codex-computer-use-mcp 0.2.0 → 0.3.0

package/ARCHITECTURE.md

@@ -1,5 +1,7 @@
 # Direct architecture and boundary inventory
 
+Code Mode remains outside this package. See [ADR 0001: Keep Code Mode in a standalone MCP process](docs/adr/0001-standalone-code-mode-mcp.md).
+
 ## Official API evidence
 
 The architecture uses public source and the installed signed binaries; it does not speak a private Computer Use socket protocol.
@@ -12,6 +14,12 @@ At OpenAI Codex source commit [`5c19155cbd93bfa099016e7487259f61669823ff`](https
 - the implementation loads the thread runtime and invokes `thread.call_mcp_tool(...)` directly ([processor lines 455–474](https://github.com/openai/codex/blob/5c19155cbd93bfa099016e7487259f61669823ff/codex-rs/app-server/src/request_processors/mcp_processor.rs#L455-L474));
 - downstream structured elicitation is an explicit client capability rather than implicit approval ([README lines 89–94](https://github.com/openai/codex/blob/5c19155cbd93bfa099016e7487259f61669823ff/codex-rs/app-server/README.md#L89-L94)).
 
+The Full access behavior is also public in the pinned Codex `rust-v0.144.2` source at commit [`a6645b6b8a656360fa16fb7e1c6721d0697d3d6a`](https://github.com/openai/codex/tree/a6645b6b8a656360fa16fb7e1c6721d0697d3d6a):
+
+- legacy `danger-full-access` maps to `PermissionProfile::Disabled` ([models lines 289–297](https://github.com/openai/codex/blob/a6645b6b8a656360fa16fb7e1c6721d0697d3d6a/codex-rs/protocol/src/models.rs#L289-L297));
+- MCP permission prompts are auto-approved when the approval policy is `Never` and the permission profile is disabled ([MCP policy lines 76–99](https://github.com/openai/codex/blob/a6645b6b8a656360fa16fb7e1c6721d0697d3d6a/codex-rs/codex-mcp/src/mcp/mod.rs#L76-L99));
+- the elicitation manager applies that policy before client notification ([elicitation lines 196–221](https://github.com/openai/codex/blob/a6645b6b8a656360fa16fb7e1c6721d0697d3d6a/codex-rs/codex-mcp/src/elicitation.rs#L196-L221)), and limits the automatic response to empty-schema approval/confirmation forms ([lines 319–331](https://github.com/openai/codex/blob/a6645b6b8a656360fa16fb7e1c6721d0697d3d6a/codex-rs/codex-mcp/src/elicitation.rs#L319-L331)).
+
 The installed CLI labels app-server experimental. This project therefore verifies the current method and upstream schemas on every call and fails closed on drift.
 
 ## Live architecture probe
@@ -103,7 +111,7 @@ nested prompts or result summaries
 | Wrapper app/intent allowlists in full mode | **accidental** | absent |
 | Safe/full wrapper modes | **compatibility-only** | removed; one durable no-permissions interface exposes all ten methods |
 | Wrapper approval prompts/configuration | **compatibility-only** | removed; no command, config, environment, or per-call selector remains |
-| Official first-party app access | **official-required** | remains external to this wrapper; unexpected elicitations are silently declined and never auto-accepted |
+| Official first-party app access | **official-required** | official Codex Full access auto-accepts normal empty-schema app approval elicitations; any elicitation app-server emits is forwarded unchanged |
 | macOS TCC | **official-required** | retained; never modified |
 | Exact ten-tool inventory/schema | **security-essential** | retained and checked before each call |
 | Canonical bundle identity | **security-essential** | retained before targeted dispatch |
@@ -121,7 +129,15 @@ nested prompts or result summaries
 
 No-permissions is the sole interface and means unrestricted wrapper dispatch with no wrapper approval prompt. All ten methods are registered. No config file, environment value, slash command, CLI mode switch, or tool argument selects another route.
 
