@peakflo/agent-harness 0.2.9-rc.5 → 0.2.9-rc.7

package/README.md

@@ -121,6 +121,16 @@ The runner never answers a request with "always allow", and does not offer
 that answer to the person approving: Codex and Cursor would save it as a
 standing rule in their own configuration.
 
+An approval request says what will happen in its first line ("Run: npm test",
+"Write: src/a.ts", "Change: 3 files" with the list), for every kind of request
+Codex can send. "Deny" refuses the action and lets the turn go on, so the agent
+says that it was not allowed; the denied action never runs.
+
+A command too long for the card keeps its start and its end, and the card
+says it is not shown in full. A question Codex asks the person is shown as a
+question to answer in words, not as Allow / Deny. An MCP form that needs values
+is declined, because nobody can fill it in from the chat.
+
 Cursor reports an account limit as a normal reply ("Upgrade your plan to
 continue"). The runner turns a reply that is only that sentence into a failed
 turn that says it comes from the Cursor account on the runner.

package/dist/adapters/claude-code-adapter.js

@@ -1284,7 +1284,20 @@ class ClaudeCodeAdapter {
             const errName = error instanceof Error ? error.name : '';
             const errMsg = error instanceof Error ? error.message : String(error);
             const errStack = error instanceof Error ? error.stack : undefined;
-            if (errName === 'AbortError' || errMsg.includes('aborted by user')) {
+            // CHANGED from 20x: the runner stops the session at the end of EVERY
+            // turn (one process per turn), and the SDK reports that stop as a plain
+            // `Error: Operation aborted`. That is the expected end of a finished
+            // turn, not a failure: it used to be logged as "Stream error" with a
+            // stack trace after every successful turn, and marked the session failed.
+            // Both conditions: the adapter asked for the stop AND the error is the
+            // SDK's own word for a stopped process. An unrelated failure that
+            // happens to arrive after the stop is still reported below.
+            const stoppedByUs = session.abortController?.signal.aborted === true &&
+                /\babort(ed)?\b/i.test(errMsg);
+            if (stoppedByUs) {
+                console.log('[ClaudeCodeAdapter] Stream stopped at the end of the turn');
+            }
+            else if (errName === 'AbortError' || errMsg.includes('aborted by user')) {
                 console.log('[ClaudeCodeAdapter] Stream aborted by user');
                 // Don't set error status - this is normal when sending a new message
             }

package/dist/adapters/codex-app-server-adapter.d.ts

@@ -29,6 +29,11 @@ export declare function isStandingApprovalDecision(optionId: string): boolean;
  * any file change — is sent to the client as an approval request before it
  * runs. That is what "Ask before each action" says.
  */
+/**
+ * The fields an MCP form asks the person to fill in. Empty for a form with no
+ * fields, and for a request that is not a form (`mode: 'url'`).
+ */
+export declare function elicitationFormFields(params: Record<string, unknown>): string[];
 export declare function codexApprovalPolicy(config: Pick<SessionConfig, 'permissionMode'>): 'never' | 'untrusted';
 interface PendingApproval {
     requestId: string | number;
@@ -40,6 +45,8 @@ interface PendingApproval {
         kind: string;
     }>;
     responseKind: 'execCommand' | 'commandExecution' | 'fileChange' | 'permissions' | 'elicitation' | 'userInput' | 'generic';
+    /** What `item/permissions/requestApproval` asked for; echoed back on allow. */
+    requestedPermissions?: unknown;
 }
 export declare class CodexAppServerAdapter implements CodingAgentAdapter {
     private sessions;
@@ -87,6 +94,19 @@ export declare class CodexAppServerAdapter implements CodingAgentAdapter {
     private setupStdoutParser;
     private handleRpcMessage;
     private handleServerRequest;
+    /**
+     * ADDED, not in 20x: `item/tool/requestUserInput` IS A QUESTION.
+     *
+     * It was shown as a permission card, and "Allow" sent the word "accept" to
+     * the model as the person's answer. It is now a question part, like the
+     * ones Pi asks: the person picks an option or types, and the answer goes
+     * back through `respondToQuestion` in the form this request takes
+     * (`{ answers: { <question id>: { answers: [text] } } }`). It is asked in
+     * every permission mode, bypass included: nobody can answer it but a person.
+     */
+    private handleUserInputRequest;
+    /** The answer to a question asked with `item/tool/requestUserInput`. */
+    respondToQuestion(sessionId: string, answers: Record<string, string>, _config?: SessionConfig, requestId?: string): Promise<boolean>;
     private handleNotification;
     private handleApprovalRequest;
     private buildApprovalResponse;

