@byok-sdk/client 0.10.2 → 0.12.0

package/dist/adapters/index.js

@@ -67,6 +67,7 @@ function freezeRuntimeAdapterDescriptor(descriptor) {
   return Object.freeze({
     id: descriptor.id,
     supportsDispatchSelection: descriptor.supportsDispatchSelection === true,
+    requiresMcpToolsetToolObservation: descriptor.requiresMcpToolsetToolObservation === true,
     capabilities: Object.freeze({
       steer: descriptor.capabilities.steer === true,
       resume: descriptor.capabilities.resume === true,
@@ -143,12 +144,21 @@ function resolvePiExtensions() {
   const clientManifest = fileURLToPath(import.meta.resolve("@byok-sdk/client/package.json"));
   return {
     webAccess: fileURLToPath(import.meta.resolve("pi-web-access/index.ts")),
-    mcpAdapter: path5.join(path5.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
+    mcpAdapter: path5.join(path5.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js"),
+    subagentsPolicy: path5.join(path5.dirname(clientManifest), "dist", "adapters", "pi", "subagents-policy-extension.js"),
+    subagents: fileURLToPath(import.meta.resolve("pi-subagents")),
+    // rpiv-todo publishes TypeScript source without a JavaScript `main`, so
+    // select the single authoritative Pi entry declared by its package metadata.
+    todo: fileURLToPath(import.meta.resolve("@juicesharp/rpiv-todo/index.ts"))
   };
 }
 
+// src/adapters/pi/subagents-policy-config.ts
+var BYOK_PI_PERMISSION_MODE = "BYOK_PI_PERMISSION_MODE";
+var BYOK_PI_READONLY_PARENT_TOOLS = ["subagent", "todo"];
+
 // src/adapters/pi/permission-mapping.ts
-var READONLY_TOOLS = ["read", "grep", "find", "ls"];
+var READONLY_TOOLS = ["read", "grep", "find", "ls", ...BYOK_PI_READONLY_PARENT_TOOLS];
 function mapPermissionPolicyToPiArgs(policy) {
   if (policy.network === false) {
     return {
@@ -970,6 +980,11 @@ var PiAdapter = class {
   descriptor = freezeRuntimeAdapterDescriptor({
     id: "pi",
     supportsDispatchSelection: true,
+    // `requiresMcpToolsetToolObservation` is deliberately absent: pi projects
+    // MCP servers through its own adapter extension and grants their tools
+    // itself, so it never reads `mcpToolsetTools`. Declaring the requirement
+    // would make every pi-routed toolset offer wait on a `tools/list` probe of
+    // every projected server for an observation nothing consumes.
     capabilities: {
       steer: true,
       resume: true,
@@ -1067,21 +1082,40 @@ var PiAdapter = class {
           let mcpConfigDir;
           let runtimeEnv = manifestSelection === void 0 ? startInput.env : withoutProviderCredentials(startInput.env);
           const taskMcpServers = startInput.mcpServers ?? {};
-          const hasMcpServers = Object.keys(taskMcpServers).length > 0;
-          if (hasMcpServers) {
+          let mcpConfigPath;
+          try {
             mcpConfigDir = await promises.mkdtemp(path5.join(os.tmpdir(), "byok-pi-mcp-"));
             await promises.chmod(mcpConfigDir, 448).catch(() => {
             });
-            const mcpConfigPath = path5.join(mcpConfigDir, "mcp-config.json");
+            mcpConfigPath = path5.join(mcpConfigDir, "mcp-config.json");
             await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers: taskMcpServers }), { mode: 384 });
-            runtimeEnv = { ...runtimeEnv, [BYOK_PI_MCP_CONFIG_PATH]: mcpConfigPath };
+          } catch (cause) {
+            await cleanupMcpConfigDir(mcpConfigDir);
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "infrastructure",
+              retry: "retryable",
+              reason: "pi task-scoped MCP configuration could not be created"
+            }, { cause });
           }
+          runtimeEnv = {
+            ...runtimeEnv,
+            [BYOK_PI_MCP_CONFIG_PATH]: mcpConfigPath,
+            [BYOK_PI_PERMISSION_MODE]: input.policy.mode
+          };
           const piArgs = [
             "--mode",
             "rpc",
             "--extension",
             extensions.webAccess,
-            ...hasMcpServers ? ["--extension", extensions.mcpAdapter] : [],
+            "--extension",
