@wix/pathgrade 1.0.20 → 1.0.21

package/README.md

@@ -350,8 +350,10 @@ Read-only metadata is explicit: add `annotations.readOnlyHint: true` only when
 the operation being modeled is read-only. Unannotated and explicitly mutating
 mock tools retain the runtime's normal approval behavior.
 
-To evaluate mutation approval behavior with Claude or Codex app-server, pass a
-non-empty ordered `mcpMockApprovalRules` array. The first matching rule wins:
+To evaluate through the receipt-backed mock host with Claude or Codex
+app-server, pass an ordered `mcpMockApprovalRules` array. Use an empty array for
+read-only-only mocks. Mutation scenarios require explicit rules; the first
+matching rule wins:
 
 ```ts
 const agent = await createAgent({

package/dist/agents/codex-app-server/agent.d.ts

@@ -2,13 +2,6 @@ import { AgentCommandRunner, AgentSession, AgentSessionOptions, BaseAgent, Envir
 import { type AppServerSessionHandle } from './transport.js';
 import { type LifecycleClock } from './item-lifecycle.js';
 type SandboxMode = 'workspace-write' | 'danger-full-access';
-export interface PermissionGrantLogEntry {
-    type: 'permissions_granted';
-    turnNumber: number;
-    requested: unknown;
-    scope: 'turn';
-    strictAutoReview: false;
-}
 export interface CodexAppServerAgentDeps {
     /**
      * Inject a transport factory for tests. Default: spawn `codex app-server`
@@ -24,8 +17,6 @@ export interface CodexAppServerAgentDeps {
     }) => Promise<AppServerSessionHandle>;
     /** Sandbox mode for `thread/start`. Default: 'workspace-write'. */
     sandboxMode?: SandboxMode;
-    /** Observer for per-grant audit entries (§7 of design decisions). */
-    onPermissionGrant?: (entry: PermissionGrantLogEntry) => void;
     /** Injectable clocks keep wall timestamps and monotonic durations independently testable. */
     clock?: LifecycleClock;
     /** Inject Codex-managed ChatGPT access sessions for deterministic tests. */

package/dist/agents/codex-app-server/agent.js

@@ -1,5 +1,5 @@
 import { BaseAgent, getRuntimeEnv, getWorkspacePath, } from '../../types.js';
-import { mountMcpForCodexAppServer } from '../../providers/mcp-runtime-mounting.js';
+import { assertUnsupportedLiveMcpSafetyRuntime, mountMcpForCodexAppServer, } from '../../providers/mcp-runtime-mounting.js';
 import { assertMcpSecretReferencesReady } from '../../providers/mcp-config.js';
 import { enrichSkillEvents, } from '../../tool-events.js';
 import { collectSensitiveEnvValues, sanitizePersistenceValue, } from '../../tool-event-results.js';
@@ -7,12 +7,11 @@ import { requireAskBusForLiveBatches } from '../../sdk/ask-bus/bus.js';
 import { attachTurnResultSensitiveValues } from '../../sdk/turn-result-secrets.js';
 import { attachToolEventSensitiveValues } from '../../sdk/tool-event-secrets.js';
 import { toAskUserToolEvent } from '../../sdk/ask-bus/projection.js';
-import { decideMcpToolCall } from '../../sdk/mcp-safety.js';
 import { spawnAppServerTransport, } from './transport.js';
 import { normalizeUpstreamQuestion, toWireAnswerMap, } from './wire-translators.js';
 import { extractTurnCompletionFailure } from './turn-completion.js';
 import { resolveCodexModel } from '../codex-model.js';
-import { CodexMcpApprovalCorrelator, extractMcpToolApprovalRequest, hasScriptedApprovalPolicy, isMcpToolCallApprovalRequest, recordPolicyDeniedMcpToolCall } from './mcp-approval-correlator.js';
+import { buildLiveMcpProtocolErrorEvent, buildPolicyDeniedMcpToolEvent, CodexMcpApprovalCorrelator, consumeMatchingMcpDenial, evaluateLiveMcpApproval, hasScriptedApprovalPolicy, isMcpToolCallApprovalRequest, queuePolicyDeniedMcpToolCall, } from './mcp-approval-correlator.js';
 import { projectItemIntoTurn } from './item-projection.js';
 import { CodexItemLifecycle, } from './item-lifecycle.js';
 import { createCodexManagedAuth } from './managed-auth.js';
@@ -45,6 +44,26 @@ function failTurn(turn, message) {
     turn.failureMessage = message;
     turn.signalFailure?.(message);
 }
+function recordFromUnknown(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function projectCompletedItem(item, timing, params, turn, correlator, sensitiveValues) {
+    if (correlator?.completed(params) === false)
+        return;
+    const mcpItem = item.type === 'mcpToolCall'
+        ? item
+        : undefined;
+    const pendingDenial = mcpItem?.status === 'failed'
+        ? consumeMatchingMcpDenial(turn, mcpItem.server, mcpItem.tool, recordFromUnknown(mcpItem.arguments))
+        : undefined;
+    if (!pendingDenial || !mcpItem) {
+        projectItemIntoTurn(item, turn, sensitiveValues, timing);
+        return;
+    }
+    turn.nonAskToolEvents.push(buildPolicyDeniedMcpToolEvent(turn.turnNumber, pendingDenial, mcpItem));
