painapple-code 1.1.2__tar.gz → 1.1.4__tar.gz

{painapple_code-1.1.2 → painapple_code-1.1.4}/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 Notable changes are documented here per release. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [SemVer](https://semver.org/), and the git tag is the single source of truth for the version (the PyPI wheel, the Docker image tag, and `__version__` all derive from it).
 
+## 1.1.4 — 2026-10-01
+
+### Fixed
+
+- Codex sessions get rich turn summaries and auto-generated session titles again on newer Codex CLIs (0.159+); the summary fork was being rejected, leaving only the raw journal. Summary-fork failures are now logged as warnings instead of disappearing.
+- Markdown links to local files in chat — `[name](/abs/path/file.md)`, `./x.md`, `file://…`, optionally with `#L12` / `:12` line targets — open the file preview instead of navigating the browser to a dead server URL.
+
+## 1.1.3 — 2026-10-01
+
+### Fixed
+
+- Codex sessions now ask for MCP tool approvals with the same in-chat permission card Claude sessions use — Allow / Deny, plus "always allow" for this session or for good. Previously Codex rejected every MCP tool call that needed approval (anything not marked read-only).
+- Switching a Codex session's permission mode (e.g. to Full access, the equivalent of `codex --yolo`) now takes effect for the existing conversation; before, a resumed Codex thread kept the sandbox it was started with, even across server restarts.
+- Failed `!` bang commands show the stderr explaining the failure instead of a bare "Exit code: N", and output written to both stdout and stderr is no longer cut down to stdout.
+
 ## 1.1.2 — 2026-09-30
 
 ### Added

{painapple_code-1.1.2/src/painapple_code.egg-info → painapple_code-1.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: painapple-code
-Version: 1.1.2
+Version: 1.1.4
 Summary: Self-hosted remote UI for Claude Code that journals every turn - background AI summaries become shadow-git commits and a queryable DuckDB history
 Author-email: Michał Booth-Wrotkowski <michal@boothw.com>
 License-Expression: AGPL-3.0-or-later

{painapple_code-1.1.2 → painapple_code-1.1.4}/docs-site/getting-started/security.md

@@ -21,7 +21,7 @@ The modes available on the default provider (set per session via the button next
 | **Auto** | `auto` | Claude's AI classifier gates each tool call |
 | **YOLO** | `bypassPermissions` | Full access |
 
-Three caveats. First, the approval cards only protect you while you're the one clicking them — in **YOLO** and **Auto** nothing asks, and those are the modes that give Claude the most freedom. Second, the cards exist only on the Claude provider: Codex enforces its own sandbox tiers instead. Third — and this is the point of this whole section — the boundary that actually holds is the one *below* the agent: the OS user, the container, the VM. A permission mode is the agent cooperating, not a sandbox. See the [permissions guide](../guides/permissions-and-thinking.md) for the full story.
+Three caveats. First, the approval cards only protect you while you're the one clicking them — in **YOLO** and **Auto** nothing asks, and those are the modes that give Claude the most freedom. Second, on the Codex provider the cards cover only MCP tool calls (Codex asks before running an MCP tool that isn't marked read-only); everything else is governed by Codex's own sandbox tiers. Third — and this is the point of this whole section — the boundary that actually holds is the one *below* the agent: the OS user, the container, the VM. A permission mode is the agent cooperating, not a sandbox. See the [permissions guide](../guides/permissions-and-thinking.md) for the full story.
 
 ## Terminal
 

{painapple_code-1.1.2 → painapple_code-1.1.4}/docs-site/guides/permissions-and-thinking.md

@@ -28,7 +28,7 @@ The **"always allow"** options on a card are the CLI's own "don't ask again" sug
 The default mode is **Ask** — reads run freely, but every edit and command waits for your approval on a card. Prefer **Accept Edits** to wave edits through and only get carded for commands, **YOLO** or **Auto** to let Claude just work, or **Don't Ask** to auto-deny anything your allow rules don't already cover. **Plan** stays read-only.
 
 !!! note "Other providers"
-    Sessions can also run on OpenAI Codex — see [AI providers](providers.md) for picking one per session (or pinning a server-wide default with `--default-provider`). The same pass-through applies: Codex doesn't use these modes at all, so the button maps to the Codex CLI's own **sandbox tiers** (Read-only / Workspace write / Full access), enforced by Codex.
+    Sessions can also run on OpenAI Codex — see [AI providers](providers.md) for picking one per session (or pinning a server-wide default with `--default-provider`). The same pass-through applies: Codex doesn't use these modes at all, so the button maps to the Codex CLI's own **sandbox tiers** (Read-only / Workspace write / Full access), enforced by Codex. One thing still asks: before running an MCP tool that isn't marked read-only, Codex requests approval, and that shows up as the same in-chat card (with "always allow" for this session or for good). **Full access** behaves like `codex --yolo` and runs MCP tools without asking.
 