+            extensions.mcpAdapter,
+            "--extension",
+            extensions.subagentsPolicy,
+            "--extension",
+            extensions.subagents,
+            "--extension",
+            extensions.todo,
             ...resumeSessionId ? ["--session", resumeSessionId] : [],
             ...mapping.args
           ];
@@ -1298,18 +1332,79 @@ function resolveClaudeBin() {
   }
   return { command: "claude", source: "path" };
 }
-function resolveApprovalMcpBin() {
+
+// src/sdk-reserved-mcp.ts
+var AGENT_MESSAGE_MCP_SERVER_NAME = "byokagentmessage";
+var AGENT_MESSAGE_TOOL_NAME = "send_agent_message";
+var AGENT_MEMORY_MCP_SERVER_NAME = "byokagentmemory";
+var AGENT_TEAM_MCP_SERVER_NAME = "byokagentteam";
+var APPROVAL_MCP_SERVER_NAME = "byokapproval";
+var RESERVED_MCP_SERVER_NAMES = Object.freeze([
+  AGENT_MESSAGE_MCP_SERVER_NAME,
+  AGENT_MEMORY_MCP_SERVER_NAME,
+  APPROVAL_MCP_SERVER_NAME,
+  AGENT_TEAM_MCP_SERVER_NAME
+]);
+function isReservedMcpServerName(name) {
+  return RESERVED_MCP_SERVER_NAMES.includes(name);
+}
+var AGENT_MEMORY_RECALL_TOOL_NAME = "memory_recall";
+var AGENT_MEMORY_SAVE_TOOL_NAME = "memory_save";
+var APPROVAL_TOOL_NAME = "approval_prompt";
+
+// src/sdk-reserved-helper-host.ts
+var BYOK_SDK_HELPER_SUBCOMMAND = "__byok_sdk_helper";
+var DIST_SCRIPT_BY_KIND = Object.freeze({
+  "agent-message-mcp": "byok-agent-message-mcp.js",
+  "agent-memory-mcp": "byok-agent-memory-mcp.js",
+  "approval-mcp": "byok-approval-mcp.js",
+  "agent-team-mcp": "byok-agent-team-mcp.js"
+});
+function assertExecutable(executable) {
+  if (!path5.isAbsolute(executable) || /[\u0000\r\n]/u.test(executable)) {
+    throw new Error("SdkHelperHostConfig.executable must be an absolute executable path");
+  }
+}
+function resolveSdkReservedHelperBin(kind, host) {
+  if (host !== void 0) {
+    if (host.mode !== "self-executable") throw new Error(`unsupported SDK helper host mode: ${String(host.mode)}`);
+    const executable = host.executable ?? process.execPath;
+    assertExecutable(executable);
+    return Object.freeze({
+      command: executable,
+      args: Object.freeze([BYOK_SDK_HELPER_SUBCOMMAND, kind]),
+      source: "self-executable"
+    });
+  }
+  const script = path5.join(
+    path5.dirname(fileURLToPath(import.meta.url)),
+    "bin",
+    DIST_SCRIPT_BY_KIND[kind]
+  );
+  return Object.freeze({
+    command: process.execPath,
+    args: Object.freeze([script]),
+    source: "dist-script"
+  });
+}
+
+// src/adapters/claude/resolve-approval-mcp-bin.ts
+function resolveApprovalMcpBin(host) {
   const override = process.env.BYOK_APPROVAL_MCP_BIN;
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path5.join(path5.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
-  return { command: process.execPath, args: [distBin], source: "dist" };
+  const resolved = resolveSdkReservedHelperBin("approval-mcp", host);
+  return {
+    command: resolved.command,
+    args: [...resolved.args],
+    source: resolved.source === "self-executable" ? "host" : "dist"
+  };
 }
 
 // src/adapters/claude/permission-mapping.ts
 var READONLY_TOOLS2 = ["Read", "Glob", "Grep"];
-function mapPermissionPolicyToClaudeArgs(policy) {
+function mapPermissionPolicyToClaudeArgs(policy, toolsetGrants = []) {
   if (policy.network === false) {
     return {
       ok: false,
@@ -1335,7 +1430,10 @@ function mapPermissionPolicyToClaudeArgs(policy) {
   if (policy.mode === "readonly") {
     const base = policy.allowTools ? policy.allowTools.filter((tool) => READONLY_TOOLS2.includes(tool)) : [...READONLY_TOOLS2];
     const effective = subtractDenied(base, denyTools);
-    return { ok: true, args: ["--permission-mode", "default", "--tools", effective.join(",")] };
+    return {
+      ok: true,
+      args: ["--permission-mode", "default", "--tools", effective.join(","), ...allowedToolsArgs(toolsetGrants)]
+    };
   }
   if (denyTools.length > 0) {
     return {
@@ -1349,12 +1447,17 @@ function mapPermissionPolicyToClaudeArgs(policy) {
   if (policy.allowTools && policy.allowTools.length > 0) {