+}
 function extractTurnCompletionIdentity(params) {
     if (!params || typeof params !== 'object' || Array.isArray(params))
         return {};
@@ -74,6 +93,12 @@ export class CodexAppServerAgent extends BaseAgent {
         const sensitiveValues = collectSensitiveEnvValues(runtimeEnv);
         const model = resolveCodexModel(options?.model);
         const sandboxMode = this.deps.sandboxMode ?? 'workspace-write';
+        await assertUnsupportedLiveMcpSafetyRuntime({
+            runtimeName: 'Codex app-server',
+            workspacePath,
+            mcpConfigPath: options?.mcpConfigPath,
+            mcpSafety: options?.mcpSafety,
+        });
         let handle = null;
         let threadId = null;
         let turnCounter = 0;
@@ -106,7 +131,6 @@ export class CodexAppServerAgent extends BaseAgent {
                 transport,
                 askBus,
                 activeTurn: () => activeTurn,
-                onPermissionGrant: this.deps.onPermissionGrant,
                 mcpSafety: options?.mcpSafety,
                 scriptedHost,
                 correlator,
@@ -150,7 +174,7 @@ export class CodexAppServerAgent extends BaseAgent {
                     codexUserAgent = initialized.userAgent.slice(0, 200);
                 }
                 // Upstream ClientNotification = { method: "initialized" }: send it
-                // before any thread/start so the handshake matches the v0.124
+                // before any thread/start so the handshake matches the v0.149
                 // contract and is forward-compatible with servers that enforce it.
                 transport.sendNotification('initialized', null);
                 await managedAuth.login(transport);
@@ -170,6 +194,7 @@ export class CodexAppServerAgent extends BaseAgent {
                 turnNumber: turnCounter,
                 askBatchIds: [],
                 nonAskToolEvents: [],
+                pendingMcpDenials: [],
                 assistantMessageParts: [],
                 turnFailed: false,
                 pendingTurnCompletions: [],
@@ -191,7 +216,13 @@ export class CodexAppServerAgent extends BaseAgent {
                             mcpConfigPath: options.mcpConfigPath,
                         })
                         : undefined);
-                    const resp = await t.sendRequest('thread/start', buildThreadStartParams({ cwd: workspacePath, model, sandboxMode, mcpConfig, scripted: !!scriptedHost }));
+                    const resp = await t.sendRequest('thread/start', buildThreadStartParams({
+                        cwd: workspacePath,
+                        model,
+                        sandboxMode,
+                        mcpConfig,
+                        enableMcpElicitations: !!scriptedHost || shouldEnableMcpElicitations(options),
+                    }));
                     if (scriptedHost && !hasScriptedApprovalPolicy(resp)) {
                         throw new Error(`Codex app-server scripted MCP approval policy drift (userAgent=${codexUserAgent})`);
                     }
@@ -213,9 +244,7 @@ export class CodexAppServerAgent extends BaseAgent {
                     },
                     onCompleted: (item, timing, params) => {
                         try {
-                            if (correlator?.completed(params) !== false) {
-                                projectItemIntoTurn(item, turn, sensitiveValues, timing);
-                            }
+                            projectCompletedItem(item, timing, params, turn, correlator, sensitiveValues);
                         }
                         catch (error) {
                             failTurn(turn, error instanceof Error ? error.message : String(error));
@@ -404,41 +433,25 @@ export class CodexAppServerAgent extends BaseAgent {
         };
     }
     dispatchServerRequest(req, ctx) {
-        const { transport, askBus, activeTurn, onPermissionGrant, mcpSafety, scriptedHost, correlator } = ctx;
+        const { transport, askBus, activeTurn, mcpSafety, scriptedHost, correlator } = ctx;
         switch (req.method) {
             case 'item/tool/requestUserInput':
                 void handleRequestUserInput(req, { transport, askBus, activeTurn });
                 return;
             case 'item/permissions/requestApproval': {
-                if (scriptedHost) {
-                    transport.sendResponse(req.id, { permissions: {}, scope: 'turn', strictAutoReview: false });
-                    return;
-                }
-                const params = (req.params ?? {});
-                transport.sendResponse(req.id, {
-                    permissions: params.permissions ?? {},
-                    scope: 'turn',
-                    strictAutoReview: false,
