create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/oauth-proxy.js

@@ -53,7 +53,6 @@ const http = require('node:http');
 const os = require('node:os');
 const path = require('node:path');
 const { execFile } = require('node:child_process');
-const readline = require('node:readline');
 const { hostIdentityAccessAllowed } = require('./lib/host-identity-access');
 
 const { effectiveOutputCap } = require('./lib/model-proxy/output-cap');
@@ -73,6 +72,9 @@ const { getDataDir } = require('./lib/data-dir');
 const { validateLeadWorkerTarget, safeRefusalReason } = require('./lib/model-proxy/lead-request-validation');
 const { buildCodexModelsResponse } = require('./lib/harness-model-profile');
 const legacyRelay = require('./lib/model-proxy/legacy-relay');
+const streamAccountingMod = require('./lib/model-proxy/stream-accounting');
+const instanceRecord = require('./lib/model-proxy/proxy-instance-record');
+const handoff = require('./lib/model-proxy/handoff');
 const {
   unsupportedSafeguards, logReviewDiagnostic,
 } = require('./lib/model-proxy/auto-mode-review');
@@ -88,6 +90,10 @@ const EBIND_NOT_LOOPBACK = 'EBIND_NOT_LOOPBACK';
 // `_health` answer reports it, and it is intentionally NOT per-instance.
 let _abortedStreams = 0;
 
+// The context of the server this process started. Read only by the CLI's SIGTERM handler (bottom of
+// this file) — an embedded caller installs no such handler, so nothing else can observe it.
+let _cliExitTarget = null;
+
 // ── per-instance context (WP-1 §5 D-3, review item 2) ───────────────────────────────────────────
 //
 // Every start() captures its OWN immutable context: the admin secret, the OAuth resolver, the native
@@ -120,6 +126,14 @@ function createProxyContext({ adminSecret = null, resolveOauthToken, dataDir, na
     // registration and closed by (and only by) this instance's wrapped HTTP server close. It holds the
     // loaded authority's private material and never exposes it.
     nativeListener: null,
+    // §5 D-9: THIS server's in-flight stream counter, created here so both the plaintext and the native
+    // server feed one number, and so a test can reach it through the context.
+    streamAccounting: streamAccountingMod.createStreamAccounting(),
+    // §5 D-7 (WP-2): what a handoff hands over -- the listening server, its ports, its generation.
+    httpServer: null,
+    boundPort: null,
+    nativePort: null,
+    generation: 1,
   };
 }
 
@@ -319,10 +333,15 @@ async function _handleAdmin(req, res, pathName, ctx) {
   // servers each authenticate against their own secret, so A's admin surface can never be opened with
   // B's secret (and B's credential resolver can never be reached through A).
   if (!ctx.adminSecret || typeof suppliedSecret !== 'string' || suppliedSecret !== ctx.adminSecret) {
+    // §9 S-9: one line, the finite reason only — never the supplied header value.
+    console.log('[model-proxy] refused status=401 reason=admin_unauthorized');
     res.writeHead(401, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: 'admin_unauthorized' }));
     return;
   }
+  // §5 D-8 (WP-3): this authenticated request -- and only this -- is "admin contact". `/_health`,
+  // `/_status` and a refused secret never reach it, so none of them can hold this proxy open.
+  handoff.noteAdminContact();
 
   const probeMatch = pathName.match(ADMIN_PROBE_RE);
   if (probeMatch && req.method === 'GET') {
@@ -364,6 +383,26 @@ async function _handleAdmin(req, res, pathName, ctx) {
     }
   }
 
