfigure = requestedServers.filter((mcp) => !existingNames.has(mcp.name));
     }
     if (serversToConfigure.length === 0) {
-      return configWithWorkspaceRoots;
+      return { config: configWithWorkspaceRoots, fullAccessHttpMcpServers: [] };
     }
+    const configuredServers = Object.fromEntries(serversToConfigure.map((mcp) => [mcp.name, this.createMcpSeverConfig(mcp.server)]));
+    const inheritedServers = isJsonObject(this.config["mcp_servers"]) ? this.config["mcp_servers"] : {};
     return {
-      ...configWithWorkspaceRoots,
-      "mcp_servers": Object.fromEntries(serversToConfigure.map((mcp) => [mcp.name, this.createMcpSeverConfig(mcp.server)]))
+      config: { ...configWithWorkspaceRoots, mcp_servers: configuredServers },
+      fullAccessHttpMcpServers: this.permissionProfileConfig ? Object.entries(configuredServers).filter(([name, server]) => typeof server["url"] === "string" && !existingNames.has(name) && !Object.hasOwn(inheritedServers, name)).map(([name]) => name) : []
     };
   }
   async getConfigMcpServerNames(projectPath) {
@@ -28720,7 +28741,7 @@ var CodexAcpClient = class {
     return await this.codexClient.runTurn({
       threadId: request.sessionId,
       input,
-      approvalPolicy: agentMode.approvalPolicy,
+      approvalPolicy: this.approvalPolicyForMode(agentMode),
       approvalsReviewer: agentMode.approvalsReviewer,
       ...sandboxSelection,
       summary: disableSummary ? "none" : "auto",
@@ -28828,7 +28849,7 @@ var CodexAcpClient = class {
     if (!config2) return;
     await this.codexClient.threadSettingsUpdate({
       threadId: sessionId,
-      approvalPolicy: agentMode.approvalPolicy,
+      approvalPolicy: this.approvalPolicyForMode(agentMode),
       permissions: permissionProfileForMode(config2, agentMode.id)
     });
   }
@@ -32594,6 +32615,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
       supportedReasoningEfforts: currentModel?.supportedReasoningEfforts ?? [],
       supportedInputModalities: currentModel?.inputModalities ?? ["text", "image"],
       agentMode: AgentMode.getInitialAgentMode(),
+      fullAccessHttpMcpServers: sessionMetadata.fullAccessHttpMcpServers ?? [],
       collaborationMode: sessionMetadata.collaborationMode,
       currentTurnId: null,
       lastTokenUsage: null,
@@ -32927,12 +32949,13 @@ Check ${configPath} and project .codex directories, especially their config.toml
       for (const session of this.sessions.values()) {
         session.asyncTasks.setAppServer(replacement.appServerClient);
         try {
-          await replacement.resumeSession({
+          const metadata = await replacement.resumeSession({
             sessionId: session.sessionId,
             cwd: session.cwd,
             additionalDirectories: session.additionalDirectories,
             mcpServers: session.mcpServers ?? []
           });
+          session.fullAccessHttpMcpServers = metadata.fullAccessHttpMcpServers ?? [];
           session.authProvider = replacement.getModelProvider();
           session.asyncTasks.refresh();
           logger.log("Resumed session after provider restart", { sessionId: session.sessionId });
@@ -33220,6 +33243,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
     if (!newMode) {
       throw RequestError.invalidParams();
     }
+    sessionState.permissionModeRevision = (sessionState.permissionModeRevision ?? 0) + 1;
     await this.codexAcpClient.setAgentMode(
       sessionState.sessionId,
       newMode
@@ -33656,6 +33680,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
       supportedReasoningEfforts: currentModel?.supportedReasoningEfforts ?? [],
       supportedInputModalities: currentModel?.inputModalities ?? ["text", "image"],
       agentMode: AgentMode.getInitialAgentMode(),
+      fullAccessHttpMcpServers: sessionMetadata.fullAccessHttpMcpServers ?? [],
       collaborationMode: sessionMetadata.collaborationMode,
       currentTurnId: null,
       lastTokenUsage: null,
