@coda-console/codex 1.8.7 → 1.9.1

package/agent/entry.mjs

@@ -26,10 +26,11 @@ import { CodexReviews } from './reviews.mjs';
 import { explainCodexError, reportedCodexFailures } from './errors.mjs';
 import { reportedCodexSleeps } from './sleep.mjs';
 import { codexDisplayNames } from './display.mjs';
+import { trustedCodaMcpRequests } from './mcp-policy.mjs';
 
 const env = process.env;
-// A session starts read-only, unless its machine's configuration says otherwise.
-env.INITIAL_AGENT_MODE ??= 'read-only';
+// Coda owns the permission boundary. An explicit launch mode or later ACP selection still wins.
+env.INITIAL_AGENT_MODE ??= 'agent-full-access';
 // The Codex this session runs, as the handshake's `agentInfo` names it (Coda's protocol「Agent 版本」): the connection's own
 // program when it sets one, else the plugin's locked @openai/codex.
 const own = env.CODEX_PATH;
@@ -66,6 +67,6 @@ registerHooks({ load(url, context, nextLoad) {
   const loaded = nextLoad(url, context);
   if (url !== adapter.href) return loaded;
   return { ...loaded, source: reportedCodexSleeps(reportedCodexFailures(codexOptionsAsShown(relayedCodexStreams(orderedCodexTitles(followCodexProcessExit(continuedCodexSubagents(
-    promptRequiredCodexSteering(instructedCodexThreads(servedCodexModels(networkedCodexDevelopment(Buffer.from(loaded.source).toString('utf8')))))))))))) };
+    promptRequiredCodexSteering(instructedCodexThreads(servedCodexModels(networkedCodexDevelopment(trustedCodaMcpRequests(Buffer.from(loaded.source).toString('utf8'))))))))))))) };
 } });
 await import(adapter.href);

package/agent/mcp-policy.mjs

@@ -0,0 +1,24 @@
+import { isAbsolute, sep } from 'node:path';
+
+// ACP is the trusted host boundary: Coda reserves the server name `coda` and supplies this stdio shim itself
+// (backend/src/components/session-config/service.mjs). Do not infer trust from a Codex config entry of the same name.
+// The shape check limits the exception to the current Coda transport, not arbitrary HTTP or plugin MCP servers.
+export function codaMcpPolicy(server, config) {
+  const args = config.args;
+  if (server.name !== 'coda' || 'type' in server || config.command !== process.execPath ||
+      !Array.isArray(args) || args.length !== 5 || typeof args[0] !== 'string' || !isAbsolute(args[0]) ||
+      !args[0].endsWith(`${sep}src${sep}adapters${sep}mcp-shim.mjs`) ||
+      args[1] !== '--thread' || typeof args[2] !== 'string' || !args[2] ||
+      args[3] !== '--socket' || typeof args[4] !== 'string' || !isAbsolute(args[4])) return config;
+  // All tools of Coda's own server, including workflow_run/approve-command, must reach Coda's permission boundary.
+  // This approves the MCP request, not the command or human decision it asks Coda to handle.
+  return { ...config, default_tools_approval_mode: 'approve' };
+}
+
+const before = '      "mcp_servers": Object.fromEntries(serversToConfigure.map((mcp) => [mcp.name, this.createMcpSeverConfig(mcp.server)]))';
+export function trustedCodaMcpRequests(source) {
+  if (source.split(before).length !== 2) throw new Error('codex-acp MCP approval patch no longer matches the locked adapter');
+  // Apply after codex-acp's name deduplication: a native configured server it selected keeps its own policy.
+  return `import { codaMcpPolicy } from ${JSON.stringify(import.meta.url)};\n${source.replace(/^#![^\n]*\n/, '').replace(before,
+    '      "mcp_servers": Object.fromEntries(serversToConfigure.map((mcp) => [mcp.name, codaMcpPolicy(mcp.server, this.createMcpSeverConfig(mcp.server))]))')}`;
+}

package/package.json

@@ -3,7 +3,7 @@
   "id": "codex",
   "displayName": "Codex",
   "description": "Codex Agent：Coda 自带的入口运行 codex-acp，报告子 Agent、后台命令与命令的自动审核。额度与登录由账号来源插件接管；未接入账号来源时使用 Codex 自己的登录面板。",
-  "version": "1.8.7",
+  "version": "1.9.1",
   "categories": [
     "Agent"
   ],
@@ -28,7 +28,8 @@
         "command": "exec \"$CODA_NODE\" \"$CODA_PLUGIN_PATH/agent/entry.mjs\"",
         "modes": {
           "title": "审批模式",
-          "unset": "人工审批",
+          "unset": "Agent 默认",
+          "note": "未选择时为完全访问。",
           "auto": "agent",
           "full": "agent-full-access"
         },