+  // §5 D-7 (WP-2): upgrade by handoff. The successor is always spawned from THIS file's path on disk and
+  // the body may carry the two bounded deadlines (test overrides), never a script or a port; a 409
+  // leaves this proxy serving exactly as it was.
+  if (pathName === '/_admin/handoff' && req.method === 'POST') {
+    const result = await handoff.initiateHandoff({
+      ctx, httpServer: ctx.httpServer, nativeListener: ctx.nativeListener, dataDir: ctx.dataDir,
+      port: ctx.boundPort, nativePort: ctx.nativePort, adminSecret: ctx.adminSecret,
+      generation: ctx.generation,
+      readyDeadlineMs: body ? body.readyDeadlineMs : undefined,
+      drainDeadlineMs: body ? body.drainDeadlineMs : undefined,
+    });
+    res.writeHead(result.ok ? 202 : 409, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result.ok
+      ? { ok: true, generation: result.generation, successorPid: result.successorPid, handoffMs: result.handoffMs }
+      : { ok: false, reason: result.reason }));
+    // The 202 is on the wire BEFORE step 7 is armed, so its exit can never preempt the caller's response.
+    if (result.ok) result.armDrain();
+    return;
+  }
+
   const workerLeaseMatch = pathName.match(ADMIN_WORKER_LEASE_RE);
   if (workerLeaseMatch && req.method === 'POST') {
     if (!body || !Number.isSafeInteger(body.generation) || !Number.isSafeInteger(body.lease)) {
@@ -779,6 +818,8 @@ async function _handleRouted(req, res, pathName, trusted = null, ctx = null) {
       : null);
   const authz = tokens.authorize(token, alias);
   if (!authz.ok) {
+    // §9 S-9: the same finite reason the body carries — never the presented token.
+    console.log(`[model-proxy] refused status=401 reason=token ${authz.reason}`);
     faceModule.writeJson(res, 401, faceModule.errorEnvelope('authentication_error', `token ${authz.reason}`));
     return;
   }
@@ -788,6 +829,7 @@ async function _handleRouted(req, res, pathName, trusted = null, ctx = null) {
   // keychain the incident was about. (The reverse direction — a legacy-bearer owner on the TLS lane —
   // is refused by the listener's carrier check.)
   if (!nativeTrusted && tokens.leadTokenNativeTransport(token) === tokens.NATIVE_TRANSPORT_MTLS) {
+    console.log('[model-proxy] refused status=401 reason=token native_transport_mismatch'); // §9 S-9
     faceModule.writeJson(res, 401, faceModule.errorEnvelope('authentication_error', 'token native_transport_mismatch'));
     return;
   }
@@ -1305,6 +1347,11 @@ async function handleRequest(req, res, trusted = null, ctx = null) {
   if (pathName.startsWith('/r/')) {
     return _handleRouted(req, res, pathName, trusted, context);
   }
+  if (pathName === '/_health' || pathName === '/_status') {
+    // WP-0 §9 S-8: the relay still builds its own fields; the wrapper merges this process's identity
+    // and live stream count into that same JSON body.
+    return _legacyHandleRequest(req, streamAccountingMod.withHealthFields(res, context.streamAccounting));
+  }
   // Legacy: today's OAuth passthrough, byte-for-byte unchanged (AC-0a).
   return _legacyHandleRequest(req, res);
 }
@@ -1319,34 +1366,6 @@ async function _handleNativeAuthorizedRequest(req, res, { token, binding, suffix
   return _handleRouted(req, res, pathName, { native: true, token, binding, suffix, query }, ctx);
 }
 
-// ── D-4 stdin secret (CLI mode only) ────────────────────────────────────
-// Reads exactly one line from stdin at process start. Never env, never argv.
-// Resolves null (no admin secret; admin endpoints stay locked) if stdin is a
-// TTY or closes without producing a line.
-function _readAdminSecretFromStdin() {
-  return new Promise((resolve) => {
-    if (!process.stdin || process.stdin.isTTY) {
-      resolve(null);
-      return;
-    }
-    const rl = readline.createInterface({ input: process.stdin, terminal: false });
-    let resolved = false;
-    const finish = (value) => {
-      if (resolved) return;
-      resolved = true;
-      rl.close();
-      resolve(value);
-    };
-    rl.once('line', (line) => finish((line || '').trim() || null));
-    rl.once('close', () => finish(null));
-  });
-}
-
-function _resolveHost() {
-  const raw = process.env.OAUTH_PROXY_HOST;
-  return typeof raw === 'string' && raw.length > 0 ? raw : HOST;
-}
-
 // D-1: bind 127.0.0.1 only. Throws a named error (never a bare listen()
 // failure) so both start() callers and the CLI entry can refuse cleanly.
 function _assertLoopbackHost(host) {
@@ -1357,7 +1376,7 @@ function _assertLoopbackHost(host) {
   }
 }
 