     args.push("--tools", policy.allowTools.join(","));
   }
+  if (policy.mode !== "plan") args.push(...allowedToolsArgs(toolsetGrants));
   return { ok: true, args };
 }
 function subtractDenied(tools, denyTools) {
   const denied = new Set(denyTools);
   return tools.filter((tool) => !denied.has(tool));
 }
+function allowedToolsArgs(toolsetGrants) {
+  const identifiers = toolsetGrants.flatMap((grant) => grant.tools.map((tool) => `mcp__${grant.server}__${tool}`)).sort();
+  return identifiers.length === 0 ? [] : ["--allowedTools", identifiers.join(",")];
+}
 function createToolUseCorrelation() {
   return { toolNameByUseId: /* @__PURE__ */ new Map() };
 }
@@ -1759,10 +1862,62 @@ var ClaudeProcessClient = class {
     this.eventQueue.end();
   }
 };
-var APPROVAL_TOOL_NAME = "approval_prompt";
+var GRANTABLE_TOOL_NAME = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$/u;
+var GRANTABLE_MCP_SERVER_NAME = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$/u;
+
+// src/adapters/mcp-tool-grants.ts
+var PREGRANTED_RESERVED_MCP_TOOLS = Object.freeze({
+  [AGENT_MESSAGE_MCP_SERVER_NAME]: Object.freeze([AGENT_MESSAGE_TOOL_NAME]),
+  [AGENT_MEMORY_MCP_SERVER_NAME]: Object.freeze([
+    AGENT_MEMORY_RECALL_TOOL_NAME,
+    AGENT_MEMORY_SAVE_TOOL_NAME
+  ])
+});
+function resolveReservedMcpToolGrants(servers) {
+  return Object.entries(PREGRANTED_RESERVED_MCP_TOOLS).filter(([server]) => Object.prototype.hasOwnProperty.call(servers ?? {}, server)).map(([server, tools]) => Object.freeze({ server, tools }));
+}
+function resolveMcpToolsetGrants(servers, observation) {
+  const projected = Object.keys(servers ?? {}).filter((name) => !isReservedMcpServerName(name)).sort();
+  const ungrantableServers = projected.filter((name) => !GRANTABLE_MCP_SERVER_NAME.test(name));
+  if (ungrantableServers.length > 0) {
+    return {
+      ok: false,
+      reason: `projected MCP toolset server name(s) [${ungrantableServers.join(", ")}] cannot be expressed as a runtime tool grant \u2014 refusing to start a task whose grants would be ambiguous`
+    };
+  }
+  const observed = observation ?? {};
+  const unexpected = Object.keys(observed).filter((name) => !projected.includes(name)).sort();
+  if (unexpected.length > 0) {
+    return {
+      ok: false,
+      reason: `observed MCP tool names for server(s) [${unexpected.join(", ")}] that are not projected for this task \u2014 refusing to grant tools for a server the task was never given`
+    };
+  }
+  const grants = [];
+  for (const server of projected) {
+    const tools = observed[server];
+    if (tools === void 0 || tools.length === 0) {
+      return {
+        ok: false,
+        reason: `no tools/list observation for projected MCP toolset server "${server}" \u2014 refusing to start a task whose toolset tools cannot be granted`
+      };
+    }
+    const ungrantableTools = tools.filter((tool) => typeof tool !== "string" || !GRANTABLE_TOOL_NAME.test(tool));
+    if (ungrantableTools.length > 0) {
+      return {
+        ok: false,
+        reason: `MCP toolset server "${server}" reported tool name(s) [${ungrantableTools.map((tool) => JSON.stringify(tool)).join(", ")}] that cannot be expressed as a runtime tool grant`
+      };
+    }
+    grants.push({ server, tools: Object.freeze([...tools].sort()) });
+  }
+  return { ok: true, grants: Object.freeze(grants) };
+}
+function grantFingerprint(grants) {
+  return grants.flatMap((grant) => grant.tools.map((tool) => `${grant.server} ${tool}`)).sort().join("\n");
+}
 
 // src/adapters/claude/claude-adapter.ts
-var APPROVAL_MCP_SERVER_NAME = "byokapproval";
 var execFileAsync2 = promisify(execFile);
 var DETECT_TIMEOUT_MS2 = 5e3;
 function errorMessage2(err) {
@@ -1787,6 +1942,10 @@ var ClaudeAdapter = class {
   descriptor = freezeRuntimeAdapterDescriptor({
     id: "claude",
     supportsDispatchSelection: true,
+    // `--allowedTools mcp__<server>__<tool>` names each projected toolset
+    // tool explicitly, so this adapter cannot admit a projected server
+    // without the daemon's own `tools/list` observation of it.