-Both Pi and generic stdio MCP omit elicitation capability. App-server is created with `approvalPolicy: "never"`. If the official downstream server nevertheless sends an elicitation request, the bridge counts and silently declines it; there is no UI path and no acceptance callback. Users configure any persistent first-party app access externally in official ChatGPT Computer Use settings.
+App-server is created with `approvalPolicy: "never"` and `sandbox: "danger-full-access"`. This is the official Codex Full access combination. The legacy sandbox field maps to `PermissionProfile::Disabled`; Codex then auto-accepts empty-schema MCP approval elicitations before client notification. Normal first-party Computer Use app approvals therefore do not prompt, and the bridge does not need to mutate the per-bundle approval store.
+
+The broker still handles any `mcpServer/elicitation/request` that app-server emits. Pi advertises OpenAI-form support and renders emitted form, OpenAI-form, and URL requests. Generic stdio MCP forwards supported standard modes as `elicitation/create`. The response path preserves `accept`, `decline`, `cancel`, structured content, and response metadata; no callback or compatible UI yields `cancel`, never an invented decision.
+
+## Pi tool disclosure boundary
+
+The Pi extension registers all ten official definitions. On `session_start` it preserves active tools owned by Pi and other extensions, keeps `computer_use_list_apps` and `computer_use_get_app_state` active, and removes only the eight Computer Use interaction definitions from the initial active set. After a successful `get_app_state` result, it additively activates those eight definitions without removing any currently active tool.
+
+This is context disclosure, not a wrapper permission gate. The schemas, execution path, and no-permissions policy do not change. Loader and interaction definitions remain registered throughout the session. The interaction definitions omit `promptSnippet` and `promptGuidelines`, allowing Pi 0.80.7's native deferred-loading representation to add schemas at the tool-result position without changing the system-prompt prefix. Providers without native support use Pi's next-request fallback.
 
 ## Output boundary
 

package/MIGRATION.md

@@ -1,6 +1,6 @@
 # Migration and rollback
 
-Version 0.2.0 is a breaking architecture change. It replaces the aggregate nested-model tool with ten direct typed tools. The direct implementation passed immutable exact-head review and rollback-safe activation before release. Follow this guide to move from version 0.1.0.
+Version 0.2.0 was the breaking direct-tool architecture change from version 0.1.0. Version 0.3.0 keeps that exact ten-tool contract and adds Pi 0.80.7 progressive disclosure. Use the relevant section below.
 
 ## What changes
 
@@ -35,7 +35,7 @@ CODEX_COMPUTER_USE_HOME="$(mktemp -d)" \
 
 `-ne` suppresses auto-discovered extensions so the live 0.1 adapter is not loaded. This does not change live Pi configuration.
 
-The source adapter starts only in no-permissions mode: all ten methods are available and the wrapper opens no approval UI. Use only benign real apps whose persistent first-party access is already configured. Do not use disposable harnesses as acceptance evidence.
+The source adapter starts only in no-permissions mode: all ten methods are available and the wrapper opens no permission UI of its own. The signed app-server runs with Codex Full access, so normal empty-schema app approval elicitations resolve without a prompt. Any elicitation app-server emits is still shown through Pi and answered only by the user. Use benign real apps for acceptance; do not use disposable harnesses as evidence.
 
 ## Migrate to version 0.2.0
 
@@ -47,7 +47,10 @@ The source adapter starts only in no-permissions mode: all ten methods are avail
 6. Start a fresh Pi process; do not rely on hot-reloading a security-boundary change.
 7. Verify `/computer-use-status` reports:
    - `permissionMode: "no-permissions"`;
-   - `approvalPrompts: false`;
+   - `wrapperPermissionPrompts: false`;
+   - `officialApprovalPolicy: "full-access"`;
+   - `officialAppApprovalHandling: "auto-approved-by-codex-full-access"`;
+   - `officialElicitationHandling: "forwarded-if-emitted"`;
    - all ten `availableMethods`;
    - `brokerVerified: true`;
    - `nestedModel: false`;
@@ -60,11 +63,25 @@ Do not copy old safe/full configuration into the new state root. No-permissions
 
 Version 0.2.0 does not support targeted local Computer Use while the Mac is locked. OpenAI reserves locked use for active trusted turns started from a connected device. See the [locked-screen limitation](README.md#locked-screen-limitation).
 
+## Upgrade from version 0.2.0 to 0.3.0
+
+The MCP contract and signed execution path do not change. The native Pi extension now registers all ten definitions but initially activates only `computer_use_list_apps` and `computer_use_get_app_state`.
+
+1. Upgrade Pi to version 0.80.7 or newer.
+2. Back up `~/.pi/agent/settings.json` and the installed 0.2 package directory.
+3. Verify that npm resolves `codex-computer-use-mcp@0.3.0` exactly, then install that exact package.
+4. Start a fresh Pi process.
+5. Verify that the two inspection tools are initially active and the eight interaction tools remain registered but inactive.
+6. Call `computer_use_get_app_state` against a benign app while the Mac is unlocked. A successful result should add all eight interaction tools without removing any active tool.
+7. Exercise a benign interaction, inspect the private content-safe audit, and verify process cleanup.
+
+The change is context disclosure, not a permission mode. Codex Full access, emitted elicitation forwarding, schemas, and the no-permissions policy remain unchanged.
+
 ## Rollback
 