package/dist/adapters/codex-app-server-adapter.js

@@ -43,6 +43,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexAppServerAdapter = void 0;
 exports.unwrapListedThreadItem = unwrapListedThreadItem;
 exports.isStandingApprovalDecision = isStandingApprovalDecision;
+exports.elicitationFormFields = elicitationFormFields;
 exports.codexApprovalPolicy = codexApprovalPolicy;
 /**
  * Extracted verbatim from 20x `src/main/adapters/codex-app-server-adapter.ts`.
@@ -57,6 +58,7 @@ const os_1 = require("os");
 const path_1 = require("path");
 const util_1 = require("util");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
+const codex_approval_text_1 = require("./codex-approval-text");
 const DEFAULT_CODEX_APP_SERVER_MODEL = 'gpt-5.5';
 /**
  * `thread/items/list` returns each item inside an envelope:
@@ -105,6 +107,26 @@ function isStandingApprovalDecision(optionId) {
  * any file change — is sent to the client as an approval request before it
  * runs. That is what "Ask before each action" says.
  */
+/**
+ * The fields an MCP form asks the person to fill in. Empty for a form with no
+ * fields, and for a request that is not a form (`mode: 'url'`).
+ */
+function elicitationFormFields(params) {
+    // Only a request that says it is NOT a form is taken at its word. A missing
+    // or unknown mode is read from the schema it carries, like a form.
+    if (asString(params.mode) === 'url')
+        return [];
+    const schema = params.requestedSchema;
+    if (!isObject(schema)) {
+        // A form whose shape this build cannot read is treated as having fields.
+        return schema === undefined || schema === null ? [] : ['an unreadable form'];
+    }
+    const properties = isObject(schema.properties) ? Object.keys(schema.properties) : [];
+    const required = Array.isArray(schema.required)
+        ? schema.required.filter((name) => typeof name === 'string')
+        : [];
+    return [...new Set([...required, ...properties])];
+}
 function codexApprovalPolicy(config) {
     // `'allow'` is what `mapPermissionMode` makes of the agent's
     // `bypassPermissions` ("Don't ask for permission"), and of nothing else.
@@ -277,12 +299,6 @@ function isSubpath(parent, child) {
     const rel = (0, path_1.relative)((0, path_1.resolve)(parent), (0, path_1.resolve)(child));
     return rel === '' || (!!rel && !rel.startsWith('..') && !(0, path_1.isAbsolute)(rel));
 }
-function summarizeApproval(params, fallback) {
-    const command = asString(params.command);
-    const reason = asString(params.reason);
-    const itemId = asString(params.itemId) || asString(params.callId);
-    return [command || fallback, reason, itemId ? `id: ${itemId}` : ''].filter(Boolean).join('\n');
-}
 function normalizeDecisionName(decision) {
     if (typeof decision === 'string')
         return decision;
@@ -291,24 +307,6 @@ function normalizeDecisionName(decision) {
     }
     return 'accept';
 }
-function decisionLabel(decision) {
-    switch (decision) {
-        case 'accept':
-        case 'approved':
-            return 'Allow';
-        case 'acceptForSession':
-        case 'approved_for_session':
-            return 'Allow for Session';
-        case 'decline':
-        case 'denied':
-            return 'Deny';
-        case 'cancel':
-        case 'abort':
-            return 'Deny and Stop';
-        default:
-            return decision;
-    }
-}
 class CodexAppServerAdapter {
     sessions = new Map();
     codexExecutablePath = null;
@@ -540,14 +538,24 @@ class CodexAppServerAdapter {
         if (!approval)
             return;
         const selected = optionId || approval.options.find((option) => approved
-            ? ['acceptForSession', 'accept', 'approved_for_session', 'approved'].includes(option.optionId)
-            : ['cancel', 'abort', 'decline', 'denied'].includes(option.optionId))?.optionId || (approved ? 'accept' : 'cancel');
-        const response = this.buildApprovalResponse(approval.responseKind, selected, approved);
+            ? ['accept', 'approved'].includes(option.optionId)
+            : ['decline', 'denied'].includes(option.optionId))?.optionId || (
+        // The older requests take `approved` / `denied`.
+        approval.responseKind === 'execCommand'
+            ? (approved ? 'approved' : 'denied')
+            : (approved ? 'accept' : 'decline'));
+        const response = this.buildApprovalResponse(approval.responseKind, selected, approved, approval.requestedPermissions);
         this.sendRpcResponse(session, approval.requestId, response);
         session.pendingApproval = null;
-        if (!approved) {
-            session.status = coding_agent_adapter_1.SessionStatusType.IDLE;
-        }
+        // CHANGED from 20x, which marked the session idle on every denial. A
+        // denial that continues the turn (`decline`, `denied`) is followed by the
+        // model's own answer; calling the session idle here ended the turn before
+        // that answer arrived. Only a denial that stops the turn is idle at once.
+        // (No button sends `cancel` or `abort` any more; a caller that names one
+        // explicitly still gets the stop it asked for.)
+        session.status = !approved && (selected === 'cancel' || selected === 'abort')
+            ? coding_agent_adapter_1.SessionStatusType.IDLE
+            : coding_agent_adapter_1.SessionStatusType.BUSY;
     }
     async getRunningTools(sessionId, _config) {
         return Array.from(this.sessions.get(sessionId)?.runningTools.values() || []);
@@ -816,12 +824,113 @@ class CodexAppServerAdapter {
             this.handleApprovalRequest(session, request, params);
             return;
         }
-        if (request.method === 'mcpServer/elicitation/request' || request.method === 'item/tool/requestUserInput') {
+        if (request.method === 'item/tool/requestUserInput') {
+            this.handleUserInputRequest(session, request, params);
+            return;
+        }
+        if (request.method === 'mcpServer/elicitation/request') {
+            /*
+             * CHANGED from 20x: A FORM THAT NEEDS VALUES IS DECLINED, NOT "ALLOWED".
+             *
+             * An elicitation in form mode asks the person to fill in fields. This
+             * runner can relay a yes or a no, not field values, and "Allow" answered
+             * with an empty form. A form with fields is therefore declined at once,
+             * in every permission mode: the MCP server is told no, rather than
+             * being handed values nobody entered. A form with no fields is a plain
+             * confirmation (how an MCP tool call asks to run) and is still put to
+             * the person.
+             */
+            const fields = elicitationFormFields(params);
+            if (fields.length > 0) {
+                console.warn(`[CodexAppServerAdapter] Declining an MCP form from ${asString(params.serverName) || 'a server'}: ` +