-function start({ port = PORT, host = HOST, adminSecret = null, resolveOauthToken, dataDir, nativeUpstreamRequest, nativeLoadAuthority } = {}) {
+function start({ port = PORT, host = HOST, adminSecret = null, resolveOauthToken, dataDir, nativeUpstreamRequest, nativeLoadAuthority, inherited = null, lingerMs = null } = {}) {
   try {
     _assertLoopbackHost(host);
   } catch (err) {
@@ -1369,6 +1388,7 @@ function start({ port = PORT, host = HOST, adminSecret = null, resolveOauthToken
   // and gets lib/data-dir's resolver (CTM_DATA_DIR, then WALL_E_DATA_DIR, then the default). None of it
   // is ever read from a request, and none of it is shared with another live server.
   const ctx = createProxyContext({ adminSecret, resolveOauthToken, dataDir, nativeUpstreamRequest, nativeLoadAuthority });
+  _cliExitTarget = ctx;
   const server = http.createServer((req, res) => {
     handleRequest(req, res, null, ctx).catch((err) => {
       try {
@@ -1379,24 +1399,31 @@ function start({ port = PORT, host = HOST, adminSecret = null, resolveOauthToken
       } catch {}
     });
   });
+  // §5 D-9: this server's plaintext requests feed the same counter the exit record reads.
+  ctx.streamAccounting.track(server);
   server.on('error', (err) => {
     console.error('[oauth-proxy] server error:', err.message);
   });
   return new Promise((resolve, reject) => {
     server.once('error', reject);
-    server.listen(port, host, () => {
+    const onListening = () => {
       // The native port is derived from the ACTUAL bound port (never the requested one), so a lease of
       // 0 or a config mismatch cannot desynchronize the pair the fixture reserved.
       const boundPort = server.address().port;
       try {
         // This instance's OWN controller, closed by this instance's wrapped server close. A second live
-        // server has its own, so neither can serve the other's registrations.
+        // server has its own, so neither can serve the other's registrations. §5 D-7: a successor binds
+        // the TLS listening socket it was handed instead of the port (S-6), so the native lane has no
+        // re-bind window either.
         ctx.nativeListener = createNativeLeadListener({
           httpPort: boundPort,
           dataDir: ctx.dataDir,
+          // §5 D-9: the native lane is the same process carrying the same requests — one counter.
+          streamAccounting: ctx.streamAccounting,
           // The default is the unowned library loader; a host test fixture may inject a gated loader to
           // force the admin readiness race at the real HTTP boundary (review item 9).
           loadAuthority: ctx.nativeLoadAuthority || undefined,
+          inheritedHandle: inherited ? inherited.nativeHandle : null,
           onAuthorizedRequest: (req, res, payload) => _handleNativeAuthorizedRequest(req, res, payload, ctx),
         });
         // Closing the HTTP server starts the native close immediately (see the wrapper for why the
@@ -1409,9 +1436,42 @@ function start({ port = PORT, host = HOST, adminSecret = null, resolveOauthToken
         ctx.nativeListener = null;
         console.error(`[oauth-proxy] native lead listener unavailable: ${(err && err.code) || 'native_lead_listener_input_invalid'}`);
       }
+      // §5 D-7 step 4: the state that has no other authority arrives with the sockets and is registered
+      // BEFORE this process answers anything -- the token table and the per-token last lead model.
+      if (inherited && inherited.state) {
+        tokens.importAll(inherited.state.tokens);
+        leadWorkerPicks.importLastLeadModel(inherited.state.lastLeadModel);
+      }
       console.log(`[oauth-proxy] listening on http://${host}:${port}`);
-      resolve(server);
-    });
+      // §5 D-2/D-3: publish this process's durable identity and hand the same closure to /_health. A
+      // successor publishes generation n+1 and the pid it took over from, so the record names the owner.
+      const record = instanceRecord.publishInstanceRecord({
+        dataDir: ctx.dataDir,
+        port: boundPort,
+        nativePort: ctx.nativeListener ? boundPort + 1 : null,
+        accounting: ctx.streamAccounting,
+        generation: inherited ? inherited.generation : 1,
+        predecessorPid: inherited ? inherited.predecessorPid : null,
+      });
+      ctx.httpServer = server;
+      ctx.boundPort = boundPort;
+      ctx.nativePort = ctx.nativeListener ? boundPort + 1 : null;
+      ctx.generation = record.generation;
+      // §5 D-8: the CLI arms the proxy's own linger once the record is published; an embedded start()
+      // passes no lingerMs, so it can never exit the process that called it.
+      if (lingerMs) handoff.armLinger({ lingerMs, ctx });
+      if (!inherited) {
+        resolve(server);
+        return;
+      }
+      // §5 D-7 step 5: `ready` is the predecessor's permission to stop accepting, so handoff.js sends it
+      // only once this process is genuinely serving (state imported, identity published, TLS re-bound).
+      handoff.announceInheritedStart({ ctx, inherited, record }).then(() => resolve(server));
+    };
+    // §5 D-7 step 4: a successor binds the listening socket it was handed, never (port, host) again --
+    // there is no moment in which the port has no owner.
+    if (inherited && inherited.httpHandle) server.listen(inherited.httpHandle, onListening);
+    else server.listen(port, host, onListening);
   });
 }
 
