@mono-agent/agent-runtime 0.15.2 → 0.15.3

package/README.md

@@ -650,7 +650,7 @@ Per-call options (a non-exhaustive selection):
 | `cwd` | `string` | Working directory for the agent's tools. |
 | `allowedTools` | `string[]` | Built-in tool allowlist. Default: all. |
 | `disallowedTools` | `string[]` | Block list. |
-| `mcpServers` | `Record<string, McpServerConfig>` | Configured MCP servers (stdio / sse / http). |
+| `mcpServers` | `Record<string, McpServerConfig>` | Configured MCP servers (stdio / sse / http); on direct Codex, each forwarded server authorizes its own tool calls. |
 | `sandboxPolicy` | `SandboxPolicy` | Optional fail-closed sandbox policy for built-in tools and stdio MCP process startup. |
 | `maxTurns` | `number` | Hard cap on agent turns. |
 | `outputSchema` | `JSONSchema` | Requests structured JSON on capable bridges; see “Structured output” below for bridge-specific return behavior. |
@@ -760,6 +760,17 @@ truncation is explicitly desired; omitting it is not a separate hidden limit.
 The standard 256 KiB tool-payload guard still applies to oversized tool results.
 
 Override or extend the tool surface by passing `mcpServers` for MCP-backed tools.
+On direct Codex normal runs, each valid server that survives translation into
+the app-server config is the authorization boundary for the tools it exposes.
+The bridge accepts Codex's synthesized `mcp_tool_call` elicitation for that exact
+server without persisting an approval. Inherited or otherwise unconfigured
+server names, genuine downstream MCP elicitations, and other app-server requests
+remain fail-closed.
+
+This also applies under direct Codex `permissionMode: "plan"`: the read-only
+sandbox constrains Codex-owned filesystem and command execution, but a declared
+MCP tool can still change state managed by its server. Do not declare a server
+whose complete tool surface is not authorized for the run.
 
 ### Structured output
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mono-agent/agent-runtime",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "description": "Agent runtime supporting Claude SDK/CLI, Codex, OpenCode, and Pi SDK bridges out of the box",
   "type": "module",
   "license": "GPL-3.0-only",

package/src/ai/providers/codex-app.js

@@ -617,6 +617,19 @@ function codexMcpConfig(mcpServers = {}) {
   return servers;
 }
 
+function codexConfiguredMcpApprovalResponse(request, configuredMcpServerNames) {
+  const params = request?.params;
+  if (
+    request?.method !== "mcpServer/elicitation/request"
+    || params?._meta?.codex_approval_kind !== "mcp_tool_call"
+    || typeof params?.serverName !== "string"
+    || !configuredMcpServerNames.has(params.serverName)
+  ) {
+    return null;
+  }
+  return { action: "accept", content: {}, _meta: null };
+}
+
 function codexErrorMessage(error) {
   if (!error) return "Codex app-server error";
   if (typeof error === "string") return error;
@@ -1109,6 +1122,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
   const makeClient = options.codexClientFactory || createCodexAppServerClient;
   const keepAlive = options.sessionKeepAlive === true;
   const noToolsProbe = options.codexNoToolsProbe === true;
+  const configuredMcpServerNames = new Set(Object.keys(codexMcpConfig(options.mcpServers)));
   // The bridge TTL is a backstop behind the host's session policy; the grace
   // keeps the host's lazy expiry firing first so eviction stays host-driven.
   const sessionTtlMs = Number.isFinite(Number(options.sessionIdleTimeoutMs))
@@ -1446,6 +1460,10 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       ),
       onServerRequest: (request) => {
         const method = typeof request?.method === "string" ? request.method : "unknown";
+        const approval = noToolsProbe
+          ? null
+          : codexConfiguredMcpApprovalResponse(request, configuredMcpServerNames);
+        if (approval) return approval;
         failUnsupportedServerRequest(method);
         throw new Error(`Unsupported Codex app-server request: ${method}`);
       },

package/types/ai/backend.d.ts

@@ -0,0 +1,57 @@
+export function backendCapabilities(sdkOrModel: any): any;
+export function backendUsesExecenvConfig(sdk: any): boolean;
+export function backendSupportsSessionResume(sdk: any): boolean;
+export const BACKEND_CAPABILITIES: {
+    claude: {
+        supports_session_resume: boolean;
+        streaming: boolean;
+        structured_output: boolean;
+        native_runtime_config: any;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_builtin_tools: boolean;
+        supports_live_input: boolean;
+        supports_native_subagents: boolean;
+        supports_fast_mode: boolean;
+        runtime: string;
+    };
+    pi: {
+        supports_session_resume: boolean;
+        supports_native_subagents: boolean;
+        streaming: boolean;
+        structured_output: boolean;
+        native_runtime_config: any;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_builtin_tools: boolean;
+        supports_live_input: boolean;
+        supports_fast_mode: boolean;
+        runtime: string;
+    };
+    codex: {
+        supports_session_resume: boolean;
+        supports_fast_mode: boolean;
+        streaming: boolean;
+        structured_output: boolean;
+        native_runtime_config: any;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_builtin_tools: boolean;
+        supports_live_input: boolean;
+        supports_native_subagents: boolean;
+        runtime: string;
+    };
+    opencode: {
+        structured_output: boolean;
+        supports_session_resume: boolean;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_live_input: boolean;
+        supports_native_subagents: boolean;
+        streaming: boolean;
+        native_runtime_config: any;
+        supports_builtin_tools: boolean;
+        supports_fast_mode: boolean;
+        runtime: string;
+    };
+};

package/types/ai/registry.d.ts

@@ -0,0 +1 @@
+export { listRuntimeBridges as listProviders, resolveRuntimeBridge as findProviderForModel, runtimeCapabilities } from "./runtime/registry.js";