+    requiresMcpToolsetToolObservation: true,
     capabilities: {
       steer: false,
       resume: true,
@@ -1808,7 +1967,13 @@ var ClaudeAdapter = class {
     }
   }
   async prepare(input) {
-    const mapping = mapPermissionPolicyToClaudeArgs(input.policy);
+    const toolsetGrants = resolveMcpToolsetGrants(input.mcpServers, input.mcpToolsetTools);
+    if (!toolsetGrants.ok) return { kind: "reject", reason: `claude adapter cannot grant projected MCP toolset tools: ${toolsetGrants.reason}`, retryable: false };
+    const reservedMemoryGrants = resolveReservedMcpToolGrants(input.mcpServers).filter((grant) => grant.server === AGENT_MEMORY_MCP_SERVER_NAME);
+    const mapping = mapPermissionPolicyToClaudeArgs(input.policy, [
+      ...reservedMemoryGrants,
+      ...toolsetGrants.grants
+    ]);
     if (!mapping.ok) return { kind: "reject", reason: mapping.reason ?? "policy rejected by claude adapter", retryable: false };
     let modelId;
     try {
@@ -1836,11 +2001,11 @@ var ClaudeAdapter = class {
     return {
       kind: "prepared",
       operation: {
-        start: (startInput) => this.startPrepared(startInput, mapping, modelId, bin, approvalMcpBin)
+        start: (startInput) => this.startPrepared(startInput, mapping, modelId, bin, approvalMcpBin, toolsetGrants.grants)
       }
     };
   }
-  async startPrepared(startInput, initialMapping, modelId, bin, approvalMcpBin) {
+  async startPrepared(startInput, initialMapping, modelId, bin, approvalMcpBin, preparedGrants) {
     if (!initialMapping.ok) throw new RuntimeExecutionFailure({
       phase: "start",
       category: "authority",
@@ -1855,6 +2020,15 @@ var ClaudeAdapter = class {
         reason: "prepared claude operation requires a resolved string instruction"
       });
     }
+    const startGrants = resolveMcpToolsetGrants(startInput.mcpServers, startInput.mcpToolsetTools);
+    if (!startGrants.ok || grantFingerprint(startGrants.grants) !== grantFingerprint(preparedGrants)) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared claude operation received different MCP toolset tool authority than it was admitted with"
+      });
+    }
     const mapping = { ...initialMapping, args: [...initialMapping.args] };
     let mcpConfigDir;
     const taskMcpServers = startInput.mcpServers ?? {};
@@ -2539,6 +2713,8 @@ var CodexProcessRunner = class {
 // src/adapters/codex/codex-adapter.ts
 var execFileAsync3 = promisify(execFile);
 var DETECT_TIMEOUT_MS3 = 5e3;
+var RESERVED_MCP_POLICY_PROBE_TIMEOUT_MS = 5e3;
+var MIN_CODEX_RESERVED_MCP_APPROVAL_VERSION = [0, 149, 0];
 var CodexAdapter = class {
   constructor(options = {}) {
     this.options = options;
@@ -2547,6 +2723,11 @@ var CodexAdapter = class {
   descriptor = freezeRuntimeAdapterDescriptor({
     id: "codex",
     supportsDispatchSelection: true,
+    // `mcp_servers.<name>.enabled_tools` plus a per-tool `approval_mode`
+    // names each projected toolset tool explicitly, so this adapter cannot
+    // admit a projected server without the daemon's own `tools/list`
+    // observation of it.