 1. Stop the current Pi process.
 2. Confirm no direct app-server/client/focus/lock process remains.
-3. Remove or disable the 0.2 package registration.
+3. Remove or disable the current package registration.
 4. Restore the backed-up 0.1 package/config registration byte-for-byte.
 5. Start a fresh Pi process.
 6. Verify the old status command and installed hash.
@@ -74,4 +91,4 @@ Direct state can be removed only after rollback evidence is captured and no proc
 
 ## Generic MCP gateway
 
-If Pi uses `mcp.json`, retain `directTools: false`. Use the exact `0.2.0` package shown in `integrations/pi/mcp.json.example`. During source acceptance, use a distinct temporary server name and source path, then remove it. The direct Pi adapter is the primary live path; do not leave the version 0.1 aggregate server active after the switch.
+If Pi uses `mcp.json`, retain `directTools: false`. Use the exact `0.3.0` package shown in `integrations/pi/mcp.json.example`. During source acceptance, use a distinct temporary server name and source path, then remove it. The direct Pi adapter is the primary live path; do not leave the version 0.1 aggregate server active after the switch.

package/PROOF.md

@@ -56,7 +56,7 @@ Current branch tests cover:
 - production app-server arguments disable model transport, plugins, and remote control;
 - durable no-permissions as the sole policy, with no config/environment/command/tool override;
 - all ten methods available without wrapper prompts or mode gates;
-- no advertised elicitation capability, no acceptance callback, and silent decline of unexpected requests;
+- exact `thread/start` Full access parameters (`approvalPolicy: "never"`, `sandbox: "danger-full-access"`);
 - fatal rejection of model-turn notifications, including a notification emitted during teardown;
 - strict `ephemeral: true` / `path: null` / `turns: []` response attestation before dispatch;
 - pre-buffer rejection of an oversized unterminated protocol line;
@@ -71,7 +71,21 @@ Current branch tests cover:
 - global per-user same-app exclusion across different supported state roots, race behavior, crash release, private lock roots, and bounded lock filenames;
 - focus-event ASN retry/drain behavior, including valid events at the start of a single large stdout chunk;
 - stdio MCP all-ten inventory/status with no alternate mode route;
-- Pi source registration for every direct capability with no nested planner, permission command, or approval UI reference.
+- signed app-server elicitation forwarding, exact user responses, headless cancellation, and cancellation while a UI callback is pending;
+- standard form/URL forwarding across a real MCP SDK client/server transport;
+- Pi source registration for every direct capability with no nested planner, permission command, or wrapper-generated approval UI;
+- Pi session-start disclosure of only the two inspection definitions while preserving unrelated active tools;
+- purely additive activation of all eight interaction definitions after successful `get_app_state`, with no lazy-tool prompt metadata;
+- Pi form, opaque OpenAI-form, URL, decline, and headless-cancel elicitation handling.
+
+## Official Full access approval probe
+
+A live differential used Chess (`com.apple.Chess`), which was absent from the signed service's persistent per-bundle approval file before and after both calls:
+
+1. `approvalPolicy: "never"` with `sandbox: "read-only"` returned `Computer Use approval denied`; app-server never emitted the service's empty-schema approval request to the bridge callback.
+2. Changing only the thread sandbox to `danger-full-access` made the same `get_app_state` call succeed. The bridge callback count and broker `elicitationRequests` were both zero, the runtime remained zero-turn and ephemeral, cleanup verified, and a before/after hash confirmed the persistent approval file was unchanged.
+
+This matches the pinned Codex source: `danger-full-access` maps to a disabled permission profile, and `Never` plus that profile auto-accepts empty-schema MCP confirmation elicitations inside the official host. It proves prompt-free request authorization without editing persistent app approvals or inventing a bridge response.
 
 ## Fresh Pi unlocked real-app acceptance
 
@@ -103,6 +117,19 @@ Evidence:
 
 Earlier exploratory attempts exposed and fixed two acceptance-quality issues rather than being counted as proof: common `CMD+A` needed normalization to the official `Meta_L+a` key form, and TextEdit state restoration had to be reset before a fresh run. The final evidence above is from the corrected direct path.
 