@@ -34400,16 +34425,27 @@ Check ${configPath} and project .codex directories, especially their config.toml
       eventHandler = promptEventHandler;
       const permissionLifecycle = this.permissionLifecycleContext(sessionState);
       const permissionContext = permissionLifecycle.beginPrompt();
+      let promptAgentMode;
+      let permissionModeRevision;
+      const httpServers = new Set(sessionState.fullAccessHttpMcpServers);
+      const noHttpServers = /* @__PURE__ */ new Set();
+      let mcpApprovalTurnId = null;
+      const isProtectedFullAccess = () => this.codexAcpClient.isProtectedFullAccess(promptAgentMode ?? sessionState.agentMode);
       const approvalHandler = new CodexApprovalHandler(
         this.connection,
         permissionContext,
-        activePrompt.signal
+        activePrompt.signal,
+        isProtectedFullAccess
       );
       const elicitationHandler = new CodexElicitationHandler(
         this.connection,
         permissionContext,
         this.clientCapabilities,
-        activePrompt.signal
+        activePrompt.signal,
+        (request) => {
+          if (!isProtectedFullAccess()) return void 0;
+          return mcpApprovalTurnId !== null && request.turnId === mcpApprovalTurnId && sessionState.agentMode.kind === "full_access" && sessionState.permissionModeRevision === permissionModeRevision ? httpServers : noHttpServers;
+        }
       );
       const observeInteraction = async (event) => {
         permissionContext.handleNotification(event);
@@ -34534,6 +34570,8 @@ Check ${configPath} and project .codex directories, especially their config.toml
         throw RequestError.invalidRequest("The current model does not support image input");
       }
       const agentMode = sessionState.agentMode;
+      promptAgentMode = agentMode;
+      permissionModeRevision = sessionState.permissionModeRevision;
       const serviceTier = resolveFastServiceTier(
         sessionState.fastModeEnabled,
         sessionState.currentModelSupportsFast
@@ -34550,6 +34588,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
           sessionState.cwd,
           sessionState.additionalDirectories,
           (turnId) => {
+            mcpApprovalTurnId = turnId;
             const turn = { threadId: params.sessionId, turnId };
             activePrompt.currentTurn = turn;
             if (this.promptShouldStop(params.sessionId, activePrompt)) {
@@ -34560,7 +34599,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
             pendingTurnStart?.resolve(turnId);
             onTurnStarted?.();
           },
-          () => this.promptShouldStop(params.sessionId, activePrompt)
+          () => this.promptShouldStop(params.sessionId, activePrompt) || sessionState.permissionModeRevision !== permissionModeRevision
         )
       );
       void sendPromptPromise.catch((err) => {
@@ -34640,6 +34679,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
               sessionState.cwd,
               sessionState.additionalDirectories,
               (turnId) => {
+                mcpApprovalTurnId = turnId;
                 const turn = { threadId: params.sessionId, turnId };
                 activePrompt.currentTurn = turn;
                 if (this.promptShouldStop(params.sessionId, activePrompt)) {
@@ -34650,7 +34690,7 @@ Check ${configPath} and project .codex directories, especially their config.toml
                 recoverableSessionFailure = sessionState.sessionFailure;
                 promptNotificationsActive = true;
               },
-              () => this.promptShouldStop(params.sessionId, activePrompt)
+              () => this.promptShouldStop(params.sessionId, activePrompt) || sessionState.permissionModeRevision !== permissionModeRevision
             )
           );
           void implementationPromise.catch((err) => {

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.10.0-agentconnect.1",
+  "version": "1.10.0-agentconnect.2",
   "description": "",
   "main": "dist/index.js",
   "bin": {