@wix/pathgrade 1.0.14 → 1.0.15

package/dist/agents/codex-app-server/agent.js

@@ -4,11 +4,13 @@ import { assertMcpSecretReferencesReady } from '../../providers/mcp-config.js';
 import { buildSummary, enrichSkillEvents, extractSkillNameFromPath, inferCodexExecAction, } from '../../tool-events.js';
 import { requireAskBusForLiveBatches } from '../../sdk/ask-bus/bus.js';
 import { toAskUserToolEvent } from '../../sdk/ask-bus/projection.js';
-import { decideMcpToolCall, redactMcpSecrets, } from '../../sdk/mcp-safety.js';
+import { decideMcpToolCall } from '../../sdk/mcp-safety.js';
+import { attachOriginalMcpInput } from '../../sdk/mcp-event-input.js';
 import { spawnAppServerTransport, } from './transport.js';
 import { normalizeUpstreamQuestion, toWireAnswerMap, } from './wire-translators.js';
 import { extractTurnCompletionFailure } from './turn-completion.js';
 import { resolveCodexModel } from '../codex-model.js';
+import { CodexMcpApprovalCorrelator, extractMcpToolApprovalRequest, hasScriptedApprovalPolicy, isMcpToolCallApprovalRequest, recordPolicyDeniedMcpToolCall } from './mcp-approval-correlator.js';
 const TURN_COMPLETED_METHOD = 'turn/completed';
 function recordFromUnknown(value) {
     if (value && typeof value === 'object' && !Array.isArray(value)) {
@@ -16,32 +18,6 @@ function recordFromUnknown(value) {
     }
     return {};
 }
-function isMcpToolCallApprovalRequest(params) {
-    const meta = recordFromUnknown(recordFromUnknown(params)._meta);
-    return meta.codex_approval_kind === 'mcp_tool_call';
-}
-function extractMcpToolApprovalRequest(params) {
-    if (!isMcpToolCallApprovalRequest(params))
-        return undefined;
-    const record = recordFromUnknown(params);
-    const meta = recordFromUnknown(record._meta);
-    const serverName = typeof record.serverName === 'string' ? record.serverName : undefined;
-    const toolName = typeof meta.toolName === 'string' ? meta.toolName
-        : typeof meta.tool_name === 'string' ? meta.tool_name
-            : typeof meta.name === 'string' ? meta.name
-                : typeof record.message === 'string' ? parseToolNameFromApprovalMessage(record.message)
-                    : undefined;
-    if (!serverName || !toolName)
-        return undefined;
-    return {
-        serverName,
-        toolName,
-        arguments: recordFromUnknown(meta.tool_params),
-    };
-}
-function parseToolNameFromApprovalMessage(message) {
-    return message.match(/tool\s+"([^"]+)"/i)?.[1];
-}
 function extractCommandActionSkillName(action) {
     if (typeof action.path === 'string') {
         const direct = extractSkillNameFromPath(action.path);
@@ -127,12 +103,16 @@ function projectItemIntoTurn(item, turn) {
     }
     if (item.type === 'mcpToolCall') {
         const call = item;
+        if (turn.nonAskToolEvents.some((event) => event.action === 'mcp_tool_call'
+            && event.toolUseId === call.id && event.mcp?.invocation === 'not_invoked'))
+            return;
         const args = recordFromUnknown(call.arguments);
         const providerToolName = `${call.server}.${call.tool}`;
-        turn.nonAskToolEvents.push({
+        turn.nonAskToolEvents.push(attachOriginalMcpInput({
             action: 'mcp_tool_call',
             provider: 'codex',
             providerToolName,
+            toolUseId: call.id,
             turnNumber: turn.turnNumber,
             arguments: {
                 ...args,
@@ -143,7 +123,8 @@ function projectItemIntoTurn(item, turn) {
             summary: `MCP tool ${providerToolName} ${call.status ?? 'unknown'}`,
             confidence: 'high',
             rawSnippet: JSON.stringify(call),
-        });
+            ...(call.result !== undefined ? { result: { content: JSON.stringify(call.result) } } : {}),
+        }, args));
         return;
     }
 }
@@ -167,36 +148,13 @@ function projectMcpStartupStatusIntoTurn(params, turn) {
     });
     if (status === 'failed') {
         const message = `MCP server ${name} failed to start${error ? `: ${error}` : ''}`;
-        turn.turnFailed = true;
-        turn.failureMessage = message;
-        turn.signalFailure?.(message);
+        failTurn(turn, message);
     }
 }
-function recordPolicyDeniedMcpToolCall(turn, request, decision, rawParams) {
-    if (!turn)
-        return;
-    const args = redactMcpSecrets(request.arguments);
-    const providerToolName = `${request.serverName}.${request.toolName}`;
-    turn.nonAskToolEvents.push({