-                });
-                const turn = activeTurn();
-                if (onPermissionGrant) {
-                    onPermissionGrant({
-                        type: 'permissions_granted',
-                        turnNumber: turn?.turnNumber ?? 0,
-                        requested: params.permissions ?? {},
-                        scope: 'turn',
-                        strictAutoReview: false,
-                    });
-                }
+                transport.sendErrorResponse(req.id, -32000, 'pathgrade: permission grants are not authorized by the MCP-only approval policy');
                 return;
             }
             case 'item/commandExecution/requestApproval':
             case 'item/fileChange/requestApproval':
+                transport.sendResponse(req.id, { decision: 'decline' });
+                return;
             case 'applyPatchApproval':
             case 'execCommandApproval':
-                transport.sendResponse(req.id, scriptedHost
-                    ? { decision: 'denied' }
-                    : { decision: 'approved', scope: 'turn' });
+                transport.sendResponse(req.id, { decision: { denied: {
+                            rejection: 'Pathgrade does not authorize legacy command or patch approvals.',
+                        } },
+                });
                 return;
             case 'item/tool/call':
                 transport.sendResponse(req.id, { status: 'declined' });
@@ -456,25 +469,17 @@ export class CodexAppServerAgent extends BaseAgent {
                     return;
                 }
                 if (isMcpToolCallApprovalRequest(req.params)) {
-                    const toolRequest = extractMcpToolApprovalRequest(req.params);
-                    if (toolRequest) {
-                        const decision = decideMcpToolCall(mcpSafety, toolRequest);
-                        if (decision.action === 'deny') {
-                            recordPolicyDeniedMcpToolCall(activeTurn(), toolRequest, decision, req.params);
-                            transport.sendResponse(req.id, {
-                                action: 'decline',
-                                content: null,
-                                _meta: {
-                                    pathgrade_policy_denial: {
-                                        reason: decision.reason,
-                                        message: decision.message,
-                                    },
-                                },
-                            });
-                            return;
+                    const evaluation = evaluateLiveMcpApproval(mcpSafety, req.params);
+                    if (evaluation.denial) {
+                        queuePolicyDeniedMcpToolCall(activeTurn(), evaluation.denial.request, evaluation.denial.decision, req.params);
+                    }
+                    if (evaluation.protocolError) {
+                        const turn = activeTurn();
+                        if (turn) {
+                            turn.nonAskToolEvents.push(buildLiveMcpProtocolErrorEvent(turn.turnNumber, evaluation.protocolError, req.params));
                         }
                     }
-                    transport.sendResponse(req.id, { action: 'accept', content: {}, _meta: null });
+                    transport.sendResponse(req.id, evaluation.response);
                 }
                 else {
                     transport.sendResponse(req.id, { action: 'decline', content: null, _meta: null });
@@ -528,21 +533,32 @@ async function handleRequestUserInput(req, ctx) {
 function buildThreadStartParams(opts) {
     return {
         cwd: opts.cwd,
-        approvalPolicy: opts.scripted ? { granular: {
-                sandbox_approval: false, rules: false, skill_approval: false,
-                request_permissions: false, mcp_elicitations: true,
-            } } : 'never',
-        ...(opts.scripted ? { approvalsReviewer: 'user' } : {}),
+        approvalPolicy: opts.enableMcpElicitations
+            ? {
+                granular: {
+                    sandbox_approval: false,
+                    rules: false,
+                    skill_approval: false,
+                    request_permissions: false,
+                    mcp_elicitations: true,
+                },
+            }
+            : 'never',
+        ...(opts.enableMcpElicitations ? { approvalsReviewer: 'user' } : {}),
         sandbox: opts.sandboxMode,
         ephemeral: true,
-        experimentalRawEvents: false,
-        persistExtendedHistory: false,
         model: opts.model,
         ...(opts.mcpConfig ? { config: opts.mcpConfig } : {}),
     };
 }
+function shouldEnableMcpElicitations(options) {