 !!! note "Auto mode is a research preview"
     Auto is the CLI's `--permission-mode auto`, where a classifier model on Claude Code's side gates each call. It needs a recent CLI and model (Sonnet 4.6+/Opus 4.6+ on the Anthropic API; Team/Enterprise plans need an org owner to enable it). Also, headless auto sessions abort after 3 consecutive classifier blocks (or 20 total) — if Claude keeps getting blocked, the turn ends rather than looping.

{painapple_code-1.1.2 → painapple_code-1.1.4}/docs-site/guides/providers.md

@@ -33,7 +33,7 @@ The **default provider** for new sessions is set with the **Make default** butto
 Each provider self-describes its capabilities, and the UI follows:
 
 - **Models** — the model picker shows the *active provider's* catalog. Claude's comes from the server's editable `models.yaml`; Codex's mirrors the Codex CLI's own model list (so it updates when Codex does). Per-provider default models are configured in Settings → Providers.
-- **Permission modes** — the Claude provider speaks Claude's modes (Plan / Ask / Don't Ask / Accept Edits / Auto / YOLO — see [Permission modes](permissions-and-thinking.md)); the Codex provider maps to Codex **sandbox tiers**: Read-only, Workspace write, and Full access.
+- **Permission modes** — the Claude provider speaks Claude's modes (Plan / Ask / Don't Ask / Accept Edits / Auto / YOLO — see [Permission modes](permissions-and-thinking.md)); the Codex provider maps to Codex **sandbox tiers**: Read-only, Workspace write, and Full access. Codex's MCP tool approvals render as the same in-chat permission cards; Full access skips them, like `codex --yolo`.
 - **Effort** — the effort gauge renders each provider's own scale. Claude has five levels (low → max); Codex levels come from its model catalog and can reach `xhigh` / `ultra` on recent models, with the picker narrowing to what the selected model supports.
 - **Cost** — Codex reports tokens only, no dollar figure, so the `$` cost readouts hide on Codex sessions and the turn bar shows token counts.
 - **Continue in the CLI** — the **Continue in CLI** quick action is provider-aware: a Claude session gives you `claude -r <id>`, a Codex session `codex exec resume <id>`.

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.1.2'
-__version_tuple__ = version_tuple = (1, 1, 2)
+__version__ = version = '1.1.4'
+__version_tuple__ = version_tuple = (1, 1, 4)
 
-__commit_id__ = commit_id = 'g2fe4788'
+__commit_id__ = commit_id = 'gbe0e310'

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/providers/__init__.py

@@ -46,7 +46,7 @@ from painapple_code.providers.base import (
 from painapple_code.providers.claude import ClaudeProvider
 from painapple_code.providers.codex_app_server import CodexAppServerProvider
 
-logger = logging.getLogger(__name__)
+logger = logging.getLogger("painapple-code.providers")
 
 # Default provider for new sessions, and the fallback when a session records no
 # provider (pre-field sessions were all created against the Claude CLI). The

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/providers/codex_app_server/__init__.py

@@ -88,6 +88,7 @@ class CodexAppServerProvider(
         persistent_process=True,   # one app-server process, many turns
         forward_plain_stderr=False,  # app-server logs human progress to stderr
         transport="jsonrpc",       # the session layer drives a transport driver
+        interactive_permissions=True,  # MCP tool approvals → permission card
     )
 
     def make_transport(self, process, opts, session):

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/providers/codex_app_server/launch.py

@@ -74,8 +74,20 @@ class _LaunchMixin:
         return params
 
     def thread_resume_params(self, opts: LaunchOptions, thread_id: str, cwd: str) -> dict:
-        """Params for `thread/resume` (continue an existing thread by id)."""
-        params: dict = {"threadId": thread_id, "cwd": cwd}
+        """Params for `thread/resume` (continue an existing thread by id).
+
+        Sandbox/approval MUST ride along: without them the app-server keeps the
+        thread's ORIGINAL sandbox from its rollout, so a mode change (which
+        respawns + resumes) never took effect — a thread started in
+        workspace-write still gated MCP tools after switching to
+        danger-full-access (codex --yolo), even across restarts.
+        """
+        params: dict = {
+            "threadId": thread_id,
+            "cwd": cwd,
+            "sandbox": _SANDBOX_BY_MODE.get(opts.permission_mode or "", _DEFAULT_SANDBOX),
+            "approvalPolicy": "never",
+        }
         model = self._wire_model(opts.model)
         if model:
             params["model"] = model

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/providers/codex_app_server/summary.py

