@wix/pathgrade 0.32.0 → 0.34.0

package/dist/agents/claude/denied-mcp-event-store.d.ts

@@ -0,0 +1,8 @@
+import type { ToolEvent } from '../../tool-events.js';
+export interface ClaudeDeniedMcpEventStore {
+    record(toolUseId: string, event: ToolEvent): void;
+    get(toolUseId: string | undefined): ToolEvent | undefined;
+    all(): ToolEvent[];
+    clear(): void;
+}
+export declare function createClaudeDeniedMcpEventStore(): ClaudeDeniedMcpEventStore;

package/dist/agents/claude/denied-mcp-event-store.js

@@ -0,0 +1,17 @@
+export function createClaudeDeniedMcpEventStore() {
+    const byToolUseId = new Map();
+    return {
+        record(toolUseId, event) {
+            byToolUseId.set(toolUseId, event);
+        },
+        get(toolUseId) {
+            return toolUseId ? byToolUseId.get(toolUseId) : undefined;
+        },
+        all() {
+            return [...byToolUseId.values()];
+        },
+        clear() {
+            byToolUseId.clear();
+        },
+    };
+}

package/dist/agents/claude/mcp-tool-name.d.ts

@@ -0,0 +1,12 @@
+import type { McpPolicyDenialReason } from '../../sdk/mcp-safety.js';
+export type ClaudeSdkMcpToolNameParseResult = {
+    kind: 'non_mcp';
+} | {
+    kind: 'mcp';
+    server: string;
+    tool: string;
+} | {
+    kind: 'unrecognized';
+    reason: Extract<McpPolicyDenialReason, 'unrecognized_mcp_tool_name'>;
+};
+export declare function parseClaudeSdkMcpToolName(providerToolName: string, configuredServerNames: readonly string[]): ClaudeSdkMcpToolNameParseResult;

package/dist/agents/claude/mcp-tool-name.js

@@ -0,0 +1,22 @@
+const MCP_TOOL_PREFIX = 'mcp__';
+export function parseClaudeSdkMcpToolName(providerToolName, configuredServerNames) {
+    if (!providerToolName.startsWith(MCP_TOOL_PREFIX))
+        return { kind: 'non_mcp' };
+    const body = providerToolName.slice(MCP_TOOL_PREFIX.length);
+    const matches = configuredServerNames
+        .filter((serverName) => {
+        if (serverName.length === 0)
+            return false;
+        const toolStart = `${serverName}__`;
+        return body.startsWith(toolStart) && body.length > toolStart.length;
+    })
+        .sort((a, b) => b.length - a.length);
+    if (matches.length !== 1) {
+        return { kind: 'unrecognized', reason: 'unrecognized_mcp_tool_name' };
+    }
+    const server = matches[0];
+    const tool = body.slice(server.length + 2);
+    if (!tool)
+        return { kind: 'unrecognized', reason: 'unrecognized_mcp_tool_name' };
+    return { kind: 'mcp', server, tool };
+}

package/dist/agents/claude/sdk-message-projector.d.ts

@@ -18,6 +18,7 @@
 import type { SDKMessage } from '@anthropic-ai/claude-agent-sdk';
 import type { AgentTurnResult } from '../../types.js';
 import type { AskUserAnswerStore } from './ask-user-answer-store.js';
+import type { ClaudeDeniedMcpEventStore } from './denied-mcp-event-store.js';
 export interface ProjectTurnInput {
     /** Buffered typed-message stream from one `query()` call. */
     messages: SDKMessage[];
@@ -34,6 +35,10 @@ export interface ProjectTurnInput {
      * `answerSource: 'unknown'` it stamped before the bridge existed.
      */
     answerStore?: AskUserAnswerStore;
+    /** Staged MCP server names from the Claude SDK mount boundary. */
+    mcpServerNames?: readonly string[];
+    /** Policy-denied MCP events recorded by the per-turn permission bridge. */
+    deniedMcpEvents?: ClaudeDeniedMcpEventStore;
 }
 export interface ProjectedTurn {
     result: AgentTurnResult;