+## Pi 0.80.7 progressive-disclosure measurement
+
+A fresh Pi 0.80.7 process loaded only the source Computer Use extension plus a read-only observer. All ten definitions were registered. The initial active Computer Use set was exactly:
+
+- `computer_use_list_apps`
+- `computer_use_get_app_state`
+
+Serializing names, descriptions, schemas, and prompt guidelines measured 6,063 bytes for all ten definitions and 1,231 bytes for the initial two: 4,832 bytes removed from the initial request, a 79.7% reduction for this tool family.
+
+A second fresh process exercised the exported activation path from inside a tool execution. Pi's tool result recorded the exact eight interaction names in `addedToolNames`; the before/after active sets retained both inspection tools and removed zero tools. The lazily activated definitions had no `promptSnippet` or `promptGuidelines`.
+
+With `openai-codex/gpt-5.6-sol`, the first request reported 5,723 uncached input tokens. The immediately following request after additive activation reported 1,008 uncached input tokens and 5,632 cache-read tokens. This is live provider evidence that the initial prefix remained reusable while Pi inserted the eight definitions at the tool-result load point. The activation probe used the same `activateInteractionTools` function called after a successful production `get_app_state`; automated tests bind that successful-result branch and exact additive set.
+
 ## Review and release status
 
 The direct implementation at commit `98d26f8040f8035a294caa8581d218a33c076990`, tree `01dd30c899863d182bcb0ac3256bd0cc11efc42b`, passed the immutable exact-head review and rollback-safe activation gates. It became the basis for the version 0.2.0 release.
@@ -119,10 +146,10 @@ Validation recorded for the reviewed direct implementation:
 - public-source scrub: no secrets, private absolute paths, or machine identifiers found;
 - fresh-Pi real-app acceptance: pass as above.
 
-Independent reviews of earlier revisions found cleanup and coordination gaps: fail-open or partial descendant enumeration, early-exit orphan recovery, state-root-scoped same-app locking, false-success lease-release audit, unverified focus-listener exit, pre-response direct-call accounting, and large-chunk focus-event loss. The reviewed implementation retains those fixes while removing all wrapper approval UI and safe or full configuration branches.
+Independent reviews of earlier revisions found cleanup and coordination gaps: fail-open or partial descendant enumeration, early-exit orphan recovery, state-root-scoped same-app locking, false-success lease-release audit, unverified focus-listener exit, pre-response direct-call accounting, and large-chunk focus-event loss. The reviewed implementation retains those fixes while removing wrapper-generated approval UI and safe or full configuration branches. The follow-up Full access change uses Codex's own policy to resolve normal empty-schema app approvals without prompts; any elicitation app-server emits remains a separate, faithfully forwarded user interaction.
 
 Version 0.2.0 supports direct local calls only in an unlocked macOS session. Targeted calls failed with official error `-10005` during genuine locked-session acceptance. OpenAI limits locked Computer Use to active trusted turns started from a connected device, so locked local use remains follow-up work and is not part of this release.
 
 ## Non-goals
 
-No private Sky protocol clone, browser-host integration, credential extraction, TCC automation, app injection, re-signing, sender-auth bypass, automatic approval acceptance, nested model fallback, or tool-result persistence.
+No private Sky protocol clone, browser-host integration, credential extraction, TCC automation, app injection, re-signing, sender-auth bypass, wrapper-side approval fabrication, persistent approval-file mutation, nested model fallback, or tool-result persistence.

package/README.md

@@ -1,6 +1,6 @@
 # Codex Computer Use MCP
 
-Version 0.2.0 exposes the official signed macOS Computer Use capabilities as direct typed tools for Pi and MCP clients. The calling agent chooses every tool and argument itself.
+Version 0.3.0 exposes the official signed macOS Computer Use capabilities as direct typed tools for Pi and MCP clients. The calling agent chooses every tool and argument itself.
 
 The primary path has:
 
@@ -20,8 +20,8 @@ Pi registers namespaced tools to avoid collisions with Pi's built-ins. The MCP s
 
 | Pi tool | MCP method | No-permissions | Purpose |
 |---|---|---:|---|
-| `computer_use_list_apps` | `list_apps` | yes | List apps known to official Computer Use |
-| `computer_use_get_app_state` | `get_app_state` | yes | Read accessibility state and imagery for one app |
+| `computer_use_list_apps` | `list_apps` | yes | List running and recently used apps |
+| `computer_use_get_app_state` | `get_app_state` | yes | Read the key-window screenshot and accessibility tree |
 | `computer_use_click` | `click` | yes | Click an element or screenshot coordinates |
 | `computer_use_perform_secondary_action` | `perform_secondary_action` | yes | Invoke a named accessibility action |
 | `computer_use_set_value` | `set_value` | yes | Assign an accessibility value |
@@ -31,17 +31,20 @@ Pi registers namespaced tools to avoid collisions with Pi's built-ins. The MCP s
 | `computer_use_press_key` | `press_key` | yes | Send a key or key combination |
 | `computer_use_type_text` | `type_text` | yes | Type literal text |
 