@@ -1431,26 +1491,10 @@ module.exports = {
   // failure so exactly-once finalization and listener cleanup are provable without a live relay.
   _relayLegacyObserved: legacyRelay._relayLegacyObserved,
   EBIND_NOT_LOOPBACK,
+  // WP-2 test seam: the context of the server THIS process started (null for an embedded caller that
+  // never ran the CLI block). proxy-cli's SIGTERM handler reads it; nothing else may.
+  _startedContext: () => _cliExitTarget,
 };
 
-// CLI mode: `node oauth-proxy.js`
-if (require.main === module) {
-  const host = _resolveHost();
-  if (host !== '127.0.0.1') {
-    // D-1: refuse before ever touching stdin, so a bad --host/env doesn't
-    // hang waiting for an admin secret that will never matter.
-    console.error(`[oauth-proxy] ${EBIND_NOT_LOOPBACK}: refusing to bind to "${host}" — must be 127.0.0.1 (D-1)`);
-    process.exit(78);
-  }
-  _readAdminSecretFromStdin()
-    .catch(() => null)
-    .then((adminSecret) => start({ host, adminSecret }))
-    .catch((err) => {
-      if (err && err.code === EBIND_NOT_LOOPBACK) {
-        console.error(`[oauth-proxy] ${err.code}: ${err.message}`);
-        process.exit(78);
-      }
-      console.error('[oauth-proxy] failed to start:', err.message);
-      process.exit(1);
-    });
-}
+// CLI mode: `node oauth-proxy.js` (or a handoff successor, spawned with an IPC channel).
+if (require.main === module) require('./lib/model-proxy/proxy-cli').runCli();