package/dist/agents/claude/sdk-message-projector.js

@@ -22,6 +22,7 @@ const SDK_ERROR_SUBTYPES = [
     'error_max_structured_output_retries',
 ];
 import { TOOL_NAME_MAP, buildSummary, enrichSkillEvents } from '../../tool-events.js';
+import { parseClaudeSdkMcpToolName } from './mcp-tool-name.js';
 export function projectSdkMessages(input) {
     let sessionId;
     let initSkills;
@@ -59,7 +60,9 @@ export function projectSdkMessages(input) {
                         continue;
                     }
                     if (block.type === 'tool_use') {
-                        toolEvents.push(buildToolEvent(block, input.turnNumber, input.answerStore));
+                        const event = buildToolEvent(block, input.turnNumber, input.answerStore, input.mcpServerNames ?? [], input.deniedMcpEvents);
+                        if (event)
+                            toolEvents.push(event);
                     }
                 }
                 break;
@@ -109,7 +112,10 @@ export function projectSdkMessages(input) {
     const trimmedResult = resultText.trim();
     const visible = isError ? '' : (trimmedAssistant || trimmedResult);
     const rawOutput = resultText || assistantText;
-    const enriched = enrichSkillEvents(toolEvents);
+    const enriched = enrichSkillEvents([
+        ...toolEvents,
+        ...(input.deniedMcpEvents?.all() ?? []),
+    ]);
     const finalToolEvents = prependSlashCommandSkillEvent(enriched, input.firstMessage, initSkills);
     const traceOutput = input.messages.map((m) => JSON.stringify(m)).join('\n');
     const result = {
@@ -161,10 +167,32 @@ function prependSlashCommandSkillEvent(events, firstMessage, initSkills) {
         ...events,
     ];
 }
-function buildToolEvent(block, turnNumber, answerStore) {
+function buildToolEvent(block, turnNumber, answerStore, mcpServerNames, deniedMcpEvents) {
     const providerToolName = String(block.name || 'unknown');
     const rawInput = block.input ?? undefined;
     const toolUseId = typeof block.id === 'string' ? block.id : undefined;
+    const mcpTool = parseClaudeSdkMcpToolName(providerToolName, mcpServerNames);
+    if (mcpTool.kind === 'mcp') {
+        if (deniedMcpEvents?.get(toolUseId))
+            return undefined;
+        const normalizedProviderToolName = `${mcpTool.server}.${mcpTool.tool}`;
+        const args = {
+            ...(rawInput ?? {}),
+            server: mcpTool.server,
+            tool: mcpTool.tool,
+            status: 'completed',
+        };
+        return {
+            action: 'mcp_tool_call',
+            provider: 'claude',
+            providerToolName: normalizedProviderToolName,
+            turnNumber,
+            arguments: args,
+            summary: `MCP tool ${normalizedProviderToolName} completed`,
+            confidence: 'high',
+            rawSnippet: JSON.stringify(block).slice(0, 200),
+        };
+    }
     const action = TOOL_NAME_MAP[providerToolName] ?? 'unknown';
     const args = action === 'ask_user'
         ? buildAskUserArguments(rawInput, answerStore?.get(toolUseId))

package/dist/agents/claude/sdk-options.d.ts

@@ -1,5 +1,5 @@
 import type { CanUseTool, Options, SpawnedProcess, SpawnOptions as SdkSpawnOptions } from '@anthropic-ai/claude-agent-sdk';
-import type { McpServersObject } from '../../providers/mcp-config.js';
+import type { McpServersObject } from '../../providers/mcp-runtime-mounting.js';
 export interface ClaudeSdkOptionsInputs {
     /** Per-trial workspace; cwd for the SDK so project-staged skills resolve. */
     workspacePath: string;
@@ -31,8 +31,10 @@ export interface ClaudeSdkOptionsInputs {
      * `session_id` on every turn after.
      */
     resume?: string;
-    /** MCP servers in the SDK's object form, from `loadMcpServersForSdk`. */
+    /** MCP servers in the SDK's object form, from `mountMcpForClaudeSdk`. */
     mcpServers?: McpServersObject;
+    /** Per-turn cancellation controller linked to PathGrade's turn timeout. */
+    abortController?: AbortController;
 }
 /**
  * Pick the Claude executable. Precedence:

package/dist/agents/claude/sdk-options.js

@@ -58,6 +58,8 @@ export function buildClaudeSdkOptions(inputs) {
         opts.resume = inputs.resume;
     if (inputs.mcpServers !== undefined)
         opts.mcpServers = inputs.mcpServers;
+    if (inputs.abortController !== undefined)
+        opts.abortController = inputs.abortController;
     // Env composition ownership: the driver does NOT pluck specific keys.
     // `prepareWorkspace` curates the runtime env (safe host vars, sandbox
     // HOME/TMPDIR, resolveCredentials() output, user-supplied

package/dist/agents/claude/tool-permission-bridge.d.ts

@@ -0,0 +1,18 @@
+import type { CanUseTool } from '@anthropic-ai/claude-agent-sdk';
+import type { AskBus } from '../../sdk/ask-bus/types.js';
+import { type McpSafetyOptions } from '../../sdk/mcp-safety.js';
+import type { AskUserAnswerStore } from './ask-user-answer-store.js';
+import type { ClaudeDeniedMcpEventStore } from './denied-mcp-event-store.js';
+export interface ClaudeToolPermissionBridgeDeps {
+    askBus: AskBus;
+    getTurnNumber: () => number;
+    answerStore: AskUserAnswerStore;
+    mcpServerNames: readonly string[];
+    mcpSafety?: McpSafetyOptions;
+    deniedMcpEvents?: ClaudeDeniedMcpEventStore;
+}
+export type ClaudeToolPermissionBridge = CanUseTool & {
+    lastError(): Error | null;
+    clearLastError(): void;
+};
+export declare function createClaudeToolPermissionBridge(deps: ClaudeToolPermissionBridgeDeps): ClaudeToolPermissionBridge;

package/dist/agents/claude/tool-permission-bridge.js

@@ -0,0 +1,86 @@
+import { decideMcpToolCall, redactMcpSecrets, } from '../../sdk/mcp-safety.js';
+import { createAskUserBridge, } from './ask-user-bridge.js';
+import { parseClaudeSdkMcpToolName } from './mcp-tool-name.js';
+export function createClaudeToolPermissionBridge(deps) {
+    const askUserBridge = createAskUserBridge({
+        askBus: deps.askBus,
+        getTurnNumber: deps.getTurnNumber,
+        answerStore: deps.answerStore,
+    });
+    const canUseTool = async (toolName, input, options) => {
+        if (toolName === 'AskUserQuestion') {
+            return askUserBridge(toolName, input, options);
+        }
+        const runMode = deps.mcpSafety?.runMode ?? 'mock';
+        const parsed = parseClaudeSdkMcpToolName(toolName, deps.mcpServerNames);
+        if (parsed.kind === 'non_mcp') {
+            return allow(input);
+        }
+        if (runMode === 'mock') {
+            return allow(input);
+        }
+        if (parsed.kind === 'unrecognized') {
+            return {
+                behavior: 'deny',
+                message: `unrecognized Claude SDK MCP tool name: ${toolName}`,
+            };
+        }
+        const decision = decideMcpToolCall(deps.mcpSafety, {
+            serverName: parsed.server,
+            toolName: parsed.tool,
+            arguments: asRecord(input),
+        });
+        if (decision.action === 'allow')
+            return allow(input);
+        recordDeniedMcpEvent({
+            store: deps.deniedMcpEvents,
+            toolUseId: options.toolUseID,
+            serverName: parsed.server,
+            toolName: parsed.tool,
+            input: asRecord(input),
+            decision,
+        });
+        return { behavior: 'deny', message: decision.message };
+    };
+    const bridge = canUseTool;
+    bridge.lastError = () => askUserBridge.lastError();
+    bridge.clearLastError = () => askUserBridge.clearLastError();
+    return bridge;
+}
+function allow(input) {
+    return { behavior: 'allow', updatedInput: asRecord(input) };
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function recordDeniedMcpEvent(opts) {
+    if (!opts.store)
+        return;
+    const providerToolName = `${opts.serverName}.${opts.toolName}`;
+    const args = redactMcpSecrets(opts.input);
+    const event = {
+        action: 'mcp_tool_call',
+        provider: 'claude',
+        providerToolName,
+        arguments: {
+            ...args,
+            server: opts.serverName,
+            tool: opts.toolName,
+            status: 'policy_denied',
+            policyResult: {
+                action: 'deny',
+                reason: opts.decision.reason,
+                message: opts.decision.message,
+            },
+        },
+        summary: `MCP tool ${providerToolName} policy_denied`,
+        confidence: 'high',
+        rawSnippet: JSON.stringify(redactMcpSecrets({
+            toolUseID: opts.toolUseId,
+            input: opts.input,
+        })).slice(0, 200),
+    };
+    opts.store.record(opts.toolUseId, event);
+}