-Pi—not a nested planner—must call `computer_use_get_app_state`, choose a current element identifier or coordinates, execute one action, and inspect again when needed.
+The MCP façade preserves the official signed helper's tool descriptions, input schemas, and annotations exactly. The Pi façade preserves its descriptions and input schemas; Pi's tool API does not expose MCP annotations. In particular, all ten MCP methods have `destructiveHint: false`; the wrapper does not conflate changing UI state with destructive behavior or add argument restrictions absent from the official schemas.
+
+Pi 0.80.7 and newer registers all ten definitions but initially activates only `computer_use_list_apps` and `computer_use_get_app_state`. A successful `get_app_state` call additively activates the eight interaction definitions for the following model request. Other active Pi and extension tools remain active. The lazily activated tools omit `promptSnippet` and `promptGuidelines`, allowing Pi's native deferred-loading path to preserve the stable system-prompt prefix.
+
+As the official contract specifies, Pi—not a nested planner—calls `computer_use_get_app_state` once per assistant turn before interacting with an app, then chooses and executes actions itself.
 
 ## Authorization policy: durable no-permissions
 
 `no-permissions` has one precise meaning here: **the wrapper asks no permission questions and exposes all ten official actions**. It is the only mode and the durable default. There is no safe/full selector, config file, environment override, slash command, CLI switch, per-call elevation, app allowlist, intent classifier, task schema, per-action confirmation, special-case app policy, or method gate.
 
-The app-server runtime is also created with `approvalPolicy: "never"`. The client does not advertise an elicitation UI. If the official downstream service unexpectedly requests elicitation, the bridge silently declines it; it never opens a prompt and never self-accepts. Any persistent first-party access required by Computer Use must therefore already be configured in the official ChatGPT app.
+The app-server runtime uses the official Full access combination: `approvalPolicy: "never"` and `sandbox: "danger-full-access"`. In the pinned Codex host, that maps to a disabled permission profile and automatically accepts empty-schema MCP approval elicitations. Normal Computer Use app-access checks therefore proceed without a per-app prompt, just as they do in Codex Full access. The bridge does not edit the service's persistent per-bundle approval file. If app-server emits an elicitation instead of resolving it under Full access, the bridge still forwards it faithfully to the invoking client; unsupported clients return `cancel`, never a fabricated `accept` or `decline`.
 
 No-permissions does **not** bypass:
 
-- first-party OpenAI app approvals or sensitive-action prompts;
 - macOS Screen Recording, Accessibility, or TCC controls;
 - strict OpenAI Team ID and code-signature checks;
 - exact upstream ten-tool schema verification;
@@ -64,23 +67,24 @@ See [`ARCHITECTURE.md`](ARCHITECTURE.md) for source links and the full restricti
 
 - macOS
 - Node.js 22 or newer
+- Pi 0.80.7 or newer for native progressive tool disclosure
 - official ChatGPT macOS app at `/Applications/ChatGPT.app`
-- official Computer Use component installed and its first-party permissions configured
+- official Computer Use component installed
 
 The direct bridge starts app-server with a new private `CODEX_HOME` containing no account credentials and only one configured MCP server: official Computer Use. It does not inherit the user's Codex MCP servers, plugins, history, memories, API keys, or auth file. It selects a non-websocket dummy model provider bound to unreachable loopback, disables plugin/remote-control features, and never starts a turn; this prevents app-server model prewarm or Responses API traffic.
 
 ### Locked-screen limitation
 
-Version 0.2.0 supports direct local calls in an unlocked macOS session. It does not support window or accessibility actions after the Mac locks.
+Version 0.3.0 supports direct local calls in an unlocked macOS session. It does not support window or accessibility actions after the Mac locks.
 
-OpenAI's [locked Computer Use](https://developers.openai.com/codex/app/computer-use#use-computer-use-while-your-mac-is-locked) is limited to active, trusted ChatGPT turns started from a connected device. It does not authorize other apps or local processes to unlock the Mac. This package uses local zero-turn dispatch, so targeted calls can fail with official error `-10005` while the Mac is locked. Support for locked local use remains a follow-up and is not part of version 0.2.0.
+OpenAI's [locked Computer Use](https://developers.openai.com/codex/app/computer-use#use-computer-use-while-your-mac-is-locked) is limited to active, trusted ChatGPT turns started from a connected device. It does not authorize other apps or local processes to unlock the Mac. This package uses local zero-turn dispatch, so targeted calls can fail with official error `-10005` while the Mac is locked. Support for locked local use remains a follow-up and is not part of version 0.3.0.
 