+    return options?.mcpConfigOrigin === 'generated_mock';
+}
 function assembleTurnResult(args) {
     const { askBus, activeTurn, exitCode, message, pid, signal, sensitiveValues = [] } = args;
+    for (const pending of activeTurn.pendingMcpDenials.splice(0)) {
+        activeTurn.nonAskToolEvents.push(buildPolicyDeniedMcpToolEvent(activeTurn.turnNumber, pending));
+    }
     const askBatchIds = new Set(activeTurn.askBatchIds);
     const askEvents = askBus
         .snapshot()

package/dist/agents/codex-app-server/mcp-approval-correlator.d.ts

@@ -1,6 +1,30 @@
 import type { ToolEvent } from '../../tool-events.js';
 import type { ScriptedMcpMockHost } from '../../providers/scripted-mcp-mock-host.js';
-import { type McpToolPolicyDecision } from '../../sdk/mcp-safety.js';
+import { type McpSafetyOptions, type McpToolPolicyDecision } from '../../sdk/mcp-safety.js';
+export interface PendingMcpDenial {
+    request: {
+        serverName: string;
+        toolName: string;
+        arguments: Record<string, unknown>;
+    };
+    decision: Extract<McpToolPolicyDecision, {
+        action: 'deny';
+    }>;
+    rawParams: unknown;
+}
+export interface CodexMcpTerminalItem {
+    type: 'mcpToolCall';
+    id: string;
+    server: string;
+    tool: string;
+    status?: string;
+    arguments?: unknown;
+    result?: unknown;
+    error?: {
+        message?: string;
+    } | null;
+    durationMs?: number | null;
+}
 export interface CorrelatedApprovalResponse {
     action: 'accept' | 'decline';
     events: ToolEvent[];
@@ -15,9 +39,30 @@ export declare function extractMcpToolApprovalRequest(params: unknown): {
     toolName: string;
     arguments: Record<string, unknown>;
 } | undefined;
-export declare function recordPolicyDeniedMcpToolCall(turn: {
-    turnNumber: number;
-    nonAskToolEvents: ToolEvent[];
+export declare function evaluateLiveMcpApproval(safety: McpSafetyOptions | undefined, params: unknown): {
+    response: {
+        action: 'accept' | 'decline';
+        content: Record<string, never> | null;
+        _meta: {
+            pathgrade_policy_denial: {
+                reason: string;
+                message: string;
+            };
+        } | null;
+    };
+    denial?: {
+        request: NonNullable<ReturnType<typeof extractMcpToolApprovalRequest>>;
+        decision: Extract<McpToolPolicyDecision, {
+            action: 'deny';
+        }>;
+    };
+    protocolError?: {
+        reason: string;
+        message: string;
+    };
+};
+export declare function queuePolicyDeniedMcpToolCall(turn: {
+    pendingMcpDenials: PendingMcpDenial[];
 } | null, request: {
     serverName: string;
     toolName: string;
@@ -25,6 +70,14 @@ export declare function recordPolicyDeniedMcpToolCall(turn: {
 }, decision: Extract<McpToolPolicyDecision, {
     action: 'deny';
 }>, rawParams: unknown): void;
+export declare function buildPolicyDeniedMcpToolEvent(turnNumber: number, pending: PendingMcpDenial, terminal?: CodexMcpTerminalItem): ToolEvent;
+export declare function consumeMatchingMcpDenial(turn: {
+    pendingMcpDenials: PendingMcpDenial[];
+}, serverName: string, toolName: string, args: Record<string, unknown>): PendingMcpDenial | undefined;
+export declare function buildLiveMcpProtocolErrorEvent(turnNumber: number, error: {
+    reason: string;
+    message: string;
+}, rawParams: unknown): ToolEvent;
 export declare class CodexMcpApprovalCorrelator {
     private readonly host;
     private readonly getTurnNumber;

package/dist/agents/codex-app-server/mcp-approval-correlator.js

@@ -1,4 +1,4 @@
-import { redactMcpSecrets, } from '../../sdk/mcp-safety.js';
+import { decideMcpToolCall, redactMcpSecrets, } from '../../sdk/mcp-safety.js';
 import { canonicalizeJson } from '../../core/canonical-json.js';
 import { buildScriptedMcpApprovalEvent, buildScriptedMcpDeniedCallEvent, } from '../../sdk/scripted-mcp-events.js';
 function isRecord(value) {
@@ -30,18 +30,75 @@ export function extractMcpToolApprovalRequest(params) {
         return undefined;
     return { serverName, toolName, arguments: isRecord(meta.tool_params) ? meta.tool_params : {} };
 }
-export function recordPolicyDeniedMcpToolCall(turn, request, decision, rawParams) {
+export function evaluateLiveMcpApproval(safety, params) {
+    const request = extractMcpToolApprovalRequest(params);
+    if (!request) {
+        const protocolError = {
+            reason: 'unrecognized_mcp_tool_name',
+            message: 'Live MCP tool identity could not be established.',
+        };
+        return {
+            response: {
+                action: 'decline', content: null,
+                _meta: { pathgrade_policy_denial: protocolError },
+            },