package/dist/agents/claude.d.ts

@@ -8,7 +8,7 @@
  *   - `sandboxedClaudeSpawn`      — `Options.spawnClaudeCodeProcess` adapter
  *                                   that filters env and (optionally) wraps
  *                                   argv with macOS sandbox-exec.
- *   - `loadMcpServersForSdk`      — reads pathgrade's MCP config JSON into
+ *   - `mountMcpForClaudeSdk`      — reads pathgrade's MCP config JSON into
  *                                   the SDK's `Options.mcpServers` shape.
  *   - `buildClaudeSdkOptions`     — pure builder for the per-turn `Options`.
  *   - `createAskUserBridge`       — live `canUseTool` that auto-allows

package/dist/agents/claude.js

@@ -8,7 +8,7 @@
  *   - `sandboxedClaudeSpawn`      — `Options.spawnClaudeCodeProcess` adapter
  *                                   that filters env and (optionally) wraps
  *                                   argv with macOS sandbox-exec.
- *   - `loadMcpServersForSdk`      — reads pathgrade's MCP config JSON into
+ *   - `mountMcpForClaudeSdk`      — reads pathgrade's MCP config JSON into
  *                                   the SDK's `Options.mcpServers` shape.
  *   - `buildClaudeSdkOptions`     — pure builder for the per-turn `Options`.
  *   - `createAskUserBridge`       — live `canUseTool` that auto-allows
@@ -24,12 +24,27 @@
 import { query as sdkQuery, } from '@anthropic-ai/claude-agent-sdk';
 import { BaseAgent, getRuntimeEnv, getWorkspacePath, } from '../types.js';
 import { createSandboxedClaudeSpawn } from '../providers/sandboxed-claude-spawn.js';
-import { loadMcpServersForSdk } from '../providers/mcp-config.js';
+import { assertClaudeLiveMcpSafetyPreflight, assertStdioMcpServersStartForClaudeSdk, mountMcpForClaudeSdk, } from '../providers/mcp-runtime-mounting.js';
 import { buildClaudeSdkOptions, resolveClaudeCodeExecutable, } from './claude/sdk-options.js';
 import { projectSdkMessages } from './claude/sdk-message-projector.js';
-import { createAskUserBridge } from './claude/ask-user-bridge.js';
 import { createAskUserAnswerStore } from './claude/ask-user-answer-store.js';
+import { createClaudeToolPermissionBridge } from './claude/tool-permission-bridge.js';
+import { createClaudeDeniedMcpEventStore } from './claude/denied-mcp-event-store.js';
 import { requireAskBusForLiveBatches } from '../sdk/ask-bus/bus.js';
+function createLinkedAbortController(signal) {
+    const controller = new AbortController();
+    if (!signal)
+        return controller;
+    if (signal.aborted) {
+        controller.abort();
+        return controller;
+    }
+    signal.addEventListener('abort', () => controller.abort(), { once: true });
+    return controller;
+}
+function getTurnAbortSignal(sessionOptions) {
+    return sessionOptions?.getAbortSignal?.() ?? sessionOptions?.abortSignal;
+}
 export class ClaudeAgent extends BaseAgent {
     deps;
     opts;
@@ -57,7 +72,17 @@ export class ClaudeAgent extends BaseAgent {
             agentOptionsExecutable: this.opts.claudeCodeExecutable,
             envExecutable,
         });
-        const mcpServers = await loadMcpServersForSdk(workspacePath);
+        const mcpMountOptions = {
+            workspacePath,
+            mcpConfigPath: sessionOptions?.mcpConfigPath,
+            runtimeEnv: getRuntimeEnv(runtime),
+        };
+        await assertClaudeLiveMcpSafetyPreflight({
+            ...mcpMountOptions,
+            mcpSafety: sessionOptions?.mcpSafety,
+        });
+        await assertStdioMcpServersStartForClaudeSdk(mcpMountOptions);
+        const mcpServers = await mountMcpForClaudeSdk(mcpMountOptions);
         let priorSessionId;
         let turnNumber = 0;
         // The live ask-user bridge resolves AskUserQuestion through the bus
@@ -67,14 +92,24 @@ export class ClaudeAgent extends BaseAgent {
         // turn 2 cannot read a stale answer from turn 1 even on toolUseID
         // collisions.
         let answerStore = createAskUserAnswerStore();
-        const bridge = createAskUserBridge({
+        let deniedMcpEvents = createClaudeDeniedMcpEventStore();
+        const bridge = createClaudeToolPermissionBridge({
             askBus,
             getTurnNumber: () => turnNumber,
             answerStore: { record: (id, e) => answerStore.record(id, e), get: (id) => answerStore.get(id) },
+            mcpServerNames: mcpServers ? Object.keys(mcpServers) : [],
+            mcpSafety: sessionOptions?.mcpSafety,
+            deniedMcpEvents: {
+                record: (id, event) => deniedMcpEvents.record(id, event),
+                get: (id) => deniedMcpEvents.get(id),
+                all: () => deniedMcpEvents.all(),
+                clear: () => deniedMcpEvents.clear(),
+            },
         });
         const runTurn = async (message) => {
             turnNumber += 1;
             answerStore = createAskUserAnswerStore();
+            deniedMcpEvents = createClaudeDeniedMcpEventStore();
             // Clear any ask-bus rejection captured on a prior turn so a
             // stale error never causes a spurious result on this turn.
             bridge.clearLastError();
@@ -87,6 +122,7 @@ export class ClaudeAgent extends BaseAgent {
                 claudeCodeExecutable,
                 resume: priorSessionId,
                 mcpServers,
+                abortController: createLinkedAbortController(getTurnAbortSignal(sessionOptions)),
             });
             const messages = [];
             const stream = queryFn({ prompt: message, options: sdkOptions });
@@ -107,6 +143,8 @@ export class ClaudeAgent extends BaseAgent {
                 turnNumber,
                 firstMessage: projectorFirstMessage,
                 answerStore,
+                mcpServerNames: mcpServers ? Object.keys(mcpServers) : [],
+                deniedMcpEvents,
             });
             // Capture the SDK-reported session id BEFORE checking for a bus
             // rejection so the next turn's `Options.resume` points at this