+                    `it asks for ${fields.join(', ')}, which cannot be entered from here`);
+                this.sendRpcResponse(session, request.id, { action: 'decline' });
+                return;
+            }
             this.handleApprovalRequest(session, request, params);
             return;
         }
         this.sendRpcResponse(session, request.id, {});
     }
+    /**
+     * ADDED, not in 20x: `item/tool/requestUserInput` IS A QUESTION.
+     *
+     * It was shown as a permission card, and "Allow" sent the word "accept" to
+     * the model as the person's answer. It is now a question part, like the
+     * ones Pi asks: the person picks an option or types, and the answer goes
+     * back through `respondToQuestion` in the form this request takes
+     * (`{ answers: { <question id>: { answers: [text] } } }`). It is asked in
+     * every permission mode, bypass included: nobody can answer it but a person.
+     */
+    handleUserInputRequest(session, request, params) {
+        const asked = (Array.isArray(params.questions) ? params.questions : []).filter(isObject);
+        /*
+         * A SECRET IS NOT ASKED FOR IN THE CHAT. An answer typed here is stored in
+         * the transcript and shown to everyone who can read the chat; a question
+         * marked `isSecret` asks for something that must not be. The whole request
+         * is left unanswered instead.
+         */
+        if (asked.some((question) => question.isSecret === true)) {
+            console.warn('[CodexAppServerAdapter] Not asking a question marked secret; it is left unanswered');
+            this.sendRpcResponse(session, request.id, { answers: {} });
+            return;
+        }
+        // The card sends each answer back under its header, so headers are made
+        // unique here: two questions called the same would get one answer.
+        const usedHeaders = new Map();
+        const uniqueHeader = (wanted) => {
+            const count = (usedHeaders.get(wanted) ?? 0) + 1;
+            usedHeaders.set(wanted, count);
+            return count === 1 ? wanted : `${wanted} (${count})`;
+        };
+        const questions = asked
+            .map((question, index) => ({
+            id: asString(question.id) || `q${index + 1}`,
+            header: uniqueHeader(asString(question.header) || `Question ${index + 1}`),
+            question: asString(question.question) || '',
+            options: (Array.isArray(question.options) ? question.options : [])
+                .filter(isObject)
+                .map((option) => ({
+                label: asString(option.label) || '',
+                description: asString(option.description) || ''
+            }))
+                .filter((option) => option.label)
+        }));
+        if (questions.length === 0) {
+            // Nothing to ask. An empty answer set, never an invented one.
+            this.sendRpcResponse(session, request.id, { answers: {} });
+            return;
+        }
+        // An earlier question that was never answered gets no answer.
+        if (session.pendingQuestion) {
+            this.sendRpcResponse(session, session.pendingQuestion.requestId, { answers: {} });
+        }
+        const partId = `codex-question-${asString(params.itemId) || String(request.id)}`;
+        session.pendingQuestion = { requestId: request.id, partId, questions };
+        session.status = coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL;
+        this.addEvent(session, { method: 'pf/question', params: { partId, questions } });
+    }
+    /** The answer to a question asked with `item/tool/requestUserInput`. */
+    async respondToQuestion(sessionId, answers, _config, requestId) {
+        const session = this.sessions.get(sessionId);
+        const pending = session?.pendingQuestion;
+        if (!session || !pending)
+            return false;
+        if (requestId && requestId !== pending.partId)
+            return false;
+        // The card sends `Header: answer` per question, or one bare answer.
+        const result = {};
+        for (const question of pending.questions) {
+            const answer = (answers[question.header] ??
+                (pending.questions.length === 1 ? answers.answer : undefined) ??
+                '').trim();
+            result[question.id] = { answers: answer ? [answer] : [] };
+        }
+        this.sendRpcResponse(session, pending.requestId, { answers: result });
+        session.pendingQuestion = null;
+        session.status = coding_agent_adapter_1.SessionStatusType.BUSY;
+        return true;
+    }
     handleNotification(session, notification) {
         const params = isObject(notification.params) ? notification.params : {};
         if (notification.method === 'thread/status/changed') {
@@ -835,6 +944,9 @@ class CodexAppServerAdapter {
         }
         if (notification.method === 'turn/completed') {
             session.activeTurnId = null;
+            // The turn is over, so a question it asked can no longer be answered:
+            // the request is gone on Codex's side. A late answer finds nothing.
+            session.pendingQuestion = null;
             if (session.threadId) {
                 session.pendingCompletionRefreshes += 1;
                 void this.reconcileCompletedTurn(session);
@@ -866,6 +978,13 @@ class CodexAppServerAdapter {
         }
         if (notification.method === 'serverRequest/resolved') {
             const requestId = params.requestId;
+            // Codex settled the question itself (the turn was interrupted).
+            if (session.pendingQuestion && String(session.pendingQuestion.requestId) === String(requestId)) {
+                session.pendingQuestion = null;
+                if (session.status === coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL) {
+                    session.status = coding_agent_adapter_1.SessionStatusType.BUSY;
+                }
+            }
             if (session.pendingApproval && String(session.pendingApproval.requestId) === String(requestId)) {
                 session.pendingApproval = null;
                 if (session.status === coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL) {
@@ -879,7 +998,7 @@ class CodexAppServerAdapter {
         if (session.config.permissionMode === 'allow') {
             const responseKind = this.getApprovalResponseKind(request.method);
             const selected = responseKind === 'execCommand' ? 'approved' : 'accept';
-            this.sendRpcResponse(session, request.id, this.buildApprovalResponse(responseKind, selected, true));
+            this.sendRpcResponse(session, request.id, this.buildApprovalResponse(responseKind, selected, true, params.permissions));
             return;
         }
         const toolCallId = asString(params.approvalId) || asString(params.itemId) || asString(params.callId) || String(request.id);
@@ -889,44 +1008,63 @@ class CodexAppServerAdapter {
         // the amendment is saved into the Codex config on the runner. Offer only