+            protocolError,
+        };
+    }
+    const decision = decideMcpToolCall(safety, request);
+    if (decision.action === 'allow') {
+        return { response: { action: 'accept', content: {}, _meta: null } };
+    }
+    return {
+        response: { action: 'decline', content: null, _meta: {
+                pathgrade_policy_denial: { reason: decision.reason, message: decision.message },
+            } },
+        denial: { request, decision },
+    };
+}
+export function queuePolicyDeniedMcpToolCall(turn, request, decision, rawParams) {
     if (!turn)
         return;
-    const args = redactMcpSecrets(request.arguments);
-    const providerToolName = `${request.serverName}.${request.toolName}`;
-    turn.nonAskToolEvents.push({
-        action: 'mcp_tool_call', provider: 'codex', providerToolName, turnNumber: turn.turnNumber,
-        arguments: { ...args, server: request.serverName, tool: request.toolName, status: 'policy_denied',
-            policyResult: { action: 'deny', reason: decision.reason, message: decision.message } },
+    turn.pendingMcpDenials.push({ request, decision, rawParams });
+}
+export function buildPolicyDeniedMcpToolEvent(turnNumber, pending, terminal) {
+    const args = redactMcpSecrets(pending.request.arguments);
+    const providerToolName = `${pending.request.serverName}.${pending.request.toolName}`;
+    return {
+        action: 'mcp_tool_call', provider: 'codex', providerToolName,
+        ...(terminal ? { toolUseId: terminal.id } : {}),
+        turnNumber, status: 'error',
+        mcp: { serverName: pending.request.serverName, toolName: pending.request.toolName,
+            invocation: 'not_invoked', outcome: 'policy_denied' },
+        arguments: {
+            ...args,
+            server: pending.request.serverName,
+            tool: pending.request.toolName,
+            status: 'policy_denied',
+            policyResult: { action: 'deny', reason: pending.decision.reason, message: pending.decision.message },
+        },
         summary: `MCP tool ${providerToolName} policy_denied`, confidence: 'high',
+        rawSnippet: JSON.stringify(redactMcpSecrets(terminal ? { approval: pending.rawParams, terminal } : pending.rawParams)),
+    };
+}
+export function consumeMatchingMcpDenial(turn, serverName, toolName, args) {
+    const argsKey = canonicalizeJson(args);
+    const index = turn.pendingMcpDenials.findIndex((pending) => pending.request.serverName === serverName
+        && pending.request.toolName === toolName
+        && canonicalizeJson(pending.request.arguments) === argsKey);
+    if (index < 0)
+        return undefined;
+    return turn.pendingMcpDenials.splice(index, 1)[0];
+}
+export function buildLiveMcpProtocolErrorEvent(turnNumber, error, rawParams) {
+    return {
+        action: 'mcp_approval', provider: 'codex', providerToolName: 'mcp.protocol_error',
+        turnNumber, status: 'error',
+        arguments: { decision: 'deny', outcome: 'protocol_error', reason: error.reason,
+            message: error.message, decisionSource: 'live_policy' },
+        summary: 'MCP approval protocol error', confidence: 'high',
         rawSnippet: JSON.stringify(redactMcpSecrets(rawParams)),
-    });
+    };
 }
 export class CodexMcpApprovalCorrelator {
     host;

package/dist/agents/codex-app-server/protocol/ClientRequest.js

@@ -3,5 +3,5 @@
 // `codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts`
 // (top-level, NOT `typescript/v2/`). This module enumerates the subset of
 // method names the pathgrade Codex app-server driver actually sends. Refresh
-// from openai/codex@rust-v0.124.0 when bumping the vendored version.
+// Refreshed against openai/codex@rust-v0.149.0-alpha.4.3.
 export {};

package/dist/agents/codex-app-server/protocol/DynamicToolCallParams.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/DynamicToolCallParams.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/GrantedPermissionProfile.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/GrantedPermissionProfile.ts
 // GENERATED CODE in upstream; do not modify locally either.
 //

package/dist/agents/codex-app-server/protocol/McpElicitationRequestParams.d.ts

@@ -14,6 +14,11 @@ export type McpElicitationRequestParams = {
     _meta: JsonValue | null;
     message: string;
     requestedSchema: McpElicitationSchema;
+} | {
+    mode: 'openai/form';
+    _meta: JsonValue | null;
+    message: string;
+    requestedSchema: JsonValue;
 } | {
     mode: 'url';
     _meta: JsonValue | null;

package/dist/agents/codex-app-server/protocol/McpElicitationRequestParams.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/McpServerElicitationRequestParams.ts
 // GENERATED CODE in upstream; do not modify locally either.