package/dist/agents/codex-app-server/agent.js

@@ -1,10 +1,45 @@
 import { BaseAgent, getRuntimeEnv, getWorkspacePath, } from '../../types.js';
+import { mountMcpForCodexAppServer } from '../../providers/mcp-runtime-mounting.js';
+import { assertMcpSecretReferencesReady } from '../../providers/mcp-config.js';
 import { requireAskBusForLiveBatches, } from '../../sdk/ask-bus/bus.js';
 import { toAskUserToolEvent } from '../../sdk/ask-bus/projection.js';
+import { decideMcpToolCall, redactMcpSecrets, } from '../../sdk/mcp-safety.js';
 import { spawnAppServerTransport, } from './transport.js';
 import { normalizeUpstreamQuestion, toWireAnswerMap, } from './wire-translators.js';
 const DEFAULT_MODEL = 'gpt-5.3-codex';
 const TURN_COMPLETED_METHOD = 'turn/completed';
+function recordFromUnknown(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return {};
+}
+function isMcpToolCallApprovalRequest(params) {
+    const meta = recordFromUnknown(recordFromUnknown(params)._meta);
+    return meta.codex_approval_kind === 'mcp_tool_call';
+}
+function extractMcpToolApprovalRequest(params) {
+    if (!isMcpToolCallApprovalRequest(params))
+        return undefined;
+    const record = recordFromUnknown(params);
+    const meta = recordFromUnknown(record._meta);
+    const serverName = typeof record.serverName === 'string' ? record.serverName : undefined;
+    const toolName = typeof meta.toolName === 'string' ? meta.toolName
+        : typeof meta.tool_name === 'string' ? meta.tool_name
+            : typeof meta.name === 'string' ? meta.name
+                : typeof record.message === 'string' ? parseToolNameFromApprovalMessage(record.message)
+                    : undefined;
+    if (!serverName || !toolName)
+        return undefined;
+    return {
+        serverName,
+        toolName,
+        arguments: recordFromUnknown(meta.tool_params),
+    };
+}
+function parseToolNameFromApprovalMessage(message) {
+    return message.match(/tool\s+"([^"]+)"/i)?.[1];
+}
 function projectItemIntoTurn(item, turn) {
     if (item.type === 'agentMessage') {
         const msg = item;
@@ -43,6 +78,82 @@ function projectItemIntoTurn(item, turn) {
         }
         return;
     }
+    if (item.type === 'mcpToolCall') {
+        const call = item;
+        const args = recordFromUnknown(call.arguments);
+        const providerToolName = `${call.server}.${call.tool}`;
+        turn.nonAskToolEvents.push({
+            action: 'mcp_tool_call',
+            provider: 'codex',
+            providerToolName,
+            turnNumber: turn.turnNumber,
+            arguments: {
+                ...args,
+                server: call.server,
+                tool: call.tool,
+                status: call.status ?? 'unknown',
+            },
+            summary: `MCP tool ${providerToolName} ${call.status ?? 'unknown'}`,
+            confidence: 'high',
+            rawSnippet: JSON.stringify(call),
+        });
+        return;
+    }
+}
+function projectMcpStartupStatusIntoTurn(params, turn) {
+    const name = params.name ?? 'unknown';
+    const status = params.status ?? 'unknown';
+    const error = typeof params.error === 'string' ? params.error : undefined;
+    turn.nonAskToolEvents.push({
+        action: 'unknown',
+        provider: 'codex',
+        providerToolName: 'mcpServer/startupStatus/updated',
+        turnNumber: turn.turnNumber,
+        arguments: {
+            name,
+            status,
+            ...(error ? { error } : {}),
+        },
+        summary: `MCP server ${name} startup ${status}`,
+        confidence: 'high',
+        rawSnippet: JSON.stringify(params),
+    });
+    if (status === 'failed') {
+        const message = `MCP server ${name} failed to start${error ? `: ${error}` : ''}`;