         // the decisions known to answer this one request; the rest are logged.
         const offered = Array.isArray(params.availableDecisions) ? params.availableDecisions : [];
-        const rawDecisions = offered
-            .filter((decision) => !isStandingApprovalDecision(normalizeDecisionName(decision)));
-        if (rawDecisions.length !== offered.length) {
-            const withheld = offered.map(normalizeDecisionName).filter(isStandingApprovalDecision);
+        const withheld = offered.map(normalizeDecisionName).filter(isStandingApprovalDecision);
+        if (withheld.length > 0) {
             console.log(`[CodexAppServerAdapter] Not offering approval decisions: ${withheld.join(', ')}`);
         }
-        const approvalOptions = rawDecisions.length > 0
-            ? rawDecisions.map((decision) => {
-                const optionId = normalizeDecisionName(decision);
-                return {
-                    optionId,
-                    name: decisionLabel(optionId),
-                    kind: optionId.includes('accept') || optionId === 'approved' ? 'allow' : 'reject'
-                };
-            })
+        /*
+         * CHANGED from 20x: ONE "Allow" AND ONE "Deny", AND DENY LETS THE TURN GO ON.
+         *
+         * Codex has two denials. `cancel` ("abort" in the older form) also
+         * interrupts the turn: the chat went idle with no word from the agent, as
+         * if nothing had been asked. `decline` ("denied") refuses the action and
+         * lets the model carry on, so it can say that it was not allowed and what
+         * it will do instead. Both are in the protocol for every request that has
+         * a decision, whether or not `availableDecisions` lists them, so "Deny" is
+         * always the one that continues.
+         */
+        const legacy = responseKind === 'execCommand';
+        const approvalOptions = legacy
+            ? [
+                { optionId: 'approved', name: 'Allow', kind: 'allow' },
+                { optionId: 'denied', name: 'Deny', kind: 'reject' }
+            ]
             : [
                 { optionId: 'accept', name: 'Allow', kind: 'allow' },
-                { optionId: 'cancel', name: 'Deny', kind: 'reject' }
+                { optionId: 'decline', name: 'Deny', kind: 'reject' }
             ];
+        // The item the request is about, when it has been announced: a file
+        // change's paths are on the item, not on the request.
+        const itemId = asString(params.itemId) || asString(params.callId);
+        const item = itemId ? session.runningTools.get(`tool-${itemId}`)?.input : undefined;
         session.pendingApproval = {
             requestId: request.id,
             toolCallId,
-            question: summarizeApproval(params, request.method),
+            question: (0, codex_approval_text_1.describeCodexApproval)(request.method, params, item, session.config.workspaceDir),
             options: approvalOptions,
-            responseKind
+            responseKind,
+            ...(responseKind === 'permissions' ? { requestedPermissions: params.permissions } : {})
         };
         session.status = coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL;
         this.onDataAvailable?.(session.threadId || session.sessionId);
     }
-    buildApprovalResponse(responseKind, selected, approved) {
+    buildApprovalResponse(responseKind, selected, approved, requestedPermissions) {
         switch (responseKind) {
             case 'execCommand':
-                return { decision: approved ? (selected === 'approved_for_session' ? 'approved_for_session' : 'approved') : (selected === 'denied' ? 'denied' : 'abort') };
+                // The older requests (`execCommandApproval`, `applyPatchApproval`)
+                // take a ReviewDecision. `denied` continues the turn; `abort` stops it.
+                return { decision: approved ? 'approved' : (selected === 'abort' ? 'abort' : 'denied') };
             case 'commandExecution':
-                return { decision: selected };
             case 'fileChange':
+                return { decision: approved ? 'accept' : (selected === 'cancel' ? 'cancel' : 'decline') };
             case 'permissions':
-                return { decision: selected };
+                // CHANGED from 20x, which answered `{ decision }`. This request has no
+                // decision: the answer is the permissions granted, for this turn only.
+                // Granting nothing is the denial.
+                return {
+                    permissions: approved && isObject(requestedPermissions) ? requestedPermissions : {},
+                    scope: 'turn'
+                };
             case 'elicitation':
                 return approved
                     ? { action: 'accept', content: {} }
@@ -936,11 +1074,11 @@ class CodexAppServerAdapter {
                     ? { response: selected }
                     : { response: null };
             default:
-                return { decision: approved ? selected : 'cancel' };
+                return { decision: approved ? 'accept' : 'decline' };
         }
     }
     getApprovalResponseKind(method) {
-        if (method === 'execCommandApproval')
+        if (method === 'execCommandApproval' || method === 'applyPatchApproval')
             return 'execCommand';
         if (method.includes('commandExecution'))
             return 'commandExecution';
@@ -1178,6 +1316,29 @@ class CodexAppServerAdapter {
         if ((method === 'item/started' || method === 'item/completed') && item) {
             return this.convertThreadItem(method, item, params, seenMessageIds, seenPartIds, partContentLengths, session);
         }
+        if (method === 'pf/question') {
+            const partId = asString(params.partId) || 'codex-question';
+            if (seenPartIds.has(partId))
+                return [];
+            seenPartIds.add(partId);
+            const questions = Array.isArray(params.questions) ? params.questions.filter(isObject) : [];
+            return [{
+                    id: partId,
+                    type: coding_agent_adapter_1.MessagePartType.QUESTION,
+                    role: coding_agent_adapter_1.MessageRole.ASSISTANT,
+                    text: questions.map((question) => asString(question.question) || '').join('\n'),
+                    tool: {
+                        name: 'question',
+                        status: 'running',
+                        title: asString(questions[0]?.header) || 'Question',
+                        questions: questions.map((question) => ({
+                            header: question.header,
+                            question: question.question,
+                            options: question.options
+                        }))
+                    }
+                }];
+        }
         if (method === 'error') {
             const partId = `error-${Date.now()}`;
             return [{