-        action: 'mcp_tool_call',
-        provider: 'codex',
-        providerToolName,
-        turnNumber: turn.turnNumber,
-        arguments: {
-            ...args,
-            server: request.serverName,
-            tool: request.toolName,
-            status: 'policy_denied',
-            policyResult: {
-                action: 'deny',
-                reason: decision.reason,
-                message: decision.message,
-            },
-        },
-        summary: `MCP tool ${providerToolName} policy_denied`,
-        confidence: 'high',
-        rawSnippet: JSON.stringify(redactMcpSecrets(rawParams)),
-    });
+function failTurn(turn, message) {
+    turn.turnFailed = true;
+    turn.failureMessage = message;
+    turn.signalFailure?.(message);
 }
 function isLiveMcpSafetyMode(options) {
     const runMode = options?.runMode ?? 'mock';
@@ -220,13 +178,19 @@ export class CodexAppServerAgent extends BaseAgent {
         let closeInfo = null;
         let activeTurn = null;
         let disposed = false;
+        let codexUserAgent = 'unknown';
+        const scriptedHost = options?.scriptedMcpHost;
+        const correlator = scriptedHost
+            ? new CodexMcpApprovalCorrelator(scriptedHost, () => turnCounter, () => threadId, () => options?.getRemainingMs?.() ?? Number.POSITIVE_INFINITY)
+            : undefined;
         const ensureTransport = async () => {
             if (disposed)
                 throw new Error('CodexAppServerAgent session disposed');
             if (handle)
                 return handle.transport;
             const factory = this.deps.createTransport
-                ?? (async (ctx) => spawnAppServerTransport({ cwd: ctx.workspacePath, env: ctx.env }));
+                ?? (async (ctx) => spawnAppServerTransport({ cwd: ctx.workspacePath, env: ctx.env,
+                    args: scriptedHost ? ['--enable', 'tool_call_mcp_elicitation'] : [] }));
             handle = await factory({ workspacePath, env: runtimeEnv });
             const transport = handle.transport;
             transport.onServerRequest((req) => this.dispatchServerRequest(req, {
@@ -235,6 +199,8 @@ export class CodexAppServerAgent extends BaseAgent {
                 activeTurn: () => activeTurn,
                 onPermissionGrant: this.deps.onPermissionGrant,
                 mcpSafety: options?.mcpSafety,
+                scriptedHost,
+                correlator,
             }));
             transport.onClose((info) => {
                 closeInfo = info;
@@ -250,20 +216,37 @@ export class CodexAppServerAgent extends BaseAgent {
                     }
                     return;
                 }
-                if (n.method !== 'item/completed')
-                    return;
                 const turn = activeTurn;
                 if (!turn)
                     return;
                 const params = n.params;
+                if (n.method === 'item/started') {
+                    try {
+                        correlator?.started(n.params);
+                    }
+                    catch (error) {
+                        failTurn(turn, error instanceof Error ? error.message : String(error));
+                    }
+                    return;
+                }
+                if (n.method !== 'item/completed')
+                    return;
                 if (!params?.item)
                     return;
-                projectItemIntoTurn(params.item, turn);
+                try {
+                    if (correlator?.completed(params) !== false)
+                        projectItemIntoTurn(params.item, turn);
+                }
+                catch (error) {
+                    failTurn(turn, error instanceof Error ? error.message : String(error));
+                }
             });
-            await transport.sendRequest('initialize', {
+            const initialized = await transport.sendRequest('initialize', {
                 clientInfo: { name: 'pathgrade', version: '0.5.0', title: null },
                 capabilities: { experimentalApi: true, optOutNotificationMethods: null },
             });
+            if (typeof initialized.userAgent === 'string')
+                codexUserAgent = initialized.userAgent.slice(0, 200);
             // Upstream ClientNotification = { method: "initialized" }: send it
             // before any thread/start so the handshake matches the v0.124
             // contract and is forward-compatible with servers that enforce it.