+        turn.turnFailed = true;
+        turn.failureMessage = message;
+        turn.signalFailure?.(message);
+    }
+}
+function recordPolicyDeniedMcpToolCall(turn, request, decision, rawParams) {
+    if (!turn)
+        return;
+    const args = redactMcpSecrets(request.arguments);
+    const providerToolName = `${request.serverName}.${request.toolName}`;
+    turn.nonAskToolEvents.push({
+        action: 'mcp_tool_call',
+        provider: 'codex',
+        providerToolName,
+        turnNumber: turn.turnNumber,
+        arguments: {
+            ...args,
+            server: request.serverName,
+            tool: request.toolName,
+            status: 'policy_denied',
+            policyResult: {
+                action: 'deny',
+                reason: decision.reason,
+                message: decision.message,
+            },
+        },
+        summary: `MCP tool ${providerToolName} policy_denied`,
+        confidence: 'high',
+        rawSnippet: JSON.stringify(redactMcpSecrets(rawParams)),
+    });
+}
+function isLiveMcpSafetyMode(options) {
+    const runMode = options?.runMode ?? 'mock';
+    return runMode === 'live-readonly' || runMode === 'live-sandbox' || runMode === 'live';
 }
 export class CodexAppServerAgent extends BaseAgent {
     deps;
@@ -76,6 +187,7 @@ export class CodexAppServerAgent extends BaseAgent {
                 askBus,
                 activeTurn: () => activeTurn,
                 onPermissionGrant: this.deps.onPermissionGrant,
+                mcpSafety: options?.mcpSafety,
             }));
             transport.onClose((info) => {
                 closeInfo = info;
@@ -84,6 +196,13 @@ export class CodexAppServerAgent extends BaseAgent {
                 if (process.env.PATHGRADE_CODEX_DEBUG) {
                     console.error(`[codex app-server] notification method=${n.method} params=${JSON.stringify(n.params).slice(0, 300)}`);
                 }
+                if (n.method === 'mcpServer/startupStatus/updated') {
+                    const turn = activeTurn;
+                    if (turn) {
+                        projectMcpStartupStatusIntoTurn((n.params ?? {}), turn);
+                    }
+                    return;
+                }
                 if (n.method !== 'item/completed')
                     return;
                 const turn = activeTurn;
@@ -117,7 +236,20 @@ export class CodexAppServerAgent extends BaseAgent {
             activeTurn = turn;
             try {
                 if (threadId === null) {
-                    const resp = await t.sendRequest('thread/start', buildThreadStartParams({ cwd: workspacePath, model, sandboxMode }));
+                    if (options?.mcpConfigPath && isLiveMcpSafetyMode(options.mcpSafety)) {
+                        await assertMcpSecretReferencesReady({
+                            workspacePath,
+                            mcpConfigPath: options.mcpConfigPath,
+                            env: runtimeEnv,
+                        });
+                    }
+                    const mcpConfig = options?.mcpConfigPath
+                        ? await mountMcpForCodexAppServer({
+                            workspacePath,
+                            mcpConfigPath: options.mcpConfigPath,
+                        })
+                        : undefined;
+                    const resp = await t.sendRequest('thread/start', buildThreadStartParams({ cwd: workspacePath, model, sandboxMode, mcpConfig }));
                     threadId = resp.thread.id;
                 }
                 // Wait for TurnCompleted OR subprocess crash OR dispatcher failure.
@@ -155,6 +287,9 @@ export class CodexAppServerAgent extends BaseAgent {