package/dist/adapters/codex-approval-text.d.ts

@@ -0,0 +1,50 @@
+/**
+ * What a person is shown when `codex app-server` asks for an approval.
+ *
+ * The card used to show the protocol itself: `item/fileChange/requestApproval`
+ * and `id: exec-…`, with the file name only in the item above it. This module
+ * turns each kind of request the app-server can send into a first line that
+ * says what will happen ("Write: src/a.ts", "Run: npm test") and further lines
+ * with what helps to decide (where, why, which files).
+ *
+ * The first line is the title; the control plane's card shows it on its own.
+ * No ids: nobody can decide anything from one.
+ *
+ * Request kinds, from `codex app-server generate-json-schema` (ServerRequest):
+ *   item/commandExecution/requestApproval   a command, or input to a terminal
+ *   item/fileChange/requestApproval         a patch; the files are on the item
+ *   item/permissions/requestApproval        wider sandbox access for the turn
+ *   mcpServer/elicitation/request           an MCP server asks (incl. to run
+ *                                           one of its tools)
+ *   item/tool/requestUserInput              the model asks a question
+ *   execCommandApproval, applyPatchApproval the older forms of the first two
+ * Kept out of the adapter, which is a copy of 20x's, so it can be tested alone.
+ */
+type Json = Record<string, unknown>;
+/** The longest command shown whole. Longer ones keep both ends. */
+export declare const MAX_SHOWN_COMMAND = 2000;
+/** The longest reason, message or question shown whole. */
+export declare const MAX_SHOWN_NOTE = 500;
+interface FileChange {
+    path: string;
+    kind: string;
+    added: number;
+    removed: number;
+}
+/**
+ * The files of a change, from either shape Codex uses:
+ *   v2 item       `changes: [{ path, kind: { type }, diff }]`
+ *   older request `fileChanges: { [path]: { add | delete | update: {…} } }`
+ */
+export declare function readFileChanges(source: unknown): FileChange[];
+/**
+ * The text of one approval request.
+ *
+ * @param item the thread item the request is about, when the adapter has seen
+ *   it (`item/started` arrives before the request). A file change's paths are
+ *   only there.
+ */
+export declare function describeCodexApproval(method: string, params: Json, item?: Json, 
+/** The session's workspace; paths inside it are shown relative to it. */
+workspaceDir?: string): string;
+export {};