 //

package/dist/agents/codex-app-server/protocol/PermissionsRequestApprovalParams.d.ts

@@ -4,6 +4,9 @@ export type PermissionsRequestApprovalParams = {
     threadId: string;
     turnId: string;
     itemId: string;
+    environmentId: string | null;
+    /** Unix timestamp (in milliseconds) when this approval request started. */
+    startedAtMs: number;
     cwd: AbsolutePathBuf;
     reason: string | null;
     permissions: RequestPermissionProfile;

package/dist/agents/codex-app-server/protocol/PermissionsRequestApprovalParams.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/PermissionsRequestApprovalParams.ts
 // GENERATED CODE in upstream; do not modify locally either.
 //

package/dist/agents/codex-app-server/protocol/PermissionsRequestApprovalResponse.d.ts

@@ -4,7 +4,7 @@ import type { GrantedPermissionProfile } from './GrantedPermissionProfile.js';
  * turn only; `'thread'` persists until the thread ends. Upstream union is
  * represented as a string literal set here.
  */
-export type PermissionGrantScope = 'turn' | 'thread';
+export type PermissionGrantScope = 'turn' | 'session';
 export type PermissionsRequestApprovalResponse = {
     permissions: GrantedPermissionProfile;
     scope: PermissionGrantScope;

package/dist/agents/codex-app-server/protocol/PermissionsRequestApprovalResponse.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/PermissionsRequestApprovalResponse.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/SandboxMode.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/SandboxMode.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/ServerRequest.js

@@ -1,6 +1,6 @@
 // Pathgrade-local composition; not a single upstream file.
-// Enumerates the 9 server-request variants the driver observes over the wire
-// under rust-v0.124.0. Upstream ships the discriminated union at
+// Enumerates the 9 server-request variants the driver supports from
+// rust-v0.149.0-alpha.4.3. Upstream ships the discriminated union at
 // `codex-rs/app-server-protocol/schema/typescript/ServerRequest.ts`
 // (top-level, NOT `typescript/v2/`); the per-variant params files this module
 // imports live under the `v2/` subdirectory.

package/dist/agents/codex-app-server/protocol/ThreadStartParams.d.ts

@@ -1,15 +1,22 @@
 import type { SandboxMode } from './SandboxMode.js';
 export type Personality = unknown;
-export type ServiceTier = unknown;
 export type JsonValue = unknown;
-export type ApprovalsReviewer = unknown;
-export type AskForApproval = unknown;
-export type PermissionProfile = unknown;
+export type ApprovalsReviewer = 'user' | 'auto_review' | 'guardian_subagent';
+export type AskForApproval = 'untrusted' | 'on-request' | {
+    granular: {
+        sandbox_approval: boolean;
+        rules: boolean;
+        skill_approval: boolean;
+        request_permissions: boolean;
+        mcp_elicitations: boolean;
+    };
+} | 'never';
 export type ThreadStartSource = unknown;
+export type ThreadSource = unknown;
 export type ThreadStartParams = {
     model?: string | null;
     modelProvider?: string | null;
-    serviceTier?: ServiceTier | null | null;
+    serviceTier?: string | null | null;
     cwd?: string | null;
     approvalPolicy?: AskForApproval | null;
     /**
@@ -18,11 +25,6 @@ export type ThreadStartParams = {
      */
     approvalsReviewer?: ApprovalsReviewer | null;
     sandbox?: SandboxMode | null;
-    /**
-     * Full permissions override for this thread. Cannot be combined with
-     * `sandbox`.
-     */
-    permissionProfile?: PermissionProfile | null;
     config?: {
         [key: string]: JsonValue | undefined;
     } | null;
@@ -33,13 +35,7 @@ export type ThreadStartParams = {
     ephemeral?: boolean | null;
     sessionStartSource?: ThreadStartSource | null;
     /**
-     * If true, opt into emitting raw Responses API items on the event stream.
-     * This is for internal use only (e.g. Codex Cloud).
-     */
-    experimentalRawEvents: boolean;
-    /**
-     * If true, persist additional rollout EventMsg variants required to
-     * reconstruct a richer thread history on resume/fork/read.
+     * Optional client-supplied analytics source classification for this thread.
      */
-    persistExtendedHistory: boolean;
+    threadSource?: ThreadSource | null;
 };

package/dist/agents/codex-app-server/protocol/ThreadStartParams.js

@@ -1,9 +1,9 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/ThreadStartParams.ts
 // GENERATED CODE in upstream; do not modify locally either.
 //
-// NOTE: upstream imports additional shared types (Personality, ServiceTier, JsonValue,
-// ApprovalsReviewer, AskForApproval, PermissionProfile, ThreadStartSource) that are not
+// NOTE: upstream imports additional shared types (Personality, JsonValue,
+// ThreadSource, ThreadStartSource) that are not
 // required by the pathgrade Codex driver. They are modelled here as opaque aliases so the
 // vendored surface compiles standalone. Refresh policy: when a new upstream version lands,
 // replace each alias with the vendored definition if the driver starts consuming it.