+    requiresMcpToolsetToolObservation: true,
     capabilities: {
       steer: false,
       resume: true,
@@ -2619,14 +2800,43 @@ ${withStreams.stderr ?? ""}`);
     } catch (error) {
       return { kind: "reject", reason: error instanceof Error ? error.message : String(error), retryable: true };
     }
+    const toolsetGrants = resolveMcpToolsetGrants(input.mcpServers, input.mcpToolsetTools);
+    if (!toolsetGrants.ok) {
+      return { kind: "reject", reason: `codex adapter cannot grant projected MCP toolset tools: ${toolsetGrants.reason}`, retryable: false };
+    }
+    const reservedGrants = resolveReservedMcpToolGrants(input.mcpServers);
+    const allGrants = Object.freeze([...reservedGrants, ...toolsetGrants.grants]);
+    if (allGrants.length > 0) {
+      try {
+        await requireCodexPerToolApprovalSupport(command);
+        for (const grant of allGrants) {
+          await probeCodexMcpToolApproval(command, grant.server, input.mcpServers[grant.server], grant.tools);
+        }
+      } catch (error) {
+        return {
+          kind: "reject",
+          reason: `codex MCP tool approval preflight failed: ${error instanceof Error ? error.message : String(error)}`,
+          retryable: false
+        };
+      }
+    }
     return {
       kind: "prepared",
       operation: {
-        start: (startInput) => this.startPrepared(startInput, mapping.args, modelId, command)
+        start: (startInput) => this.startPrepared(startInput, mapping.args, modelId, command, toolsetGrants.grants, allGrants)
       }
     };
   }
-  async startPrepared(startInput, policyArgs, modelId, command) {
+  async startPrepared(startInput, policyArgs, modelId, command, preparedToolsetGrants, preparedMcpGrants) {
+    const startGrants = resolveMcpToolsetGrants(startInput.mcpServers, startInput.mcpToolsetTools);
+    if (!startGrants.ok || grantFingerprint(startGrants.grants) !== grantFingerprint(preparedToolsetGrants)) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared codex operation received different MCP toolset tool authority than it was admitted with"
+      });
+    }
     if (typeof startInput.instruction !== "string") {
       throw new RuntimeExecutionFailure({
         phase: "start",
@@ -2678,12 +2888,13 @@ ${withStreams.stderr ?? ""}`);
         reason: "prepared codex operation received a manifest with different runtime selection"
       });
     }
+    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, preparedMcpGrants);
     const { sessionRef, runner } = await runCodexTurn({
       command,
       resumeRef: startInput.manifest.sessionRef,
       instruction: startInput.instruction,
       modelId: manifestModelId,
-      policyArgs: [...policyArgs, ...codexMcpConfigArgs(startInput.mcpServers)],
+      policyArgs: [...policyArgs, ...mcpConfigArgs],
       cwd: manifestCwd,
       env: runtimeEnv,
       spawnFn: this.options.spawnFn,
@@ -2706,15 +2917,55 @@ ${withStreams.stderr ?? ""}`);
       initialRunner: runner,
       preparedGit: startInput.manifest.workspace.workspaceId !== void 0,
       modelId: manifestModelId,
-      terminal
+      terminal,
+      mcpConfigArgs
     });
   }
   resolveBin() {
     return (this.options.resolveBin ?? resolveCodexBin)();
   }
 };
-function codexMcpConfigArgs(servers) {
+async function requireCodexPerToolApprovalSupport(command) {
+  const versionResult = await execFileAsync3(command, ["--version"], { timeout: RESERVED_MCP_POLICY_PROBE_TIMEOUT_MS });
+  const versionText = `${versionResult.stdout}
+${versionResult.stderr}`.trim();
+  const versionMatch = /codex-cli\s+(\d+)\.(\d+)\.(\d+)/u.exec(versionText);
+  if (versionMatch === null) throw new Error(`unrecognized Codex version: ${versionText || "(empty)"}`);
+  const version = versionMatch.slice(1, 4).map(Number);
+  for (let index = 0; index < MIN_CODEX_RESERVED_MCP_APPROVAL_VERSION.length; index += 1) {
+    if (version[index] > MIN_CODEX_RESERVED_MCP_APPROVAL_VERSION[index]) break;