package/dist/adapters/codex-approval-text.js

@@ -0,0 +1,366 @@
+"use strict";
+/**
+ * What a person is shown when `codex app-server` asks for an approval.
+ *
+ * The card used to show the protocol itself: `item/fileChange/requestApproval`
+ * and `id: exec-…`, with the file name only in the item above it. This module
+ * turns each kind of request the app-server can send into a first line that
+ * says what will happen ("Write: src/a.ts", "Run: npm test") and further lines
+ * with what helps to decide (where, why, which files).
+ *
+ * The first line is the title; the control plane's card shows it on its own.
+ * No ids: nobody can decide anything from one.
+ *
+ * Request kinds, from `codex app-server generate-json-schema` (ServerRequest):
+ *   item/commandExecution/requestApproval   a command, or input to a terminal
+ *   item/fileChange/requestApproval         a patch; the files are on the item
+ *   item/permissions/requestApproval        wider sandbox access for the turn
+ *   mcpServer/elicitation/request           an MCP server asks (incl. to run
+ *                                           one of its tools)
+ *   item/tool/requestUserInput              the model asks a question
+ *   execCommandApproval, applyPatchApproval the older forms of the first two
+ * Kept out of the adapter, which is a copy of 20x's, so it can be tested alone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_SHOWN_NOTE = exports.MAX_SHOWN_COMMAND = void 0;
+exports.readFileChanges = readFileChanges;
+exports.describeCodexApproval = describeCodexApproval;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/** One line, however the value was written. */
+function oneLine(value) {
+    return value.replace(/\s*\n\s*/g, ' ⏎ ').trim();
+}
+const MAX_LISTED_PATHS = 12;
+/** The longest command shown whole. Longer ones keep both ends. */
+exports.MAX_SHOWN_COMMAND = 2000;
+const COMMAND_HEAD = 1500;
+const COMMAND_TAIL = 300;
+/** The longest reason, message or question shown whole. */
+exports.MAX_SHOWN_NOTE = 500;
+/**
+ * A command that is too long for a card keeps its start, where the program
+ * and its first arguments are, and its end, where a redirect or a second
+ * command would be, and says how much is missing. The card then also says, on
+ * a line of its own, that this is not the whole command: a person must never
+ * approve a shortened command believing they have read it.
+ */
+function shownCommand(command) {
+    const line = oneLine(command);
+    if (line.length <= exports.MAX_SHOWN_COMMAND)
+        return { text: line, hidden: 0 };
+    const hidden = line.length - COMMAND_HEAD - COMMAND_TAIL;
+    return {
+        text: `${line.slice(0, COMMAND_HEAD)} … [${hidden} characters not shown] … ${line.slice(-COMMAND_TAIL)}`,
+        hidden
+    };
+}
+function notShownInFull(command) {
+    return (`Not shown in full: this command is ${oneLine(command).length} characters ` +
+        'long. Deny it unless you know what it runs.');
+}
+/** Words about the request (why, what a server says), not what will run. */
+function note(value) {
+    const line = oneLine(value);
+    return line.length <= exports.MAX_SHOWN_NOTE
+        ? line
+        : `${line.slice(0, exports.MAX_SHOWN_NOTE)} … (shortened, ${line.length - exports.MAX_SHOWN_NOTE} more characters)`;
+}
+/** `/work/space/src/a.ts` in `/work/space` → `src/a.ts`. Others unchanged. */
+function relativeTo(workspaceDir, path) {
+    const root = (workspaceDir ?? '').replace(/\/+$/, '');
+    if (!root)
+        return path;
+    // A path that climbs (`/work/space/../../etc/passwd`) is not inside the
+    // workspace whatever it starts with. Shown as it is.
+    if (/(^|\/)\.\.?(\/|$)/.test(path.replace(/\/\.$/, '')))
+        return path;
+    // macOS reports the same directory as /tmp/… and /private/tmp/….
+    for (const prefix of [
+        root,
+        `/private${root}`,
+        root.replace(/^\/private/, '')
+    ]) {
+        if (prefix && path.startsWith(`${prefix}/`)) {
+            return path.slice(prefix.length + 1);
+        }
+    }
+    return path;
+}
+function countDiff(diff) {
+    let added = 0;
+    let removed = 0;
+    for (const line of diff.split('\n')) {
+        if (line.startsWith('+++') || line.startsWith('---'))
+            continue;
+        if (line.startsWith('+'))
+            added += 1;
+        else if (line.startsWith('-'))
+            removed += 1;
+    }
+    return { added, removed };
+}
+function changeKind(value) {
+    if (typeof value === 'string')
+        return value;
+    if (isRecord(value)) {
+        return text(value.type) || Object.keys(value)[0] || 'update';
+    }
+    return 'update';
+}
+/**
+ * The files of a change, from either shape Codex uses:
+ *   v2 item       `changes: [{ path, kind: { type }, diff }]`
+ *   older request `fileChanges: { [path]: { add | delete | update: {…} } }`
+ */
+function readFileChanges(source) {
+    if (Array.isArray(source)) {
+        const changes = [];
+        for (const entry of source) {
+            if (!isRecord(entry) || !text(entry.path))
+                continue;
+            const diff = text(entry.diff);
+            const kind = changeKind(entry.kind);
+            // A new file's "diff" is its whole content, without `+` marks.
+            const counted = kind === 'add' && diff && !/^[+-]/m.test(diff)
+                ? { added: diff.split('\n').length, removed: 0 }
+                : countDiff(diff);
+            changes.push({ path: text(entry.path), kind, ...counted });
+        }
+        return changes;
+    }
+    if (isRecord(source)) {
+        return Object.entries(source).map(([path, change]) => {
+            const kind = changeKind(change);
+            const body = isRecord(change) && isRecord(change[kind]) ? change[kind] : {};
+            const diff = text(body.unified_diff) || text(body.diff);
+            const content = text(body.content);
+            return {
+                path,
+                kind,
+                ...(diff
+                    ? countDiff(diff)
+                    : { added: content ? content.split('\n').length : 0, removed: 0 })
+            };
+        });
+    }
+    return [];
+}
+function verbFor(kind) {
+    if (kind === 'add')
+        return 'Create';
+    if (kind === 'delete')
+        return 'Delete';
+    return 'Write';
+}
+function changeSummary(change) {
+    if (change.kind === 'delete')
+        return '';
+    const parts = [];
+    if (change.added)
+        parts.push(`+${change.added}`);
+    if (change.removed)
+        parts.push(`−${change.removed}`);
+    return parts.length ? ` (${parts.join(' ')})` : '';
+}
+function describeFileChanges(changes) {
+    if (changes.length === 0)
+        return ['Write: files in the workspace'];
+    if (changes.length === 1) {
+        const [only] = changes;
+        return [`${verbFor(only.kind)}: ${only.path}${changeSummary(only)}`];
+    }
+    const kinds = new Set(changes.map((change) => change.kind));
+    const verb = kinds.size === 1 ? verbFor(changes[0].kind) : 'Change';
+    const lines = [`${verb}: ${changes.length} files`];
+    for (const change of changes.slice(0, MAX_LISTED_PATHS)) {
+        // Said once in the first line when every file is the same kind of change.
+        const mark = kinds.size === 1
+            ? ''
+            : change.kind === 'add'