@@ -281,6 +264,7 @@ export class CodexAppServerAgent extends BaseAgent {
                 turnFailed: false,
             };
             activeTurn = turn;
+            correlator?.beginTurn();
             try {
                 if (threadId === null) {
                     if (options?.mcpConfigPath && isLiveMcpSafetyMode(options.mcpSafety)) {
@@ -290,13 +274,16 @@ export class CodexAppServerAgent extends BaseAgent {
                             env: runtimeEnv,
                         });
                     }
-                    const mcpConfig = options?.mcpConfigPath
+                    const mcpConfig = scriptedHost?.codexConfig ?? (options?.mcpConfigPath
                         ? await mountMcpForCodexAppServer({
                             workspacePath,
                             mcpConfigPath: options.mcpConfigPath,
                         })
-                        : undefined;
-                    const resp = await t.sendRequest('thread/start', buildThreadStartParams({ cwd: workspacePath, model, sandboxMode, mcpConfig }));
+                        : undefined);
+                    const resp = await t.sendRequest('thread/start', buildThreadStartParams({ cwd: workspacePath, model, sandboxMode, mcpConfig, scripted: !!scriptedHost }));
+                    if (scriptedHost && !hasScriptedApprovalPolicy(resp)) {
+                        throw new Error(`Codex app-server scripted MCP approval policy drift (userAgent=${codexUserAgent})`);
+                    }
                     threadId = resp.thread.id;
                 }
                 // Wait for TurnCompleted OR subprocess crash OR dispatcher failure.
@@ -352,8 +339,7 @@ export class CodexAppServerAgent extends BaseAgent {
                         }
                     }
                 });
-                const startTurnResp = t
-                    .sendRequest('turn/start', {
+                const startTurnResp = t.sendRequest('turn/start', {
                     threadId,
                     input: [{ type: 'text', text: message, text_elements: [] }],
                 })
@@ -369,6 +355,18 @@ export class CodexAppServerAgent extends BaseAgent {
                             : 'turn/start failed';
                     turn.signalFailure?.(msg);
                 });
+                if (scriptedHost) {
+                    const started = await startTurnResp;
+                    if (!started?.turn?.id || !threadId) {
+                        scriptedHost.failProtocol('turn/start did not return an authoritative turn id');
+                        turn.signalFailure?.('turn/start did not return an authoritative turn id');
+                    }
+                    else {
+                        if (correlator?.setAuthoritativeTurn(threadId, started.turn.id) === false) {
+                            turn.signalFailure?.('MCP lifecycle did not match the authoritative turn');
+                        }
+                    }
+                }
                 try {
                     await turnCompletion;
                 }
@@ -383,7 +381,8 @@ export class CodexAppServerAgent extends BaseAgent {
                         signal: info.signal,
                     });
                 }
-                void startTurnResp;
+                if (!scriptedHost)
+                    void startTurnResp;
                 if (turn.turnFailed) {
                     return assembleTurnResult({
                         askBus,
@@ -401,6 +400,7 @@ export class CodexAppServerAgent extends BaseAgent {
             }
             finally {
                 activeTurn = null;
+                correlator?.endTurn();
             }
         };
         const dispose = async () => {
@@ -439,12 +439,16 @@ export class CodexAppServerAgent extends BaseAgent {
         };
     }
     dispatchServerRequest(req, ctx) {
-        const { transport, askBus, activeTurn, onPermissionGrant, mcpSafety } = ctx;
+        const { transport, askBus, activeTurn, onPermissionGrant, mcpSafety, scriptedHost, correlator } = ctx;
         switch (req.method) {
             case 'item/tool/requestUserInput':
                 void handleRequestUserInput(req, { transport, askBus, activeTurn });
                 return;
             case 'item/permissions/requestApproval': {
+                if (scriptedHost) {
+                    transport.sendResponse(req.id, { permissions: {}, scope: 'turn', strictAutoReview: false });
+                    return;
+                }
                 const params = (req.params ?? {});
                 transport.sendResponse(req.id, {
                     permissions: params.permissions ?? {},
@@ -467,12 +471,25 @@ export class CodexAppServerAgent extends BaseAgent {
             case 'item/fileChange/requestApproval':