 ## Pi integration
 
 Install the exact release from npm:
 
 ```bash
-pi install npm:codex-computer-use-mcp@0.2.0
+pi install npm:codex-computer-use-mcp@0.3.0
 ```
 
 To evaluate a source checkout instead:
@@ -97,7 +101,7 @@ Command:
 /computer-use-status
 ```
 
-The native Pi adapter is the primary product path. It always registers all ten typed tools directly. It exposes no mode-changing command and no approval UI.
+The native Pi adapter is the primary product path. It registers all ten typed tools directly, starts each session with the two inspection tools active, and additively activates the eight interaction tools after successful app inspection. It exposes no mode-changing command or wrapper-generated approval UI. Official app-access approval elicitations are resolved by Codex Full access before they reach Pi. Any elicitation that app-server does emit is shown through Pi's UI, and only the user's choice is returned to the service.
 
 ## MCP server
 
@@ -123,7 +127,7 @@ For Pi's generic MCP gateway, keep `directTools: false` so this powerful surface
 }
 ```
 
-The generic MCP server exposes the same no-permissions behavior: no wrapper approval UI and all ten methods. Unexpected downstream elicitations are silently declined; configure persistent first-party app access only in official ChatGPT Computer Use settings.
+The generic MCP server exposes the same no-permissions behavior: official Codex Full access, no wrapper permission gate, and all ten methods. App-access approvals are resolved inside the official host. Any standard form or URL elicitation that app-server emits is forwarded as an MCP `elicitation/create` request. The upstream client response is returned unchanged; unsupported or headless clients cancel rather than fabricate a decision.
 
 ## Security and privacy
 

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Reporting a vulnerability
 
-Do not open a public issue for a vulnerability that could weaken signing, schema verification, permission-mode dispatch, first-party approval handling, app identity, locking, focus telemetry, cleanup, or audit integrity.
+Do not open a public issue for a vulnerability that could weaken signing, contract verification, no-permissions dispatch, first-party access handling, app identity, locking, focus telemetry, cleanup, or audit integrity.
 
 Use GitHub private vulnerability reporting. Include the affected commit/version, the smallest non-sensitive reproduction, expected versus observed behavior, and whether an official action completed before failure.
 
@@ -20,10 +20,10 @@ This is direct tool dispatch—not model orchestration.
 
 1. Only fixed app-bundled Codex and Computer Use client paths are allowed in production.
 2. Both binaries pass strict code-signature verification and OpenAI Team ID `2DC432GLL2` checks before dispatch.
-3. The helper's exact ten method names and input schemas match the pinned expected inventory before every call.
+3. The helper's exact ten method names and input schemas match the pinned expected inventory before every call; release tests also verify its descriptions and annotations.
 4. `no-permissions` is the only wrapper policy: all ten methods are exposed and no wrapper permission prompt is opened.
 5. There is no config file, environment override, command, tool argument, per-call branch, or alternate safe/full route that an agent can select.
-6. App-server uses `approvalPolicy: "never"`; elicitation capability is disabled and unexpected first-party requests are silently declined, never prompted or self-accepted. Persistent official app access remains authoritative and must be configured outside this wrapper.
+6. App-server uses the official Full access combination, `approvalPolicy: "never"` plus `sandbox: "danger-full-access"`. The pinned Codex host automatically accepts empty-schema MCP approval elicitations, so normal first-party app-access checks proceed without prompts. The wrapper does not synthesize this response or edit persistent per-app approvals. Any elicitation app-server emits is forwarded faithfully; an unavailable client cancels.
 7. Target selectors resolve to canonical installed bundle IDs before dispatch.
 8. Same-app work is excluded across native Pi, generic MCP, and custom state roots with one fixed per-user kernel `lockf` lease namespace.
 9. Target focus events, periodic samples, watcher health, queued ASN resolution, and final state are checked. This is post-action detection, not a preventive OS sandbox.
@@ -40,20 +40,22 @@ This is direct tool dispatch—not model orchestration.
 
 ### No-permissions
 
-All ten official methods and arbitrary resolvable app targets are available without wrapper permission prompts. The name means “ask no permission,” not “disable tools.” This is broad authorization. It does not imply that actions are reversible or that focus detection can prevent an already dispatched action. App-state reads can expose visible sensitive information to the calling model.
+All ten official methods and arbitrary resolvable app targets are available without wrapper permission prompts. The name means “ask no permission,” not “disable tools.” This is broad authorization. It does not imply that actions are reversible or that focus detection can prevent an already dispatched action.
 
 The mode is compiled as the sole policy. Agent-writable audit state and legacy configuration files cannot change it, and there is no CLI/slash/tool/environment mode selector.
 
