@bill10/agent-007 0.12.1001 → 0.12.2000

package/VERSION

@@ -1 +1 @@
-0.12.1.1
+0.12.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bill10/agent-007",
-  "version": "0.12.1001",
+  "version": "0.12.2000",
   "description": "From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.",
   "license": "MIT",
   "repository": {

package/server/agent-mcp.js

@@ -91,6 +91,10 @@ export function writeMcpConfig(sessionId, agentToken) {
 // server/permission-hook.js with this session's MCP config. Claude Code only;
 // Codex takes its hook differently and is not wired yet (docs/BILLION.md).
 const PERMISSION_HOOK = fileURLToPath(new URL('./permission-hook.js', import.meta.url));
+// The two board tools the job prompt tells a worker on Billion's card to use:
+// finishing its card, and asking Billion. Asking permission for those would
+// only send Billion (or the owner) a request to approve its own instructions.
+export const WORKER_BOARD_TOOLS = ['finish_job', 'send_message'];
 const shellQuote = (s) => `"${String(s).replace(/(["\\$`])/g, '\\$1')}"`;
 // Forward slashes on Windows, which node takes as well: a backslash means
 // something different to each shell a hook might run under (doubled by the
@@ -99,10 +103,7 @@ export const hookPath = (p, platform = process.platform) => (platform === 'win32
 export function withApprovalHook(file, args, configPath) {
   if (!configPath || agentName(file) !== 'claude' || args.includes('--settings')) return args;
   const settings = {
-    // The two board tools the job prompt tells the worker to use: finishing
-    // its card, and asking Billion. Asking permission for those would only
-    // send Billion a request to approve its own instructions.
-    permissions: { allow: ['finish_job', 'send_message'].map(tool => `mcp__${MCP_SERVER_NAME}__${tool}`) },
+    permissions: { allow: WORKER_BOARD_TOOLS.map(tool => `mcp__${MCP_SERVER_NAME}__${tool}`) },
     hooks: {
       PermissionRequest: [{
         matcher: '*',
@@ -113,6 +114,18 @@ export function withApprovalHook(file, args, configPath) {
   return ['--settings', JSON.stringify(settings), ...args];
 }
 
+// The Codex side of the same pre-allow: per-run -c overrides, one separate argv
+// element each, so ~/.codex/config.toml is never touched. Only these tools;
+// everything else on the server keeps Codex's default (ask). Must come after
+// withMcpConfig's server table on the command line, which replaces the table.
+export function withCodexWorkerTools(file, args, configPath) {
+  if (!configPath || agentName(file) !== 'codex') return args;
+  return [
+    ...WORKER_BOARD_TOOLS.flatMap(tool => ['-c', `mcp_servers.${MCP_SERVER_NAME}.tools.${tool}.approval_mode="approve"`]),
+    ...args,
+  ];
+}
+
 export function removeMcpConfig(sessionId) {
   try {
     rmSync(mcpConfigPath(sessionId), { force: true });

package/server/pty.js

@@ -10,7 +10,7 @@ export { trackSyncFrames } from '../lib/helpers.js';
 import { resolveExecutable, isUsableCwd, commandExists, missingCommandMessage } from './command-path.js';
 import { RING_BUFFER_MAX } from './state.js';
 import { mintAgentToken, authEnabled } from './auth.js';
-import { writeMcpConfig, removeMcpConfig, withMcpConfig, takesMcpConfig, withApprovalHook } from './agent-mcp.js';
+import { writeMcpConfig, removeMcpConfig, withMcpConfig, takesMcpConfig, withApprovalHook, withCodexWorkerTools } from './agent-mcp.js';
 import { broadcastJobs, requestDispatch } from './jobs.js';
 import { flushMessages, dropMessages } from './messages.js';
 import { sessionAgentFromCommand, permissionFlagsFromCommand } from '../lib/jobs.js';
@@ -244,7 +244,11 @@ export function createSessionFromConfig({ sessionId, name, color, command, repoP
   // use it — a plain `bash` tab does not need one.
   const mcpConfigPath = takesMcpConfig(file) ? writeMcpConfig(sessionId, agentToken) : null;
   const codexTrust = autoTrust && sessionAgentFromCommand(command) === 'codex';
-  const mcpArgs = withMcpConfig(file, codexTrust ? [...codexTrustArgs(worktreePath), ...args] : args, mcpConfigPath);
+  const ownArgs = codexTrust ? [...codexTrustArgs(worktreePath), ...args] : args;
+  // Codex has no hook yet, but its worker on Billion's card still gets the
+  // same board tools pre-allowed. Inside withMcpConfig, whose server table
+  // override would otherwise replace them.
+  const mcpArgs = withMcpConfig(file, approvalsToBillion ? withCodexWorkerTools(file, ownArgs, mcpConfigPath) : ownArgs, mcpConfigPath);
   // A worker on one of Billion's cards asks Billion before it asks a person
   // (server/approvals.js) — where the CLI can be hooked, which today is
   // Claude Code only. Recorded as whether the hook actually went in.