+    if (version[index] < MIN_CODEX_RESERVED_MCP_APPROVAL_VERSION[index]) {
+      throw new Error(`Codex ${version.slice(0, 3).join(".")} lacks the required per-MCP-tool approval contract`);
+    }
+  }
+}
+async function probeCodexMcpToolApproval(command, name, server, tools) {
+  const probeArgs = [
+    "mcp",
+    "get",
+    name,
+    "--json",
+    "-c",
+    `mcp_servers.${name}.command=${JSON.stringify(server.command)}`,
+    ...codexMcpToolApprovalArgs(name, tools)
+  ];
+  const result = await execFileAsync3(command, probeArgs, { timeout: RESERVED_MCP_POLICY_PROBE_TIMEOUT_MS });
+  const parsed = JSON.parse(result.stdout);
+  const readBack = Array.isArray(parsed.enabled_tools) ? parsed.enabled_tools : void 0;
+  if (parsed.name !== name || parsed.enabled !== true || readBack === void 0 || readBack.length !== tools.length || readBack.some((tool, index) => tool !== tools[index])) {
+    throw new Error(`Codex did not read back the exact tool allowlist for MCP server "${name}"`);
+  }
+}
+function codexMcpToolApprovalArgs(name, tools) {
+  const args = ["-c", `mcp_servers.${name}.enabled_tools=${JSON.stringify([...tools])}`];
+  for (const tool of tools) {
+    args.push("-c", `mcp_servers.${name}.tools.${tool}.approval_mode="approve"`);
+  }
+  return args;
+}
+function codexMcpConfigArgs(servers, grants = []) {
   if (servers === void 0 || Object.keys(servers).length === 0) return [];
+  const grantedTools = new Map(grants.map((grant) => [grant.server, grant.tools]));
   const args = ["--ignore-user-config"];
   for (const [name, server] of Object.entries(servers).sort(([left], [right]) => left.localeCompare(right))) {
     args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(server.command)}`);
@@ -2722,6 +2973,8 @@ function codexMcpConfigArgs(servers) {
     for (const [key, value] of Object.entries(server.env ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
       args.push("-c", `mcp_servers.${name}.env.${key}=${JSON.stringify(value)}`);
     }
+    const granted = grantedTools.get(name);
+    if (granted !== void 0) args.push(...codexMcpToolApprovalArgs(name, granted));
   }
   return args;
 }
@@ -2908,6 +3161,19 @@ var CodexSession = class {
   recordUnmapped;
   preparedGit;
   modelId;
+  /**
+   * A resume spawns a BRAND NEW codex process, which inherits none of the
+   * first turn's `-c` overrides — exactly the same reason `followUp()`
+   * re-maps the permission policy on every call. Without replaying these
+   * bytes, `--ignore-user-config` and every `mcp_servers.*` key (command,
+   * args, env, `enabled_tools`, per-tool `approval_mode`) would silently
+   * vanish after turn one: the reserved message server and any projected
+   * toolset would stop existing, and any surviving tool call would be
+   * refused outright under `approval_policy=never`. Frozen at start; never
+   * recomputed from anything a later turn supplies, so a follow-up can never
+   * widen this session's MCP authority.
+   */
+  mcpConfigArgs;
   terminal;
   currentRunner;
   ownedRunners = /* @__PURE__ */ new Set();
@@ -2925,6 +3191,7 @@ var CodexSession = class {
     this.preparedGit = options.preparedGit;
     this.modelId = options.modelId;
     this.terminal = options.terminal;
+    this.mcpConfigArgs = options.mcpConfigArgs;
     this.currentRunner = options.initialRunner;
     this.ownedRunners.add(options.initialRunner);
     void this.forgetRunnerOnceClosed(options.initialRunner);
@@ -3033,7 +3300,9 @@ var CodexSession = class {
         resumeRef,
         instruction: task.instruction,
         modelId,
-        policyArgs: mapping.args,
+        // Freshly re-mapped policy for THIS turn, plus the start turn's
+        // frozen MCP config replayed verbatim — see `mcpConfigArgs`.
+        policyArgs: [...mapping.args, ...this.mcpConfigArgs],
         cwd: this.workspaceDir,
         env: withoutProviderCredentials(this.env),
         spawnFn: this.spawnFn,