             case 'applyPatchApproval':
             case 'execCommandApproval':
-                transport.sendResponse(req.id, { decision: 'approved', scope: 'turn' });
+                transport.sendResponse(req.id, scriptedHost
+                    ? { decision: 'denied' }
+                    : { decision: 'approved', scope: 'turn' });
                 return;
             case 'item/tool/call':
                 transport.sendResponse(req.id, { status: 'declined' });
                 return;
             case 'mcpServer/elicitation/request':
+                if (scriptedHost && correlator) {
+                    void correlator.decide(req.id, req.params).then((correlated) => {
+                        activeTurn()?.nonAskToolEvents.push(...correlated.events);
+                        transport.sendResponse(req.id, {
+                            action: correlated.action,
+                            content: correlated.action === 'accept' ? {} : null,
+                            _meta: null,
+                        });
+                    });
+                    return;
+                }
                 if (isMcpToolCallApprovalRequest(req.params)) {
                     const toolRequest = extractMcpToolApprovalRequest(req.params);
                     if (toolRequest) {
@@ -502,11 +519,8 @@ export class CodexAppServerAgent extends BaseAgent {
                 const message = 'codex app-server requires OPENAI_API_KEY for pathgrade and honors OPENAI_BASE_URL when set; ChatGPT/cached auth unsupported under transport=app-server';
                 transport.sendErrorResponse(req.id, -32001, message);
                 const turn = activeTurn();
-                if (turn) {
-                    turn.turnFailed = true;
-                    turn.failureMessage = message;
-                    turn.signalFailure?.(message);
-                }
+                if (turn)
+                    failTurn(turn, message);
                 return;
             }
             default:
@@ -549,7 +563,11 @@ async function handleRequestUserInput(req, ctx) {
 function buildThreadStartParams(opts) {
     return {
         cwd: opts.cwd,
-        approvalPolicy: 'never',
+        approvalPolicy: opts.scripted ? { granular: {
+                sandbox_approval: false, rules: false, skill_approval: false,
+                request_permissions: false, mcp_elicitations: true,
+            } } : 'never',
+        ...(opts.scripted ? { approvalsReviewer: 'user' } : {}),
         sandbox: opts.sandboxMode,
         ephemeral: true,
         experimentalRawEvents: false,

package/dist/agents/codex-app-server/mcp-approval-correlator.d.ts

@@ -0,0 +1,55 @@
+import type { ToolEvent } from '../../tool-events.js';
+import type { ScriptedMcpMockHost } from '../../providers/scripted-mcp-mock-host.js';
+import { type McpToolPolicyDecision } from '../../sdk/mcp-safety.js';
+export interface CorrelatedApprovalResponse {
+    action: 'accept' | 'decline';
+    events: ToolEvent[];
+}
+export declare function isMcpToolCallApprovalRequest(params: unknown): boolean;
+export declare function hasScriptedApprovalPolicy(response: {
+    approvalPolicy?: unknown;
+    approvalsReviewer?: unknown;
+}): boolean;
+export declare function extractMcpToolApprovalRequest(params: unknown): {
+    serverName: string;
+    toolName: string;
+    arguments: Record<string, unknown>;
+} | undefined;
+export declare function recordPolicyDeniedMcpToolCall(turn: {
+    turnNumber: number;
+    nonAskToolEvents: ToolEvent[];
+} | null, request: {
+    serverName: string;
+    toolName: string;
+    arguments: Record<string, unknown>;
+}, decision: Extract<McpToolPolicyDecision, {
+    action: 'deny';
+}>, rawParams: unknown): void;
+export declare class CodexMcpApprovalCorrelator {
+    private readonly host;
+    private readonly getTurnNumber;
+    private readonly getThreadId;
+    private readonly getRemainingMs;
+    private live;
+    private terminal;
+    private decisions;
+    private active;
+    private authoritativeTurn?;
+    private authorityPromise;
+    private resolveAuthority?;
+    private waitingRequests;
+    private poisoned;
+    constructor(host: ScriptedMcpMockHost, getTurnNumber: () => number, getThreadId: () => string | null, getRemainingMs?: () => number);
+    started(params: unknown): void;
+    completed(params: unknown): boolean;
+    decide(requestId: string | number, rawParams: unknown): Promise<CorrelatedApprovalResponse>;
+    beginTurn(): void;
+    setAuthoritativeTurn(threadId: string, turnId: string): boolean;
+    endTurn(): void;
+    private protocolEvent;
+    private waitForAuthority;
+    private parseLifecycleRecord;
+    private validateLifecycleTurn;
+    private failLifecycle;
+    private poison;
+}