+                ? 'new'
+                : change.kind === 'delete'
+                    ? 'deleted'
+                    : '';
+        lines.push(`• ${change.path}${changeSummary(change)}${mark ? ` — ${mark}` : ''}`);
+    }
+    if (changes.length > MAX_LISTED_PATHS) {
+        lines.push(`• and ${changes.length - MAX_LISTED_PATHS} more`);
+    }
+    return lines;
+}
+/**
+ * `/bin/zsh -lc 'npm test'` → `npm test`. Codex runs every command through a
+ * login shell; the wrapper is the same every time and hides the command. Only
+ * the plain one-quoted form is unwrapped, so nothing is ever shown that is not
+ * literally what the shell will be given.
+ */
+function unwrapShell(command) {
+    // SINGLE quotes only: inside them the shell changes nothing, so the inner
+    // text is exactly the command. Inside double quotes it would still expand
+    // `$(…)`, backticks and variables, and the card would not show what runs.
+    const match = /^(?:\/(?:usr\/)?bin\/)?(?:zsh|bash|sh) -l?c '([\s\S]*)'$/.exec(command.trim());
+    if (!match)
+        return command;
+    const inner = match[1];
+    return inner.includes("'") ? command : inner;
+}
+function commandText(value) {
+    if (Array.isArray(value)) {
+        return value
+            .filter((part) => typeof part === 'string')
+            .join(' ');
+    }
+    return text(value);
+}
+function describePermissions(permissions) {
+    const lines = [];
+    if (!isRecord(permissions))
+        return lines;
+    if (isRecord(permissions.network) && permissions.network.enabled === true) {
+        lines.push('• network access');
+    }
+    if (isRecord(permissions.fileSystem)) {
+        const fileSystem = permissions.fileSystem;
+        const list = (key, label) => {
+            const paths = Array.isArray(fileSystem[key])
+                ? fileSystem[key].filter((path) => typeof path === 'string')
+                : [];
+            for (const path of paths)
+                lines.push(`• ${label} ${path}`);
+        };
+        list('write', 'write to');
+        list('read', 'read');
+        if (Array.isArray(fileSystem.entries)) {
+            for (const entry of fileSystem.entries) {
+                if (!isRecord(entry))
+                    continue;
+                const path = isRecord(entry.path)
+                    ? text(entry.path.path) || JSON.stringify(entry.path)
+                    : text(entry.path);
+                const access = text(entry.access) || 'access';
+                if (path)
+                    lines.push(`• ${access} ${path}`);
+            }
+        }
+    }
+    return lines;
+}
+/** `item/somethingNew/requestApproval` → "something new". */
+function humanise(method) {
+    const words = method
+        .replace(/^item\//, '')
+        .replace(/\/?(requestApproval|request)$/i, '')
+        .replace(/Approval$/i, '')
+        .replace(/[/_]/g, ' ')
+        .replace(/([a-z])([A-Z])/g, '$1 $2')
+        .trim()
+        .toLowerCase();
+    return words || 'an action';
+}
+/**
+ * The text of one approval request.
+ *
+ * @param item the thread item the request is about, when the adapter has seen
+ *   it (`item/started` arrives before the request). A file change's paths are
+ *   only there.
+ */
+function describeCodexApproval(method, params, item, 
+/** The session's workspace; paths inside it are shown relative to it. */
+workspaceDir) {
+    const reason = text(params.reason);
+    const lines = [];
+    const shown = (path) => relativeTo(workspaceDir, path);
+    if (method === 'item/commandExecution/requestApproval' ||
+        method === 'execCommandApproval') {
+        const command = unwrapShell(commandText(params.command) || commandText(item?.command) || '');
+        const network = isRecord(params.networkApprovalContext)
+            ? params.networkApprovalContext
+            : null;
+        const capped = shownCommand(command);
+        if (params.kind === 'writeStdin') {
+            lines.push(`Send input to a running command: ${capped.text}`);
+            if (capped.hidden)
+                lines.push(notShownInFull(command));
+        }
+        else if (command) {
+            lines.push(`Run: ${capped.text}`);
+            // Straight under the command, before anything else that could push it
+            // out of sight.
+            if (capped.hidden)
+                lines.push(notShownInFull(command));
+        }
+        else if (network) {
+            lines.push(`Network access: ${text(network.host)}`);
+        }
+        else {
+            lines.push('Run: a command');
+        }
+        const cwd = text(params.cwd) || text(item?.cwd);
+        // The workspace itself goes without saying; anywhere else is worth a line.
+        const where = cwd
+            ? shown(`${cwd.replace(/\/+$/, '')}/.`).replace(/\/?\.$/, '')
+            : '';
+        if (where)
+            lines.push(`In: ${where}`);
+        if (network && command) {
+            lines.push(`Network access: ${text(network.host)}${text(network.protocol) ? ` (${text(network.protocol)})` : ''}`);
+        }
+    }
+    else if (method === 'item/fileChange/requestApproval' ||
+        method === 'applyPatchApproval') {
+        lines.push(...describeFileChanges(readFileChanges(params.fileChanges ?? item?.changes).map((change) => ({
+            ...change,
+            path: shown(change.path)
+        }))));
+        const root = text(params.grantRoot);
+        if (root)
+            lines.push(`Also asks to write under: ${root}`);
+    }
+    else if (method === 'item/permissions/requestApproval') {
+        const wanted = describePermissions(params.permissions);
+        lines.push('Grant more access for this turn');
+        lines.push(...(wanted.length ? wanted : ['• wider sandbox access']));
+        const cwd = text(params.cwd);
+        if (cwd)
+            lines.push(`In: ${cwd}`);
+    }
+    else if (method === 'mcpServer/elicitation/request') {
+        const server = text(params.serverName) || 'An MCP server';
+        const message = text(params.message);
+        lines.push(message
+            ? `${server} asks: ${note(message)}`
+            : `${server} asks to continue`);
+        const url = text(params.url);
+        if (url)
+            lines.push(`Opens: ${url}`);
+    }
+    else if (method === 'item/tool/requestUserInput') {
+        const first = Array.isArray(params.questions) ? params.questions[0] : null;
+        const question = isRecord(first)
+            ? text(first.question) || text(first.header)
+            : '';
+        lines.push(question ? `Codex asks: ${note(question)}` : 'Codex asks a question');
+    }
+    else {
+        // A kind this build does not know. Say what is asked in plain words and
+        // show what the request itself says about it, never the method name alone.
+        const command = commandText(params.command);
+        lines.push(`Codex asks to approve: ${humanise(method)}`);
+        if (command) {
+            lines.push(`Command: ${shownCommand(command).text}`);
+            if (shownCommand(command).hidden)
+                lines.push(notShownInFull(command));
+        }
+        const cwd = text(params.cwd);
+        if (cwd)
+            lines.push(`In: ${cwd}`);
+    }
+    if (reason)
+        lines.push(`Reason: ${note(reason)}`);
+    return lines.join('\n');
+}