package/template/coding-task-manager/package-lock.json

@@ -28,10 +28,13 @@
         "proxy-agent": "8.0.2",
         "puppeteer": "25.14.0",
         "qrcode": "^1.5.4",
+        "stream-chain": "4.2.6",
+        "stream-json": "3.7.0",
         "strip-ansi": "^6.0.1",
         "tree-sitter-bash": "^0.25.1",
         "web-push": "^3.6.7",
         "web-tree-sitter": "^0.26.13",
+        "wrap-ansi": "^9.0.2",
         "ws": "8.22.0",
         "yauzl": "3.4.0"
       },
@@ -3517,6 +3520,27 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/stream-chain": {
+      "version": "4.2.6",
+      "resolved": "https://registry.npmjs.org/stream-chain/-/stream-chain-4.2.6.tgz",
+      "integrity": "sha512-1zeJ8CrtJfmiba26ui8jXkq/xLRFvhzkdH02D5QLO9Cnovgeb28IJxg88DdraWnjnkbOol/++uIAybJbJhk7ig==",
+      "license": "BSD-3-Clause",
+      "funding": {
+        "url": "https://github.com/sponsors/uhop"
+      }
+    },
+    "node_modules/stream-json": {
+      "version": "3.7.0",
+      "resolved": "https://registry.npmjs.org/stream-json/-/stream-json-3.7.0.tgz",
+      "integrity": "sha512-rCSBdcBP/bPk6T8QFcxAj1MSzAuc5i49cYW6IE7sYObNEPccBJIUiL6fU9c9BWt40aJK0siVynLX7lWaW8alXw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "stream-chain": "^4.2.5"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/uhop"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",

package/template/coding-task-manager/package.json

@@ -87,10 +87,13 @@
     "puppeteer": "25.14.0",
     "proxy-agent": "8.0.2",
     "qrcode": "^1.5.4",
+    "stream-chain": "4.2.6",
+    "stream-json": "3.7.0",
     "strip-ansi": "^6.0.1",
     "tree-sitter-bash": "^0.25.1",
     "web-push": "^3.6.7",
     "web-tree-sitter": "^0.26.13",
+    "wrap-ansi": "^9.0.2",
     "ws": "8.22.0",
     "yauzl": "3.4.0"
   },

package/template/coding-task-manager/providers/codex-mcp-extract.js

@@ -1,33 +1,135 @@
 'use strict';
 
 // Shared extraction of the (server, tool) pair from Codex MCP approval prompts.
+//
+// Codex builds the approval question with
+//   format!("Allow {actor} to run tool \"{tool_name}\"?")
+// (codex-rs/core/src/mcp_tool_call.rs), where `actor` is one of
+//   - "the <server> MCP server"  — an ordinary MCP server (e.g. "the wall-e MCP server"),
+//   - "this app"                 — the built-in app/connector server, connector unnamed,
+//   - the connector's display name, e.g. "Google Drive" — also server `codex_apps`.
 // Two on-screen shapes carry the verb:
-//   "Calling wall-e.walle_memory_status({})"           → CALLING_RE
-//   'Allow the wall-e MCP server to run tool "X"?'      → QUESTION_RE
+//   'Allow <actor> to run tool "<tool>"?'              → parseApprovalQuestion
+//   "Calling <qualified>"  (with or without "({...})") → parseCallingEcho
+//
+// The actor is matched STRUCTURALLY: "the <x> MCP server" / "this app" /
+// anything else. It is never checked against a list of connector names — new
+// connectors must not need a code change to be recognized.
 //
-// Reused by providers/codex-mcp.js (the specific handler) AND providers/codex.js
-// (the generic fallback). This keeps the MCP verb visible even when the specific
-// codex-mcp parser doesn't fire — e.g. a viewport-wrapped prompt that drops the
-// "enter to submit" anchor falls back to codex.js, which would otherwise emit a
-// bare toolName='MCP' with no verb, hiding read-only calls (search_graph, get_*)
-// from the read/write classifier and stranding them on a manual banner.
+// Reused by providers/codex-mcp.js (the specific handler), providers/codex.js
+// (the generic fallback) AND workers/state-detectors/codex.js. This keeps the
+// MCP verb visible even when the specific codex-mcp parser doesn't fire — e.g. a
+// viewport-wrapped prompt that drops the "enter to submit" anchor falls back to
+// codex.js, which would otherwise emit a bare toolName='MCP' with no verb,
+// hiding read-only calls (search_graph, get_*) from the read/write classifier
+// and stranding them on a manual banner.
+
+// The built-in app/connector MCP server id (codex-rs/codex-mcp/src/mcp/mod.rs).
+const CODEX_APPS_SERVER = 'codex_apps';
+
+// 'Allow <actor> to run tool "<tool>"?' → the two captures. Anchored at the line
+// start (that guards against prose that merely mentions the question) but tolerant
+// of leading UI decoration: Codex's ratatui borders/footers paint box, bullet and
+// cursor glyphs before the text ("│ Allow …, "• Calling …").
+const APPROVAL_QUESTION_RE = /^[\s│┃║|•◦›❯>*-]*Allow\s+(.+?)\s+to run tool\s+["']?([A-Za-z0-9_.-]+)["']?\s*\?/i;
+// Ordinary MCP servers name themselves in the actor: "the <server> MCP server".
+// Case-insensitive so it agrees with APPROVAL_QUESTION_RE, which accepts "Allow".
+const MCP_SERVER_ACTOR_RE = /^the (\S+) MCP server$/i;
+// The unnamed connector actor.
+const APP_FALLBACK_ACTOR = 'this app';
+// "Calling <qualified>" — a DOTTED token ("server.tool"), as Codex always renders
+// it. The "({...})" argument list is optional (and absent in current builds), but
+// the dot is not: a bare "Calling foo" is prose, not an MCP approval signal.
+const CALLING_ECHO_RE = /\bCalling\s+([A-Za-z0-9_-]+\.[A-Za-z0-9_.-]+)/i;
 