 ## Elicitations
 
-Neither Pi nor stdio MCP advertises or renders an approval UI. The bridge starts app-server with `approvalPolicy: "never"`. An unexpected downstream elicitation is counted, silently declined, and never self-accepted. Persistent first-party app access belongs in official ChatGPT Computer Use settings.
+The bridge starts app-server with `approvalPolicy: "never"` and `sandbox: "danger-full-access"`. This is Codex's Full access policy, not a wrapper-side approximation. Codex 0.144.2 maps the sandbox value to a disabled permission profile and automatically accepts empty-schema MCP approval elicitations before they are emitted to the client. That covers normal Computer Use app-access prompts without mutating the service's persistent approval file.
 
-## Visible-content warning
+If app-server emits a form, OpenAI-form, or URL elicitation, Pi renders it and stdio MCP forwards supported standard modes through `elicitation/create`. The wrapper preserves the user/client response. Missing UI or an unsupported client produces `cancel`, never a fabricated decision.
 
-Computer Use is designed to return app state and screenshots. Do not point it at apps containing credentials, payment data, private messages, or customer secrets unless the user explicitly requires that context and accepts model exposure. Audit safety does not make target-app content non-sensitive.
+## Visible content
+
+Computer Use returns the official app-state text and screenshots to the invoking client. The wrapper does not inspect, classify, redact, or use that content to narrow the actions authorized by the user's request, and it never writes the content to its audit.
 
 ## Supported versions
 
-Only the latest approved release is supported. Version 0.2.0 supports direct local calls in an unlocked macOS session. Targeted local calls while the Mac is locked are not supported.
+Only the latest approved release is supported. Version 0.3.0 supports direct local calls in an unlocked macOS session. Targeted local calls while the Mac is locked are not supported.
 
 App-server is experimental and bundle paths or schemas can change. Drift fails closed until reviewed.

package/dist/audit.d.ts

@@ -16,7 +16,7 @@ export interface AuditRecord {
     directCalls: number;
     modelTurnsStarted: number;
     ephemeralThread: boolean | null;
-    approvalRequests: number;
+    elicitationRequests: number;
     backgroundPreserved: boolean | null;
     brokerCleanupVerified: boolean;
     appLeaseReleased: boolean;

package/dist/direct-broker.d.ts

@@ -2,6 +2,18 @@ import { type DirectMethod, type DirectToolArguments } from "./tools.ts";
 export declare const CODEX_PATH = "/Applications/ChatGPT.app/Contents/Resources/codex";
 export declare const COMPUTER_USE_PLUGIN_ROOT = "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use";
 export declare const COMPUTER_USE_CLIENT_PATH = "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use/Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient";
+export interface DirectBrokerElicitationRequest extends Record<string, unknown> {
+    mode?: string;
+    message?: string;
+    requestedSchema?: unknown;
+    url?: string;
+    elicitationId?: string;
+}
+export interface DirectBrokerElicitationResponse {
+    action: "accept" | "decline" | "cancel";
+    content?: unknown;
+    _meta?: unknown;
+}
 export interface DirectBrokerResult {
     content: Array<Record<string, unknown>>;
     structuredContent?: unknown;
@@ -9,7 +21,7 @@ export interface DirectBrokerResult {
     brokerVersion: string;
     clientBuild: string;
     durationMs: number;
-    approvalRequests: number;
+    elicitationRequests: number;
     modelTurnsStarted: 0;
     ephemeralThread: true;
     brokerCleanupVerified: true;
@@ -17,6 +29,8 @@ export interface DirectBrokerResult {
 export interface DirectBrokerOptions {
     timeoutMs?: number;
     signal?: AbortSignal;
+    onElicitation?: (request: DirectBrokerElicitationRequest) => DirectBrokerElicitationResponse | Promise<DirectBrokerElicitationResponse>;
+    supportsOpenAiFormElicitation?: boolean;
     /** Test-only executable override. Production callers never set this. */
     appServerCommand?: string;
     /** Test-only argument override. */
@@ -37,14 +51,14 @@ export declare class DirectBrokerCallError extends Error {
     readonly directCalls: number;
     readonly modelTurnsStarted: number;
     readonly ephemeralThread: boolean;
-    readonly approvalRequests: number;
+    readonly elicitationRequests: number;
     readonly brokerVersion: string;
     readonly clientBuild: string;
     constructor(message: string, cleanupVerified: boolean, cause?: unknown, evidence?: {
         directCalls?: number;
         modelTurnsStarted?: number;
         ephemeralThread?: boolean;
-        approvalRequests?: number;
+        elicitationRequests?: number;
         brokerVersion?: string;
         clientBuild?: string;
     });

