mcp-agents 0.8.0 → 0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-agents",
-  "version": "0.8.0",
+  "version": "0.10.1",
   "description": "MCP server that wraps AI CLI tools (Claude Code, Gemini CLI, Codex CLI) for use by any MCP client",
   "type": "module",
   "bin": {

package/server.js

@@ -29,11 +29,36 @@ const VERSION = JSON.parse(
 const DEFAULT_TIMEOUT_MS = 300_000;
 const DEFAULT_CODEX_MODEL = "gpt-5.5";
 const DEFAULT_CODEX_MODEL_REASONING_EFFORT = "xhigh";
+const DEFAULT_CODEX_SANDBOX_MODE = "workspace-write";
+const DEFAULT_CODEX_APPROVAL_POLICY = "never";
 const DEFAULT_CLAUDE_MODEL = "claude-opus-4-8";
 const DEFAULT_CLAUDE_EFFORT = "xhigh";
 // tools/call argument keys stripped from the codex pass-through so callers
-// cannot override the pinned model/effort (or the read-only/never config).
-const CODEX_STRIPPED_TOOL_ARGS = ["model", "config"];
+// cannot override the pinned model/effort. sandbox/cwd/approval-policy are
+// intentionally left intact so callers can steer them per call.
+//   - top-level: only the dedicated `model` arg (there is no top-level
+//     model_reasoning_effort/profile arg in the codex tool schema)
+//   - inside the `config` override map: model/effort plus every other
+//     model-envelope vector — a `profile`/`profiles` can carry its own
+//     model/effort, provider/base-url keys re-point the same model name to a
+//     different backend, and the plan/review variants carry their own
+//     model/effort; all are stripped so the pin cannot be bypassed. Matched on
+//     each config key's HEAD segment so dotted overrides (codex accepts paths
+//     like `profiles.x.model`) are caught too, not just exact keys.
+const CODEX_STRIPPED_TOP_LEVEL_ARGS = ["model"];
+const CODEX_STRIPPED_CONFIG_KEYS = [
+  "model",
+  "model_reasoning_effort",
+  "profile",
+  "profiles",
+  "model_provider",
+  "model_providers",
+  "openai_base_url",
+  "chatgpt_base_url",
+  "model_catalog_json",
+  "plan_mode_reasoning_effort",
+  "review_model",
+];
 const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 const CLAUDE_EMPTY_OUTPUT_MAX_ATTEMPTS = 2;
 const SIGNAL_CODES = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
@@ -103,6 +128,9 @@ function toStringArg(value) {
 
 /**
  * Normalize provider output and parse Claude's JSON print format when present.
+ * `--output-format json` emits either a single `{type:"result"}` object or
+ * (newer CLIs, e.g. 2.1.x) an array of stream events whose final
+ * `type:"result"` entry holds the answer; both are supported.
  * @param {string} provider
  * @param {string} output
  * @returns {{ text: string, isError: boolean }}
@@ -115,10 +143,24 @@ function normalizeToolOutput(provider, output) {
 
   try {
     const parsed = JSON.parse(trimmed);
-    if (parsed && typeof parsed === "object" && parsed.type === "result") {
+    // Resolve the result event from either shape. Scanning from the end finds
+    // the terminal result without depending on Array.prototype.findLast
+    // (keeps the Node >=18 floor — see engines).
+    let result = parsed;
+    if (Array.isArray(parsed)) {
+      result = null;
+      for (let i = parsed.length - 1; i >= 0; i--) {
+        const event = parsed[i];
+        if (event && typeof event === "object" && event.type === "result") {
+          result = event;
+          break;
+        }
+      }
+    }
+    if (result && typeof result === "object" && result.type === "result") {
       return {
-        text: toStringArg(parsed.result),
-        isError: parsed.is_error === true,
+        text: toStringArg(result.result),
+        isError: result.is_error === true,
       };
     }
   } catch {
@@ -141,6 +183,10 @@ Options:
   --provider <name>              CLI backend to use (${providers}) [default: codex]
   --model <model>                Codex model [default: ${DEFAULT_CODEX_MODEL}]
   --model_reasoning_effort <e>   Codex reasoning effort [default: ${DEFAULT_CODEX_MODEL_REASONING_EFFORT}]
+  --sandbox_mode <mode>          Codex sandbox mode: read-only, workspace-write,
+                                 danger-full-access [default: ${DEFAULT_CODEX_SANDBOX_MODE}]
+  --approval_policy <policy>     Codex approval policy: untrusted, on-failure,
+                                 on-request, never [default: ${DEFAULT_CODEX_APPROVAL_POLICY}]
   --timeout <seconds>            Default timeout per call [default: 300]
   --help, -h                     Show this help message
   --version, -v                  Show version number`);
@@ -148,14 +194,17 @@ Options:
 