-const CALLING_RE = /\bCalling\s+([A-Za-z0-9_.-]+)\.([A-Za-z0-9_.-]+)\s*\(/i;
-const QUESTION_RE = /Allow the ([A-Za-z0-9_.-]+) MCP server to run tool ["']?([A-Za-z0-9_.-]+)["']?\?/i;
+// 'Allow <actor> to run tool "<tool>"?' → { actorKind, actor, tool } | null
+//   actorKind: 'mcp_server' when actor matches MCP_SERVER_ACTOR_RE (the server
+//              name is that capture),
+//              'app_fallback' when actor === 'this app',
+//              'connector' otherwise (any non-empty text).
+function parseApprovalQuestion(line) {
+  const match = String(line || '').match(APPROVAL_QUESTION_RE);
+  if (!match) return null;
+  const actor = match[1].trim();
+  const tool = match[2];
+  if (!actor || !tool) return null;
+  const actorKind = MCP_SERVER_ACTOR_RE.test(actor)
+    ? 'mcp_server'
+    : (actor.toLowerCase() === APP_FALLBACK_ACTOR ? 'app_fallback' : 'connector');
+  return { actorKind, actor, tool };
+}
+
+// 'Calling <qualified>' with or without a following '(' → { qualified } | null
+//   qualified = the dotted token after "Calling " ([A-Za-z0-9_-]+\.[A-Za-z0-9_.-]+),
+//   e.g. 'codex_apps.google_drive.update_file'. A dotless "Calling foo" is null.
+function parseCallingEcho(line) {
+  const match = String(line || '').match(CALLING_ECHO_RE);
+  if (!match) return null;
+  return { qualified: match[1] };
+}
+
+// The server for a question whose actor does not name it: the connector/app
+// server is `codex_apps`, but a "Calling" echo above the prompt can still spell
+// out the qualified name — 'codex_apps.google_drive.update_file' with tool
+// 'google_drive.update_file' → 'codex_apps'.
+function serverForQuestion(question, rows) {
+  if (question.actorKind === 'mcp_server') {
+    const named = MCP_SERVER_ACTOR_RE.exec(question.actor);
+    if (named) return named[1];
+  }
+  const suffix = `.${question.tool}`;
+  for (let i = rows.length - 1; i >= 0; i--) {
+    const echo = parseCallingEcho(rows[i]);
+    if (!echo) continue;
+    if (echo.qualified.length > suffix.length && echo.qualified.endsWith(suffix)) {
+      return echo.qualified.slice(0, -suffix.length);
+    }
+  }
+  return CODEX_APPS_SERVER;
+}
 
