@bridge_gpt/mcp-server 0.2.56 → 0.2.57

package/README.md

@@ -242,6 +242,20 @@ npx -y @bridge_gpt/mcp-server doctor
 `doctor` is strictly read-only. It reports what it found — configs, registrations,
 credential availability, prerequisites — and changes nothing.
 
+**Codex approval profile.** When selecting Codex during `install`, opt in at the
+prompt or pass `--tools=codex --codex-profile=on` in a scripted install. Bridge
+creates `$CODEX_HOME/bridge.config.toml` (default `~/.codex/bridge.config.toml`)
+with approval settings for the tools used by its review and implementation
+workflows. Bridge-spawned Codex workers then select it automatically, including
+the fresh implementation session after review. Pass `--codex-profile=off` to
+decline; the installer leaves any existing profile content intact. If a profile
+already contains user-authored or conflicting content, the installer leaves it
+untouched and reports that workers cannot use it. Run `doctor --agent codex` to
+inspect the current status. To use the profile in a Codex session you open
+yourself, run `codex --profile bridge`. Bridge `--auto` controls recipe gates;
+Codex MCP tool approvals are a separate setting. The profile does not change
+global `sandbox_mode` or `approval_policy`.
+
 </details>
 
 <details>
@@ -351,7 +365,7 @@ later boot.
   "mcpServers": {
     "bridge": {
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.57", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -373,7 +387,7 @@ later boot.
     "bridge": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.57", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -395,7 +409,7 @@ later boot.
     "bridge": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.57", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -418,7 +432,7 @@ Windsurf only supports global MCP configuration.
   "mcpServers": {
     "bridge": {
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.57", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -437,7 +451,7 @@ Windsurf only supports global MCP configuration.
 ```toml
 [mcp_servers.bridge]
 command = "npx"
-args = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"]
+args = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.57", "serve"]
 
 [mcp_servers.bridge.env]
 BAPI_BASE_URL = "https://bridgegpt-api.com"

package/build/codex-bridge-profile.js

@@ -0,0 +1,151 @@
+/** Secret-free, opt-in approval settings for Bridge-spawned Codex workers. */
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { codexBridgeTableNames } from "./mcp-host-config.js";
+import { MCP_SERVER_NAME } from "./mcp-identity.js";
+export { codexHome } from "./codex-home.js";
+export const BRIDGE_CODEX_PROFILE = "bridge";
+const PROFILE_FILE = "bridge.config.toml";
+const STATE_FILE = "bridge.profile-state.json";
+const MARKER = "# Bridge-managed Codex approval profile (BAPI-1214)";
+/** Tools called by review-and-start, review-and-implement, and implement-ticket. */
+export const BRIDGE_WORKFLOW_TOOLS = [
+    "ping", "get_ticket", "get_pipeline_recipe", "request_ticket_review",
+    "wait_for_ticket_review", "fresh_base", "generate_decision_page",
+    "capture_review_decisions", "request_plan_generation", "get_plan",
+    "get_phase_context", "record_phase_result", "create_pull_request",
+    "update_jira_status", "config_field", "resolve_ci_checks", "poll_ci_checks",
+    "wait_for_ci_checks",
+];
+export function codexProfilePaths(home) {
+    return {
+        profile: path.join(home, PROFILE_FILE),
+        state: path.join(home, STATE_FILE),
+        config: path.join(home, "config.toml"),
+    };
+}
+export function renderBridgeCodexProfile(key) {
+    return [
+        MARKER,
+        `# Applies only when selected with codex --profile ${BRIDGE_CODEX_PROFILE}.`,
+        ...BRIDGE_WORKFLOW_TOOLS.flatMap((tool) => [
+            `[mcp_servers.${key}.tools.${tool}]`,
+            'approval_mode = "auto"',
+            "",
+        ]),
+    ].join("\n") + "\n";
+}