@@ -30,7 +30,7 @@ from typing import Optional
 from painapple_code import paths
 from painapple_code.providers.base import SummaryForkPlan
 
-logger = logging.getLogger("painapple_code")
+logger = logging.getLogger("painapple-code.codex-app-server")
 
 # Per-request waits. The handshake/fork/turn acks return promptly; the turn's
 # content streams as notifications, so awaiting an ack never blocks turn-length.
@@ -126,6 +126,9 @@ class _SummaryMixin:
         try:
             await client.request("initialize", {
                 "clientInfo": {"name": "painapple-code", "version": _client_version()},
+                # `excludeTurns` below is an experimental field: older CLIs
+                # (0.144) reject it without this opt-in.
+                "capabilities": {"experimentalApi": True},
             }, timeout=_RPC_TIMEOUT)
             await client.notify("initialized")
 
@@ -135,6 +138,11 @@ class _SummaryMixin:
                 "cwd": payload.get("cwd") or ".",
                 "sandbox": "read-only",       # the summarizer must not touch files
                 "approvalPolicy": "never",
+                # Newer CLIs (0.159) refuse an ephemeral fork of a paginated
+                # thread without it ("-32600 … requires excludeTurns: true").
+                # It only trims the RESPONSE's turn list — the fork still
+                # carries the full conversation context.
+                "excludeTurns": True,
             }
             if payload.get("model"):
                 fork_params["model"] = payload["model"]
@@ -163,7 +171,7 @@ class _SummaryMixin:
             }
             return structured, cost
         except Exception as e:
-            logger.info(f"codex app-server summary fork failed: {e}")
+            logger.warning(f"codex app-server summary fork failed: {e}")
             return None, None
         finally:
             await client.close()

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/providers/codex_app_server/transport.py

@@ -21,10 +21,11 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import re
 
 from painapple_code.session_store import SessionStore
 
-logger = logging.getLogger("painapple_code")
+logger = logging.getLogger("painapple-code.codex-app-server")
 
 # Default per-request timeout. The handshake and thread/turn acks return
 # promptly; a turn's *content* streams as separate notifications, so awaiting an
@@ -44,6 +45,21 @@ _APPROVAL_DENY = {
 }
 
 
+# MCP tool approvals. Codex asks before running an MCP tool that isn't
+# annotated read-only — even under `approvalPolicy="never"`, which only governs
+# shell/patch escalations — by sending an `mcpServer/elicitation/request` whose
+# `_meta.codex_approval_kind` is "mcp_tool_call". An unanswered/errored request
+# makes codex reject the call ("user rejected MCP tool call"), so these are
+# round-tripped to the client's permission card instead. `_meta.persist` lists
+# the remember-scopes codex will honour ("session", "always"); echoing one back
+# in the accept response's `_meta.persist` stops it asking again.
+_MCP_APPROVAL_KIND = "mcp_tool_call"
+_MCP_TOOL_RE = re.compile(r'run tool "([^"]+)"')
+# codex persist scope → the permission card's suggestion `destination`
+# (reusing the addRules row shape the Claude card already renders/labels).
+_PERSIST_DESTINATION = {"session": "session", "always": "userSettings"}
+
+
 def _client_version() -> str:
     try:
         from painapple_code import __version__
@@ -66,6 +82,12 @@ class JsonRpcTransport:
         self._thread_id = None      # codex thread id (== session.session_id)
         self._active_turn_id = None  # in-flight turn id (turn/interrupt needs it)
         self._send_lock = asyncio.Lock()  # serialize handshake/thread/turn sends
+        # Set by the session layer: async callable(permission_request dict) that
+        # surfaces an approval card to the client. None → approvals are declined.
+        self.on_permission_request = None
+        # permission request_id → (JSON-RPC request id, [persist scope per
+        # suggestion index]) for approvals awaiting the user's decision.
+        self._pending_approvals: dict = {}
 
     # --- low-level JSON-RPC I/O ------------------------------------------
 
@@ -133,6 +155,13 @@ class JsonRpcTransport:
                 self._active_turn_id = turn["id"]
         elif method == "turn/completed":
             self._active_turn_id = None
+        elif method == "serverRequest/resolved":
+            # Codex settled a request itself (turn interrupted / thread closed)
+            # — retire any approval card still waiting on it.
+            rid = (native.get("params") or {}).get("requestId")
+            request_id = f"codex-mcp-{rid}"
+            if request_id in self._pending_approvals:
+                asyncio.create_task(self._expire_approval(request_id))
         return True                          # notification → translate
 