                         turn.failureMessage = msg;
                         resolve();
                     };
+                    if (turn.turnFailed) {
+                        turn.signalFailure(turn.failureMessage ?? 'turn failed');
+                    }
                     // If already closed, settle immediately.
                     if (closeInfo) {
                         if (!settled) {
@@ -254,7 +389,7 @@ export class CodexAppServerAgent extends BaseAgent {
         };
     }
     dispatchServerRequest(req, ctx) {
-        const { transport, askBus, activeTurn, onPermissionGrant } = ctx;
+        const { transport, askBus, activeTurn, onPermissionGrant, mcpSafety } = ctx;
         switch (req.method) {
             case 'item/tool/requestUserInput':
                 void handleRequestUserInput(req, { transport, askBus, activeTurn });
@@ -288,7 +423,30 @@ export class CodexAppServerAgent extends BaseAgent {
                 transport.sendResponse(req.id, { status: 'declined' });
                 return;
             case 'mcpServer/elicitation/request':
-                transport.sendResponse(req.id, { action: 'decline' });
+                if (isMcpToolCallApprovalRequest(req.params)) {
+                    const toolRequest = extractMcpToolApprovalRequest(req.params);
+                    if (toolRequest) {
+                        const decision = decideMcpToolCall(mcpSafety, toolRequest);
+                        if (decision.action === 'deny') {
+                            recordPolicyDeniedMcpToolCall(activeTurn(), toolRequest, decision, req.params);
+                            transport.sendResponse(req.id, {
+                                action: 'decline',
+                                content: null,
+                                _meta: {
+                                    pathgrade_policy_denial: {
+                                        reason: decision.reason,
+                                        message: decision.message,
+                                    },
+                                },
+                            });
+                            return;
+                        }
+                    }
+                    transport.sendResponse(req.id, { action: 'accept', content: {}, _meta: null });
+                }
+                else {
+                    transport.sendResponse(req.id, { action: 'decline', content: null, _meta: null });
+                }
                 return;
             case 'account/chatgptAuthTokens/refresh': {
                 const message = 'codex app-server requires OPENAI_API_KEY for pathgrade and honors OPENAI_BASE_URL when set; ChatGPT/cached auth unsupported under transport=app-server';
@@ -347,6 +505,7 @@ function buildThreadStartParams(opts) {
         experimentalRawEvents: false,
         persistExtendedHistory: false,
         model: opts.model,
+        ...(opts.mcpConfig ? { config: opts.mcpConfig } : {}),
     };
 }
 function assembleTurnResult(args) {

package/dist/agents/codex.js

@@ -1,7 +1,11 @@
 import { TOOL_NAME_MAP, buildSummary, inferCodexExecAction, enrichSkillEvents } from '../tool-events.js';
 import { TranscriptAgent } from './transcript-agent.js';
+import { assertMcpRuntimeMountingSupportedForCodexExec } from '../providers/mcp-runtime-mounting.js';
 export class CodexAgent extends TranscriptAgent {
     async runTurn(instruction, runCommand, options) {
+        await assertMcpRuntimeMountingSupportedForCodexExec({
+            mcpConfigPath: options?.mcpConfigPath,
+        });
         const promptPath = await this.writePromptFile(instruction, runCommand);
         const command = buildCodexExecCommand(promptPath, options?.model);
         const result = await runCommand(command);