+function fingerprint(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+async function optionalRead(readFile, filePath) {
+    try {
+        return await readFile(filePath);
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? null : undefined;
+    }
+}
+/** Only a matching managed file and explicit enabled state can activate workers. */
+export async function inspectBridgeCodexProfile(home, readFile) {
+    const paths = codexProfilePaths(home);
+    const [config, profile, state] = await Promise.all([
+        optionalRead(readFile, paths.config),
+        optionalRead(readFile, paths.profile),
+        optionalRead(readFile, paths.state),
+    ]);
+    if (config === undefined || profile === undefined || state === undefined)
+        return { status: "unreadable" };
+    const names = codexBridgeTableNames(config ?? "");
+    if (names.length > 1)
+        return { status: "conflict" };
+    const key = names[0] ?? MCP_SERVER_NAME;
+    if (state === null)
+        return { status: profile === null ? "missing" : "conflict", key };
+    let parsed;
+    try {
+        parsed = JSON.parse(state);
+    }
+    catch {
+        return { status: "conflict", key };
+    }
+    if (!parsed || typeof parsed !== "object" || !("enabled" in parsed) || typeof parsed.enabled !== "boolean") {
+        return { status: "conflict", key };
+    }
+    if (!parsed.enabled)
+        return { status: "declined", key };
+    if (profile === null || !("hash" in parsed) || typeof parsed.hash !== "string")
+        return { status: "conflict", key };
+    if (profile !== renderBridgeCodexProfile(key) || fingerprint(profile) !== parsed.hash)
+        return { status: "conflict", key };
+    return { status: "active", key };
+}
+export async function configureBridgeCodexProfile(home, choice, deps) {
+    const paths = codexProfilePaths(home);
+    const current = await inspectBridgeCodexProfile(home, deps.readFile);
+    if (choice === "decline") {
+        const oldState = await optionalRead(deps.readFile, paths.state);
+        if (oldState === undefined)
+            return { status: "unreadable" };
+        let existingHash;
+        if (oldState !== null) {
+            try {
+                const parsed = JSON.parse(oldState);
+                if (!parsed || typeof parsed.enabled !== "boolean")
+                    return { status: "conflict" };
+                if (typeof parsed.hash === "string")
+                    existingHash = parsed.hash;
+            }
+            catch {
+                return { status: "conflict" };
+            }
+        }
+        await deps.mkdir(home, { recursive: true });
+        await deps.writeFile(paths.state, JSON.stringify({ enabled: false, ...(existingHash ? { hash: existingHash } : {}) }) + "\n");
+        return { status: "declined", key: current.key };
+    }
+    if (current.status === "unreadable")
+        return current;
+    const config = await optionalRead(deps.readFile, paths.config);
+    if (config === undefined)
+        return { status: "unreadable" };
+    const names = codexBridgeTableNames(config ?? "");
+    if (names.length > 1)
+        return { status: "conflict" };
+    const key = names[0] ?? MCP_SERVER_NAME;
+    const existing = await optionalRead(deps.readFile, paths.profile);
+    const oldState = await optionalRead(deps.readFile, paths.state);
+    const desired = renderBridgeCodexProfile(key);
+    if (existing === undefined || oldState === undefined)
+        return { status: "unreadable", key };
+    if (oldState !== null) {
+        try {
+            const parsed = JSON.parse(oldState);
+            if (!parsed || typeof parsed.enabled !== "boolean" ||
+                (parsed.enabled && (typeof parsed.hash !== "string" || existing === null || parsed.hash !== fingerprint(existing)))) {
+                return { status: "conflict", key };
+            }
+        }
+        catch {
+            return { status: "conflict", key };
+        }
+    }
+    // Existing user content is never modified or implicitly adopted.