     async def initialize(self) -> None:
@@ -226,6 +255,9 @@ class JsonRpcTransport:
     async def _answer_server_request(self, native: dict) -> None:
         method = native.get("method", "")
         rid = native.get("id")
+        if method == "mcpServer/elicitation/request":
+            await self._handle_elicitation(rid, native.get("params") or {})
+            return
         deny = _APPROVAL_DENY.get(method)
         if deny is not None:
             await self._write({"jsonrpc": "2.0", "id": rid, "result": deny})
@@ -236,3 +268,68 @@ class JsonRpcTransport:
                 "jsonrpc": "2.0", "id": rid,
                 "error": {"code": -32601, "message": f"{method} not handled"},
             })
+
+    # --- MCP tool approvals ------------------------------------------------
+
+    async def _handle_elicitation(self, rid, params: dict) -> None:
+        """Surface an MCP tool approval as a permission card.
+
+        Only codex's own tool-call approvals are routed to the user. A genuine
+        MCP-server elicitation (a form/URL the server wants filled in) has no
+        UI here yet, so it's declined — explicitly, so codex doesn't hang.
+        """
+        meta = params.get("_meta") or {}
+        if (meta.get("codex_approval_kind") != _MCP_APPROVAL_KIND
+                or self.on_permission_request is None):
+            logger.info(f"codex elicitation from {params.get('serverName')!r} "
+                        f"declined (kind={meta.get('codex_approval_kind')!r})")
+            await self._write({"jsonrpc": "2.0", "id": rid,
+                               "result": {"action": "decline", "content": None}})
+            return
+
+        server = params.get("serverName") or "mcp"
+        message = params.get("message") or ""
+        m = _MCP_TOOL_RE.search(message)
+        tool_name = f"mcp__{server}__{m.group(1)}" if m else f"mcp__{server}"
+        persist = [p for p in (meta.get("persist") or []) if p in _PERSIST_DESTINATION]
+        request_id = f"codex-mcp-{rid}"
+        self._pending_approvals[request_id] = (rid, persist)
+        tool_input = meta.get("tool_params")
+        await self.on_permission_request({
+            "type": "permission_request",
+            "request_id": request_id,
+            "tool_name": tool_name,
+            "input": tool_input if isinstance(tool_input, dict) else {},
+            "description": message or None,
+            "suggestions": [
+                {"type": "addRules", "rules": [{"tool_name": tool_name}],
+                 "destination": _PERSIST_DESTINATION[p]}
+                for p in persist
+            ],
+        })
+
+    async def _expire_approval(self, request_id: str) -> None:
+        self._pending_approvals.pop(request_id, None)
+        self.session._pending_permission_requests.pop(request_id, None)
+        # ok=False → the client marks the card expired (same as a dead process).
+        await self.session.safe_send({"type": "permission_resolved",
+                                      "request_id": request_id, "ok": False})
+
+    def owns_permission(self, request_id) -> bool:
+        return request_id in self._pending_approvals
+
+    async def respond_permission(self, request_id: str, data: dict) -> bool:
+        """Answer a pending MCP approval with the user's decision."""
+        entry = self._pending_approvals.pop(request_id, None)
+        if entry is None:
+            return False
+        rid, persist = entry
+        if data.get("behavior") == "allow":
+            result: dict = {"action": "accept", "content": None}
+            idx = data.get("suggestion_index")
+            if isinstance(idx, int) and 0 <= idx < len(persist):
+                result["_meta"] = {"persist": persist[idx]}
+        else:
+            result = {"action": "decline", "content": None}
+        await self._write({"jsonrpc": "2.0", "id": rid, "result": result})
+        return True

{painapple_code-1.1.2 → painapple_code-1.1.4}/src/painapple_code/services/agent_session.py

@@ -866,6 +866,11 @@ class AgentManager:
                     session.process, launch_opts, session
                 )
                 if session._transport is not None:
+                    if hasattr(session._transport, "on_permission_request"):
+                        # Transport-native approvals (Codex MCP tool calls)
+                        # ride the same permission-card flow as claude-sdk.
+                        session._transport.on_permission_request = (
+                            lambda msg, _s=session: self._handle_permission_request(_s, msg))
                     await session._transport.initialize()
 
             return True
@@ -2486,6 +2491,18 @@ class AgentManager:
             return False
         if not session.process or not session.is_running:
             return False
+        transport = session._transport
+        if transport is not None and getattr(transport, "owns_permission", lambda _r: False)(request_id):
+            # JSON-RPC transport answers its own server request (Codex MCP
+            # approval) — nothing goes to stdin as a line frame.
+            try:
+                ok = await transport.respond_permission(request_id, data)
+            except Exception as e:
+                logger.error(f"Error sending transport permission response: {e}")
+                return False
+            session._pending_permission_requests.pop(request_id, None)
+            session.touch()
+            return ok
         request = session._pending_permission_requests[request_id]
         frame = {
             "type": "permission_response",