 /**
  * Parse CLI flags from process.argv.
- * Handles --help, --version, --provider, --model, --model_reasoning_effort, and unknown flags.
- * @returns {{ provider: string, model?: string, modelReasoningEffort?: string, defaultTimeoutMs?: number }}
+ * Handles --help, --version, --provider, --model, --model_reasoning_effort,
+ * --sandbox_mode, --approval_policy, and unknown flags.
+ * @returns {{ provider: string, model?: string, modelReasoningEffort?: string, sandboxMode?: string, approvalPolicy?: string, defaultTimeoutMs?: number }}
  */
 function parseArgs() {
   const args = process.argv.slice(2);
   let provider = "codex";
   let model;
   let modelReasoningEffort;
+  let sandboxMode;
+  let approvalPolicy;
   let defaultTimeoutMs;
 
   for (let i = 0; i < args.length; i++) {
@@ -193,6 +242,20 @@ function parseArgs() {
         }
         modelReasoningEffort = args[++i];
         break;
+      case "--sandbox_mode":
+        if (i + 1 >= args.length) {
+          process.stderr.write("error: --sandbox_mode requires a value\n");
+          process.exit(1);
+        }
+        sandboxMode = args[++i];
+        break;
+      case "--approval_policy":
+        if (i + 1 >= args.length) {
+          process.stderr.write("error: --approval_policy requires a value\n");
+          process.exit(1);
+        }
+        approvalPolicy = args[++i];
+        break;
       case "--timeout": {
         if (i + 1 >= args.length) {
           process.stderr.write("error: --timeout requires a value\n");
@@ -212,7 +275,14 @@ function parseArgs() {
     }
   }
 
-  return { provider, model, modelReasoningEffort, defaultTimeoutMs };
+  return {
+    provider,
+    model,
+    modelReasoningEffort,
+    sandboxMode,
+    approvalPolicy,
+    defaultTimeoutMs,
+  };
 }
 
 /**
@@ -356,15 +426,20 @@ function toTomlString(value) {
 
 /**
  * Build the minimal config for the isolated Codex bridge runtime.
- * @param {{ model: string, modelReasoningEffort: string }} opts
+ * @param {{ model: string, modelReasoningEffort: string, sandboxMode: string, approvalPolicy: string }} opts
  * @returns {string}
  */
-function buildCodexBridgeConfig({ model, modelReasoningEffort }) {
+function buildCodexBridgeConfig({
+  model,
+  modelReasoningEffort,
+  sandboxMode,
+  approvalPolicy,
+}) {
   return [
     `model = ${toTomlString(model)}`,
     `model_reasoning_effort = ${toTomlString(modelReasoningEffort)}`,
-    'approval_policy = "never"',
-    'sandbox_mode = "read-only"',
+    `approval_policy = ${toTomlString(approvalPolicy)}`,
+    `sandbox_mode = ${toTomlString(sandboxMode)}`,
     "",
     "[features]",
     "multi_agent = false",
@@ -374,10 +449,15 @@ function buildCodexBridgeConfig({ model, modelReasoningEffort }) {
 