package/dist/runtime/session-runner.d.ts

@@ -277,6 +277,35 @@ export declare function decodeQuestionAnswers(answer: string | undefined): Recor
  * Codex's "Allow" read as a denial.
  */
 export declare function isApprovingOptionId(optionId: string): boolean;
+/**
+ * Decide what a user's answer actually means, and fail closed when it is not
+ * clear.
+ *
+ * THREE PATHS REACH HERE AND THEY DO NOT CARRY THE SAME INFORMATION:
+ *
+ *   1. An option BUTTON in the question card. Sends `optionId`. Unambiguous,
+ *      and this is the ordinary case.
+ *   2. The card's Reject button. Sends no `optionId` and the fixed text
+ *      "Rejected by the user."
+ *   3. The COMPOSER. When a question is open, typing a message posts it as an
+ *      answer instead (composer.tsx:76-106) — with no `optionId` at all.
+ *
+ * So free text has to be interpreted, and the rule is: interpret it only when
+ * it plainly matches something the backend offered. Anything else DENIES, and
+ * says so in the transcript rather than silently doing the safer thing without
+ * telling the user why they are being asked again.
+ */
+export declare function resolveApproval(command: {
+    answer?: string;
+    optionId?: string;
+}, open: {
+    knownOptionIds: Set<string>;
+    optionIdByLabel: Map<string, string>;
+}): {
+    approved: boolean;
+    optionId?: string;
+    transcriptText: string;
+};
 export interface McpCheckState {
     checked: Map<string, number>;
     failed: Map<string, FailedMcpCheck>;

package/dist/runtime/session-runner.js

@@ -29,6 +29,7 @@ exports.modelGatewayRefusal = modelGatewayRefusal;
 exports.permissionFingerprint = permissionFingerprint;
 exports.decodeQuestionAnswers = decodeQuestionAnswers;
 exports.isApprovingOptionId = isApprovingOptionId;
+exports.resolveApproval = resolveApproval;
 const node_crypto_1 = require("node:crypto");
 const model_gateway_1 = require("../adapters/model-gateway");
 const contract_1 = require("../contract");
@@ -1869,7 +1870,11 @@ class SessionRunner {
                         question: approval.question,
                         options: approval.options.map((option) => ({
                             id: option.optionId,
-                            label: option.name
+                            label: option.name,
+                            // Whether this answer says yes, decided HERE by the same rule
+                            // that will read the answer back. The card colours its buttons
+                            // from this and never from the words on them.
+                            kind: isApprovingOptionId(option.optionId) ? 'allow' : 'reject'
                         }))
                     }
                 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.9-rc.5",
+  "version": "0.2.9-rc.7",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",