package/dist/agents/codex-app-server/protocol/ToolRequestUserInputAnswer.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/ToolRequestUserInputAnswer.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/ToolRequestUserInputOption.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/ToolRequestUserInputOption.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/ToolRequestUserInputParams.d.ts

@@ -7,4 +7,7 @@ export type ToolRequestUserInputParams = {
     turnId: string;
     itemId: string;
     questions: Array<ToolRequestUserInputQuestion>;
+    isBlocking: boolean;
+    /** @deprecated Use `isBlocking` to decide whether the request should block. */
+    autoResolutionMs: number | null;
 };

package/dist/agents/codex-app-server/protocol/ToolRequestUserInputParams.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/ToolRequestUserInputParams.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/ToolRequestUserInputQuestion.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/ToolRequestUserInputQuestion.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/ToolRequestUserInputResponse.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/ToolRequestUserInputResponse.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/TurnCompletedNotification.js

@@ -1,4 +1,4 @@
-// Vendored from openai/codex@rust-v0.124.0
+// Vendored from openai/codex@rust-v0.149.0-alpha.4.3
 // Source: codex-rs/app-server-protocol/schema/typescript/v2/TurnCompletedNotification.ts
 // GENERATED CODE in upstream; do not modify locally either.
 export {};

package/dist/agents/codex-app-server/protocol/index.js

@@ -1,6 +1,6 @@
 // Curated re-exports for the pathgrade Codex app-server driver and fixture
 // tests. Every re-exported symbol is either a curated upstream shape from
-// openai/codex@rust-v0.124.0 (with an upstream-citation header in its file) or
+// openai/codex@rust-v0.149.0-alpha.4.3 (with an upstream-citation header in its file) or
 // a pathgrade-local composition (ClientRequest, ServerRequest, Op) whose header
 // spells out the composition rationale.
 //

package/dist/providers/mcp-config.d.ts

@@ -1,4 +1,5 @@
 import type { MockMcpServerDescriptor } from '../core/mcp-mock.types.js';
+import type { McpConfigOrigin } from '../types.js';
 /**
  * Stdio-server shape pathgrade writes to `.pathgrade-mcp.json`. Lines up
  * directly with the SDK's `McpStdioServerConfig` (`sdk.d.ts:1005`) — the
@@ -38,5 +39,6 @@ export declare function assertMcpSecretReferencesReady(opts: {
 }): Promise<void>;
 export interface McpConfigResult {
     mcpConfigPath: string | undefined;
+    mcpConfigOrigin: McpConfigOrigin | undefined;
 }
 export declare function stageMcpConfig(workspacePath: string, mcp: McpDeclaration | undefined): Promise<McpConfigResult>;

package/dist/providers/mcp-config.js

@@ -130,7 +130,7 @@ async function resolveMockServerScript(workspacePath) {
 }
 export async function stageMcpConfig(workspacePath, mcp) {
     if (!mcp)
-        return { mcpConfigPath: undefined };
+        return { mcpConfigPath: undefined, mcpConfigOrigin: undefined };
     const mcpConfigPath = MCP_CONFIG_FILENAME;
     if ('configFile' in mcp) {
         const mcpSrc = path.resolve(mcp.configFile);
@@ -161,5 +161,8 @@ export async function stageMcpConfig(workspacePath, mcp) {
         }
         await fs.writeJson(path.join(workspacePath, mcpConfigPath), { mcpServers }, { spaces: 2 });
     }
-    return { mcpConfigPath };
+    return {
+        mcpConfigPath,
+        mcpConfigOrigin: 'mock' in mcp ? 'generated_mock' : 'caller_config',
+    };
 }

package/dist/providers/workspace.d.ts

@@ -1,9 +1,10 @@
 import { type SandboxConfig } from './sandbox.js';
-import type { CommandResult } from '../types.js';
+import type { CommandResult, McpConfigOrigin } from '../types.js';
 export type { McpDeclaration } from './mcp-config.js';
 export interface Workspace {
     readonly path: string;
     readonly mcpConfigPath: string | undefined;
+    readonly mcpConfigOrigin: McpConfigOrigin | undefined;
     readonly env: Record<string, string>;
     readonly setupCommands: string[];
     readonly sensitiveValues?: readonly string[];

package/dist/providers/workspace.js

@@ -56,11 +56,12 @@ export async function prepareWorkspace(spec) {
         await copyPathsFromHostHome(creds.copyFromHome, homePath);