 // Scan bottom-up (the live prompt is at the end of the viewport). Prefer the
-// explicit "Allow the … server to run tool …?" question; fall back to the
-// "Calling server.tool(" echo Codex prints just above the approval widget.
+// explicit question — its quoted tool name is authoritative — and fall back to
+// the "Calling <qualified>" echo Codex prints just above the approval widget.
+//
+// Returns { server, tool, questionIdx, actorKind } | null. `actorKind` is null
+// on the echo-only path (there is no question actor to classify).
 function extractMcpServerTool(lines) {
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const q = lines[i].match(QUESTION_RE);
-    if (q) return { server: q[1], tool: q[2], questionIdx: i };
+  const rows = Array.isArray(lines) ? lines : [];
+
+  for (let i = rows.length - 1; i >= 0; i--) {
+    const question = parseApprovalQuestion(rows[i]);
+    if (!question) continue;
+    return {
+      server: serverForQuestion(question, rows),
+      tool: question.tool,
+      questionIdx: i,
+      actorKind: question.actorKind,
+    };
   }
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const c = lines[i].match(CALLING_RE);
-    if (c) return { server: c[1], tool: c[2], questionIdx: -1 };
+
+  for (let i = rows.length - 1; i >= 0; i--) {
+    const echo = parseCallingEcho(rows[i]);
+    if (!echo) continue;
+    // Split at the FIRST dot: 'codex_apps.google_drive.update_file' is server
+    // 'codex_apps' + tool 'google_drive.update_file' (a greedy split at the last
+    // dot silently truncated the tool to 'update_file').
+    const dot = echo.qualified.indexOf('.');
+    if (dot <= 0) continue;
+    return {
+      server: echo.qualified.slice(0, dot),
+      tool: echo.qualified.slice(dot + 1),
+      questionIdx: -1,
+      actorKind: null,
+    };
   }
+
   return null;
 }
 
-module.exports = { CALLING_RE, QUESTION_RE, extractMcpServerTool };
+module.exports = {
+  CODEX_APPS_SERVER,
+  parseApprovalQuestion,
+  parseCallingEcho,
+  extractMcpServerTool,
+};

package/template/coding-task-manager/providers/codex-mcp.js

@@ -10,8 +10,17 @@
 //   3. Always allow
 //   4. Cancel
 //   enter to submit | esc to cancel
-
-const { QUESTION_RE, CALLING_RE, extractMcpServerTool } = require('./codex-mcp-extract');
+//
+// The question's actor is structural, not a fixed list: "the <server> MCP
+// server" (ordinary MCP server), "this app" (server `codex_apps`, connector
+// unnamed) or the connector's display name (e.g. "Google Drive", also server
+// `codex_apps`). The echo line may carry no "({...})" argument list.
+
+const {
+  parseApprovalQuestion,
+  parseCallingEcho,
+  extractMcpServerTool,
+} = require('./codex-mcp-extract');
 const ALLOW_RE = /^\s*[❯›> ]?\s*1\.\s*Allow\b/i;
 // At least one of the "remember this" options — the structural twin of "1. Allow"
 // that distinguishes a live MCP approval menu from a stray "Allow" in prose.
@@ -47,13 +56,13 @@ module.exports = {
     const lines = String(text || '').split('\n').map(l => l.trim()).filter(Boolean);
     if (lines.length < 3) return false;
 
-    // The MCP question ("Allow the <server> MCP server to run tool …?") or the
-    // "Calling server.tool(" echo is the strongest, most stable signal. Codex's
+    // The MCP question ("Allow <actor> to run tool …?") or the
+    // "Calling server.tool" echo is the strongest, most stable signal. Codex's
     // footer hint ("enter to submit | esc to cancel") was DROPPED in newer builds
     // (0.142.x) — anchoring detection on that cosmetic string silently broke every
     // MCP auto-approval when the UI changed, so it is no longer used at all. Detect
     // on the invariant structure instead.
-    const hasQuestion = lines.some(l => QUESTION_RE.test(l)) || lines.some(l => CALLING_RE.test(l));
+    const hasQuestion = lines.some(l => parseApprovalQuestion(l) || parseCallingEcho(l));
     if (!hasQuestion) return false;
 
     // Require a LIVE Allow-option block near the viewport bottom: "1. Allow" plus at