+    if (existing !== null && existing !== desired) {
+        let managed = false;
+        if (oldState !== null && existing.startsWith(MARKER)) {
+            try {
+                const parsed = JSON.parse(oldState);
+                managed = typeof parsed?.enabled === "boolean" && parsed?.hash === fingerprint(existing);
+            }
+            catch { /* malformed state cannot authorize a rewrite */ }
+        }
+        if (!managed)
+            return { status: "conflict", key };
+    }
+    await deps.mkdir(home, { recursive: true });
+    if (existing !== desired)
+        await deps.writeFile(paths.profile, desired);
+    await deps.writeFile(paths.state, JSON.stringify({ enabled: true, hash: fingerprint(desired) }) + "\n");
+    return { status: "active", key };
+}

package/build/codex-home.js

@@ -0,0 +1,7 @@
+import path from "node:path";
+import os from "node:os";
+/** Codex's user config root; only an absolute CODEX_HOME is accepted. */
+export function codexHome(env, homedir = os.homedir()) {
+    const override = env.CODEX_HOME?.trim();
+    return override && path.isAbsolute(override) ? override : path.join(homedir, ".codex");
+}

package/build/codex-launch-scope.js

@@ -1,15 +1,12 @@
 /** Per-process Codex MCP scope, derived from the same manifest and shim as worktree provisioning. */
 import { readBridgeConfig } from "./bridge-config.js";
-import os from "node:os";
 import { codexBridgeTableNames } from "./mcp-host-config.js";
-import { MCP_HOST_TARGETS, resolveHostTargetPath } from "./mcp-host-targets.js";
+import { codexHome } from "./codex-home.js";
+import { codexProfilePaths, inspectBridgeCodexProfile, BRIDGE_CODEX_PROFILE } from "./codex-bridge-profile.js";
 import { buildMcpServerEntriesForManifest, normalizeWorktreePathForRegistration, } from "./mcp-provisioning.js";
 import { MCP_SERVER_NAME } from "./mcp-identity.js";
-function tomlEntry(entry) {
-    return `{ command = ${JSON.stringify(entry.command)}, args = [${entry.args.map((arg) => JSON.stringify(arg)).join(", ")}] }`;
-}
 /** A missing Bridge target is a launch failure, never a fallback to user-scoped config. */
-export async function resolveCodexLaunchScope(root, deps, codexConfigPath = resolveHostTargetPath(MCP_HOST_TARGETS.codex, { cwd: root, homedir: os.homedir() })) {
+export async function resolveCodexLaunchScope(root, deps, codexConfigPath = codexProfilePaths(codexHome(deps.env ?? process.env, deps.homedir?.())).config) {
     const normalized = normalizeWorktreePathForRegistration(root, deps);
     if (!normalized.ok)
         return { ok: false, error: "Codex MCP scope unavailable: invalid repository path." };
@@ -41,9 +38,17 @@ export async function resolveCodexLaunchScope(root, deps, codexConfigPath = reso
         return { ok: false, error: "Codex MCP scope unavailable: duplicate Bridge registrations in Codex host config." };
     }
     const bridgeKey = registeredNames[0] ?? MCP_SERVER_NAME;
+    const home = codexHome(deps.env ?? process.env, deps.homedir?.());
+    const profile = await inspectBridgeCodexProfile(home, deps.readFile);
     const argv = ["-C", normalized.path];
+    if (profile.status === "active" && profile.key === bridgeKey)
+        argv.push("--profile", BRIDGE_CODEX_PROFILE);
     for (const [name, entry] of Object.entries(built.entries)) {
-        argv.push("-c", `mcp_servers.${name === MCP_SERVER_NAME ? bridgeKey : name}=${tomlEntry(entry)}`);
+        const key = name === MCP_SERVER_NAME ? bridgeKey : name;
+        // Field-level overrides retain the profile's mcp_servers.<key>.tools policy.
+        argv.push("-c", `mcp_servers.${key}.command=${JSON.stringify(entry.command)}`);
+        argv.push("-c", `mcp_servers.${key}.args=${JSON.stringify(entry.args)}`);
+        argv.push("-c", `mcp_servers.${key}.enabled=true`);
     }
     return { ok: true, argv };
 }

package/build/doctor.js

@@ -21,6 +21,7 @@ import path from "path";
 import { createDefaultStartTicketsDeps } from "./start-tickets.js";
 import { VERSION, BUILD_COMMIT } from "./version.generated.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, formatInstallStatusFallbackReport, resolveInstallDoctorTarget, } from "./install-doctor.js";
+import { codexHome, inspectBridgeCodexProfile } from "./codex-bridge-profile.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "./agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "./agent-launchers/executor-adapter-registry.js";
 import { parseDefaultOnEnvFlag } from "./env-flags.js";
@@ -1743,7 +1744,11 @@ export async function runDoctorCli(argv, overrides = {}) {
         }
     }
     if (parsed.options.agentName === "codex") {
-        log("Codex is not yet supported for start-tickets sessions: its Bridge MCP registration cannot be scoped to each worktree. The prerequisite checks below do not imply launch support.");
+        const readCodexFile = deps.readFile ?? ((p) => readFile(p, "utf-8"));
+        const profile = await inspectBridgeCodexProfile(codexHome(deps.env), readCodexFile);
+        log(profile.status === "active"
+            ? "Codex Bridge approval profile installed; spawned workers use --profile bridge."
+            : `Codex Bridge approval profile ${profile.status}; spawned workers use existing Codex approvals. Run install --tools=codex --codex-profile=on to opt in.`);
     }
     log(formatDoctorPrereqSection(deps.platform, collection));
     // Executor-adapter section (BAPI-781). Advisory with respect to the EXIT CODE