         await linkPathsFromHostHome(creds.linkFromHome ?? [], homePath);
         await stageSensitiveHomeFiles(creds.sensitiveHomeFiles ?? [], homePath);
-        const { mcpConfigPath } = await stageMcpConfig(workspacePath, mcp);
+        const { mcpConfigPath, mcpConfigOrigin } = await stageMcpConfig(workspacePath, mcp);
         let disposed = false;
         return {
             path: workspacePath,
             mcpConfigPath,
+            mcpConfigOrigin,
             env: sandboxEnv,
             setupCommands: creds.setupCommands,
             sensitiveValues: [...new Set([

package/dist/sdk/judge-prompt-builder.js

@@ -1,3 +1,5 @@
+import { sanitizePersistenceValue } from '../tool-event-results.js';
+import { getToolEventSensitiveValues } from './tool-event-secrets.js';
 export function buildJudgePrompt(scorer, ctx, input) {
     const sections = [];
     sections.push(`## Session Transcript\n${ctx.transcript}`);
@@ -23,7 +25,17 @@ function formatToolEvents(ctx) {
     return ctx.toolEvents
         .map((event) => {
         const turn = event.turnNumber ? `turn ${event.turnNumber}` : 'instruction';
-        return `- ${turn}: ${event.action} via ${event.providerToolName} (${event.provider})`;
+        const sensitiveValues = getToolEventSensitiveValues(event);
+        const details = [
+            event.status ? `  status: ${event.status}` : undefined,
+            event.mcp ? `  mcp: ${JSON.stringify(event.mcp)}` : undefined,
+            event.arguments ? `  arguments: ${JSON.stringify(sanitizePersistenceValue(event.arguments, sensitiveValues))}` : undefined,
+            event.result ? `  result: ${JSON.stringify(sanitizePersistenceValue(event.result, sensitiveValues))}` : undefined,
+        ].filter((line) => line !== undefined);
+        return [
+            `- ${turn}: ${event.action} via ${event.providerToolName} (${event.provider})`,
+            ...details,
+        ].join('\n');
     })
         .join('\n');
 }

package/dist/sdk/managed-session.js

@@ -22,6 +22,7 @@ export function createManagedSession(deps) {
         ?? createAskBus({ askUserTimeoutMs: deps.askUserTimeoutMs ?? 30_000 });
     const sessionOptions = {
         ...(ws.mcpConfigPath ? { mcpConfigPath: ws.mcpConfigPath } : {}),
+        ...(ws.mcpConfigOrigin ? { mcpConfigOrigin: ws.mcpConfigOrigin } : {}),
         ...(model ? { model } : {}),
         ...(conversationWindow !== undefined ? { conversationWindow } : {}),
         ...(runtimePolicies.length > 0 ? { runtimePolicies } : {}),

package/dist/sdk/mcp-mock-approvals.js

@@ -171,8 +171,8 @@ function assertClaudeNamesUnambiguous(names) {
     }
 }
 export function compileMcpMockApprovalSession(opts) {
-    if (!Array.isArray(opts.rules) || opts.rules.length === 0) {
-        throw new Error('mcpMockApprovalRules must be a non-empty array');
+    if (!Array.isArray(opts.rules)) {
+        throw new Error('mcpMockApprovalRules must be an array');
     }
     const descriptors = (Array.isArray(opts.mcpMock) ? opts.mcpMock : [opts.mcpMock])
         .map((descriptor, index) => cloneDescriptor(descriptor, index));

package/dist/types.d.ts

@@ -352,8 +352,11 @@ export interface AgentSession {
 export declare function getWorkspacePath(handle: EnvironmentHandle): string;
 export declare function getRuntimeHandle(handle: EnvironmentHandle): string;
 export declare function getRuntimeEnv(handle: EnvironmentHandle): Record<string, string>;
+export type McpConfigOrigin = 'generated_mock' | 'caller_config';
 export interface AgentSessionOptions {
     mcpConfigPath?: string;
+    /** Authority provenance for the staged MCP configuration. */
+    mcpConfigOrigin?: McpConfigOrigin;
     model?: string;
     conversationWindow?: import('./sdk/types.js').ConversationWindowConfig | false;
     runtimePolicies?: RuntimePolicyDescriptor[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/pathgrade",
-  "version": "1.0.20",
+  "version": "1.0.21",
   "packageManager": "yarn@4.12.0",
   "description": "Evaluate whether AI agents discover and use your skills correctly",
   "exports": {
@@ -144,5 +144,5 @@
     "typescript": "^5.9.3",
     "zod": "4.3.6"
   },
-  "falconPackageHash": "4b55cfec1102172799601d1b5a3a8089a73b9c5e093a4533316f1e7c"
+  "falconPackageHash": "20beff94d0506c770c82c813225aca2ab4c0b4785199afb176f72286"
 }