package/dist/direct-broker.js

@@ -20,7 +20,7 @@ export class DirectBrokerCallError extends Error {
     directCalls;
     modelTurnsStarted;
     ephemeralThread;
-    approvalRequests;
+    elicitationRequests;
     brokerVersion;
     clientBuild;
     constructor(message, cleanupVerified, cause, evidence = {}) {
@@ -30,7 +30,7 @@ export class DirectBrokerCallError extends Error {
         this.directCalls = evidence.directCalls ?? 0;
         this.modelTurnsStarted = evidence.modelTurnsStarted ?? 0;
         this.ephemeralThread = evidence.ephemeralThread ?? false;
-        this.approvalRequests = evidence.approvalRequests ?? 0;
+        this.elicitationRequests = evidence.elicitationRequests ?? 0;
         this.brokerVersion = evidence.brokerVersion ?? "unknown";
         this.clientBuild = evidence.clientBuild ?? "unknown";
     }
@@ -391,7 +391,7 @@ export async function callOfficialDirectTool(method, args, options = {}) {
     let fatalError;
     let stderr = "";
     let nextId = 1;
-    let approvalRequests = 0;
+    let elicitationRequests = 0;
     let modelTurnsStarted = 0;
     let directCalls = 0;
     let ephemeralThread = false;
@@ -500,14 +500,26 @@ export async function callOfficialDirectTool(method, args, options = {}) {
                         send({ id: message.id, error: { code: -32601, message: "Unsupported server request" } });
                         return;
                     }
-                    if (approvalRequests >= 8) {
-                        fail(new Error("Official app-server emitted excessive elicitation requests"));
-                        return;
-                    }
-                    approvalRequests += 1;
-                    // The durable no-permissions interface never opens an approval UI and never
-                    // self-accepts a first-party request. Unexpected elicitations are declined.
-                    send({ id: message.id, result: { action: "decline" } });
+                    elicitationRequests += 1;
+                    const requestParams = message.params && typeof message.params === "object" && !Array.isArray(message.params)
+                        ? message.params
+                        : {};
+                    void (async () => {
+                        let response = { action: "cancel" };
+                        if (options.onElicitation) {
+                            try {
+                                const candidate = await options.onElicitation(requestParams);
+                                if (candidate && ["accept", "decline", "cancel"].includes(candidate.action))
+                                    response = candidate;
+                            }
+                            catch {
+                                response = { action: "cancel" };
+                            }
+                        }
+                        if (fatalError || !proc?.stdin.writable)
+                            return;
+                        send({ id: message.id, result: response });
+                    })().catch((error) => fail(error instanceof Error ? error : new Error(String(error))));
                     return;
                 }
             }
@@ -555,11 +567,13 @@ export async function callOfficialDirectTool(method, args, options = {}) {
         if (fatalError)
             throw fatalError;
         await request("initialize", {
-            clientInfo: { name: "pi_direct_computer_use", title: "Pi Direct Computer Use", version: "0.2.0" },
-            capabilities: { mcpServerOpenaiFormElicitation: false },
+            clientInfo: { name: "pi_direct_computer_use", title: "Pi Direct Computer Use", version: "0.3.0" },
+            capabilities: { mcpServerOpenaiFormElicitation: options.supportsOpenAiFormElicitation === true && options.onElicitation !== undefined },
         }, 15_000);
         send({ method: "initialized" });
-        const started = (await request("thread/start", { cwd: workDir, approvalPolicy: "never", sandbox: "read-only", ephemeral: true, serviceName: "pi_direct_computer_use" }, 30_000));
+        // Codex Full access requires both values: with `never` plus a restricted sandbox,
+        // core declines the signed service's app approval instead of prompting or accepting it.
+        const started = (await request("thread/start", { cwd: workDir, approvalPolicy: "never", sandbox: "danger-full-access", ephemeral: true, serviceName: "pi_direct_computer_use" }, 30_000));
         const thread = started?.thread;
         const threadId = thread?.id;
         if (typeof threadId !== "string"
@@ -583,7 +597,7 @@ export async function callOfficialDirectTool(method, args, options = {}) {
             brokerVersion: verification.brokerVersion,
             clientBuild: verification.clientBuild,
             durationMs: Date.now() - startedAt,
-            approvalRequests,
+            elicitationRequests,
             modelTurnsStarted: 0,
             ephemeralThread: true,
             brokerCleanupVerified: true,
@@ -625,7 +639,7 @@ export async function callOfficialDirectTool(method, args, options = {}) {
         directCalls,
         modelTurnsStarted,
         ephemeralThread,
-        approvalRequests,
+        elicitationRequests,
         brokerVersion: verification.brokerVersion,
         clientBuild: verification.clientBuild,
     };