 /**
  * Create an isolated Codex home that preserves auth but strips inherited MCP servers.
- * @param {{ model: string, modelReasoningEffort: string }} opts
+ * @param {{ model: string, modelReasoningEffort: string, sandboxMode: string, approvalPolicy: string }} opts
  * @returns {string}
  */
-function createIsolatedCodexHome({ model, modelReasoningEffort }) {
+function createIsolatedCodexHome({
+  model,
+  modelReasoningEffort,
+  sandboxMode,
+  approvalPolicy,
+}) {
   const codexHome = mkdtempSync(join(tmpdir(), "mcp-agents-codex-"));
   const sourceAuthPath = join(resolveCodexHome(), "auth.json");
   const targetAuthPath = join(codexHome, "auth.json");
@@ -389,7 +469,12 @@ function createIsolatedCodexHome({ model, modelReasoningEffort }) {
 
   writeFileSync(
     configPath,
-    buildCodexBridgeConfig({ model, modelReasoningEffort }),
+    buildCodexBridgeConfig({
+      model,
+      modelReasoningEffort,
+      sandboxMode,
+      approvalPolicy,
+    }),
     "utf8",
   );
 
@@ -398,10 +483,13 @@ function createIsolatedCodexHome({ model, modelReasoningEffort }) {
 
 /**
  * Filter a single newline-delimited JSON-RPC message on its way to the codex
- * pass-through. Strips per-call model/config overrides from `tools/call` so the
- * client cannot escape the pinned model/effort (or the read-only/never config).
- * Non-`tools/call` and unparseable lines are returned byte-for-byte unchanged so
- * the MCP framing is preserved.
+ * pass-through. Strips per-call model/effort overrides from `tools/call` so the
+ * client cannot escape the pinned model/effort — both the top-level `model` arg
+ * and the model-envelope keys inside a `config` override map. sandbox/cwd/
+ * approval-policy (top-level and inside `config`) are intentionally left intact
+ * so callers can steer them per call. Non-`tools/call`, unparseable, and
+ * nothing-to-strip lines are returned byte-for-byte unchanged so the MCP framing
+ * is preserved.
  * @param {string} line
  * @returns {string}
  */
@@ -422,12 +510,36 @@ function filterCodexToolCall(line) {
       : null;
   if (!args || typeof args !== "object") return line;
 
-  const stripped = CODEX_STRIPPED_TOOL_ARGS.filter((key) => key in args);
-  if (stripped.length === 0) return line;
+  const removed = [];
+
+  for (const key of CODEX_STRIPPED_TOP_LEVEL_ARGS) {
+    if (key in args) {
+      delete args[key];
+      removed.push(key);
+    }
+  }
+
+  // Per-call `config` overrides beat CODEX_HOME/config.toml, so the pinned
+  // model/effort must be stripped from here too; everything else (sandbox_mode,
+  // approval_policy, cwd, sandbox_workspace_write, …) is left untouched. codex
+  // config overrides also accept dotted paths (e.g. "profiles.x.model"), so
+  // match each key on its HEAD segment, not the exact key.
+  const cfg = args.config;
+  if (cfg && typeof cfg === "object" && !Array.isArray(cfg)) {
+    for (const key of Object.keys(cfg)) {
+      if (CODEX_STRIPPED_CONFIG_KEYS.includes(key.split(".")[0])) {
+        delete cfg[key];
+        removed.push(`config.${key}`);
+      }
+    }
+    // Drop a now-empty override map so codex never receives a bare `config: {}`.
+    if (Object.keys(cfg).length === 0) delete args.config;
+  }
+
+  if (removed.length === 0) return line; // nothing pinned to strip — keep framing
 
-  for (const key of stripped) delete args[key];
   logErr(
-    `[mcp-agents] codex passthrough: ignoring per-call overrides: ${stripped.join(", ")}`,
+    `[mcp-agents] codex passthrough: pinning model/effort, stripped: ${removed.join(", ")}`,
   );
   return JSON.stringify(msg);
 }
@@ -436,18 +548,27 @@ function filterCodexToolCall(line) {
  * Spawn codex mcp-server as a pass-through. stdout/stderr flow straight back to
  * the client, but the client's stdin is intercepted line-by-line so per-call
  * model/config overrides are stripped before reaching codex.
- * @param {{ model?: string, modelReasoningEffort?: string }} opts
+ * @param {{ model?: string, modelReasoningEffort?: string, sandboxMode?: string, approvalPolicy?: string }} opts
  */
-function runCodexPassthrough({ model, modelReasoningEffort }) {
+function runCodexPassthrough({
+  model,
+  modelReasoningEffort,
+  sandboxMode,
+  approvalPolicy,
+}) {
   const resolvedModel = model || DEFAULT_CODEX_MODEL;
   const resolvedModelReasoningEffort =
     modelReasoningEffort || DEFAULT_CODEX_MODEL_REASONING_EFFORT;
+  const resolvedSandboxMode = sandboxMode || DEFAULT_CODEX_SANDBOX_MODE;
+  const resolvedApprovalPolicy = approvalPolicy || DEFAULT_CODEX_APPROVAL_POLICY;
   let isolatedCodexHome;
 
   try {
     isolatedCodexHome = createIsolatedCodexHome({
       model: resolvedModel,
       modelReasoningEffort: resolvedModelReasoningEffort,
+      sandboxMode: resolvedSandboxMode,
+      approvalPolicy: resolvedApprovalPolicy,
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -472,7 +593,9 @@ function runCodexPassthrough({ model, modelReasoningEffort }) {
 
   logErr(
     `[mcp-agents] passthrough: codex ${args.join(" ")} ` +
-      `(model=${resolvedModel}, reasoning_effort=${resolvedModelReasoningEffort}, isolated_home=true)`,
+      `(model=${resolvedModel}, reasoning_effort=${resolvedModelReasoningEffort}, ` +
+      `sandbox_mode=${resolvedSandboxMode}, approval_policy=${resolvedApprovalPolicy}, ` +
+      `isolated_home=true)`,
   );
 
   const child = spawn("codex", args, {
@@ -486,22 +609,27 @@ function runCodexPassthrough({ model, modelReasoningEffort }) {
     logErr(`[codex] ${chunk.toString().trimEnd()}`);
   });
 
-  // Pump client stdin -> codex stdin, splitting on newlines (MCP stdio framing)
-  // so each JSON-RPC message can be filtered before forwarding.
+  // Pump client stdin -> codex stdin, splitting on the newline BYTE (0x0a) that
+  // delimits MCP stdio JSON-RPC frames. Buffering raw bytes (not per-chunk
+  // strings) avoids corrupting a multibyte UTF-8 sequence that straddles two
+  // read chunks, which would otherwise break the byte-for-byte passthrough.
   child.stdin.on("error", () => {}); // ignore EPIPE if codex exits early
-  let stdinBuf = "";
+  const NEWLINE = 0x0a;
+  let stdinBuf = Buffer.alloc(0);
   process.stdin.on("data", (chunk) => {
-    stdinBuf += chunk.toString("utf8");
+    stdinBuf = stdinBuf.length ? Buffer.concat([stdinBuf, chunk]) : chunk;
     let nl;
-    while ((nl = stdinBuf.indexOf("\n")) !== -1) {
-      const line = stdinBuf.slice(0, nl);
-      stdinBuf = stdinBuf.slice(nl + 1);
+    while ((nl = stdinBuf.indexOf(NEWLINE)) !== -1) {
+      const line = stdinBuf.subarray(0, nl).toString("utf8");
+      stdinBuf = stdinBuf.subarray(nl + 1);
       child.stdin.write(`${filterCodexToolCall(line)}\n`);
     }
   });
   process.stdin.on("error", () => {});
   process.stdin.on("end", () => {
-    if (stdinBuf.length > 0) child.stdin.write(filterCodexToolCall(stdinBuf));
+    if (stdinBuf.length > 0) {
+      child.stdin.write(filterCodexToolCall(stdinBuf.toString("utf8")));
+    }
     child.stdin.end();
   });
 
@@ -539,7 +667,14 @@ function runCodexPassthrough({ model, modelReasoningEffort }) {
 // ---------------------------------------------------------------------------
 
 async function main() {
-  const { provider: providerName, model, modelReasoningEffort, defaultTimeoutMs } = parseArgs();
+  const {
+    provider: providerName,
+    model,
+    modelReasoningEffort,
+    sandboxMode,
+    approvalPolicy,
+    defaultTimeoutMs,
+  } = parseArgs();
   const backend = CLI_BACKENDS[providerName];
 
   if (!backend) {
@@ -550,7 +685,12 @@ async function main() {
   }
 
   if (backend.passthrough) {
-    runCodexPassthrough({ model, modelReasoningEffort });
+    runCodexPassthrough({
+      model,
+      modelReasoningEffort,
+      sandboxMode,
+      approvalPolicy,
+    });
     return;
   }