Let Codex plugin approval prompts reach the client

Rhys Sullivan committed 2 months ago

Commit 8fa7ed81 parent 1631dad3 files · +58 −1Browse files

Unified · Split

3 files

packages/plugins/mcp/src/sdk/appserver-connector.test.ts +24 −0
packages/plugins/mcp/src/sdk/appserver-connector.ts +14 −1
packages/plugins/mcp/src/sdk/appserver-test-server.ts +20 −0

packages/plugins/mcp/src/sdk/appserver-connector.test.ts+24−0

@@ -78,6 +78,30 @@ describe("codex app-server bridge", () => { · 77 unmodified lines
78	),	78	),
79	);	79	);
80		80
		81	it.effect("starts the thread with an approval policy that lets prompts through", () =>
		82	Effect.scoped(
		83	Effect.gen(function* () {
		84	// Codex declines MCP elicitations ITSELF on a thread whose approval
		85	// policy does not allow them — the prompt never reaches the client and
		86	// the tool just reports "access was not approved". The fixture only
		87	// elicits when the bridge asked for a permitting policy, so reaching
		88	// the handler at all is the assertion.
		89	const connection = yield* withConnection(appServerInput("messages"));
		90	let prompted = false;
		91	connection.client.setRequestHandler("elicitation/create", () => {
		92	prompted = true;
		93	return Promise.resolve({ action: "accept" as const, content: {} });
		94	});
		95
		96	const result = yield* Effect.promise(() =>
		97	connection.client.callTool({ name: "needs_approval", arguments: {} }),
		98	);
		99	expect(prompted, "the plugin's own approval prompt reached the client").toBe(true);
		100	expect(result.isError).toBeFalsy();
		101	}),
		102	),
		103	);
		104
81	it.effect("a declined elicitation reaches the app-server as a decline, not an approval", () =>	105	it.effect("a declined elicitation reaches the app-server as a decline, not an approval", () =>
82	Effect.scoped(	106	Effect.scoped(
83	Effect.gen(function* () {	107	Effect.gen(function* () {

packages/plugins/mcp/src/sdk/appserver-connector.ts+14−1

 //
 //   MCP upstream                      app-server downstream
 //   initialize                    →   initialize → initialized → thread/start
+//                                     (with an approval policy that lets the
+//                                      plugin's own prompts reach the client)
 //   tools/list                    →   mcpServerStatus/list (one server's tools)
 //   tools/call                    →   mcpServer/tool/call
 //   elicitation/create (to client) ←  mcpServer/elicitation/request
       return;
     }
     this.#sendDownstream({ jsonrpc: "2.0", method: "initialized" });
-    const started = await this.#request("thread/start", { sessionStartSource: "startup" });
+    // `approvalPolicy` is load-bearing, not a default worth inheriting: on a
+    // thread whose policy is `never` (or a granular one without
+    // `mcpElicitations`) Codex DECLINES every MCP elicitation itself and never
+    // forwards it, which surfaces as an unexplained "access was not approved"
+    // on any tool that asks — `read_messages` above all. `on-request` is the
+    // policy that routes the plugin's own approval prompt to the client, where
+    // executor's elicitation bridge answers it. Nothing else can escalate here:
+    // this thread runs no turns, so there is no shell or exec approval to ask.
+    const started = await this.#request("thread/start", {
+      sessionStartSource: "startup",
+      approvalPolicy: "on-request",
+    });
     if (!started.ok) {
       this.#fail(message.id, started.error);
       return;

packages/plugins/mcp/src/sdk/appserver-test-server.ts+20−0

   Schema.Struct({ clientInfo: Schema.Struct({ name: Schema.String }) }),
 );
+const decodeThreadStartParams = Schema.decodeUnknownOption(
+  Schema.Struct({ approvalPolicy: Schema.optional(Schema.String) }),
+);
 const decodeThreadParams = Schema.decodeUnknownOption(
   Schema.Struct({
     threadId: Schema.optional(Schema.String),
 };
 let initializedSeen = false;
+let elicitationsAllowed = false;
 let nextServerRequestId = 1000;
 /** Elicitation request id → the pending tool call's request id. */
 const pendingApprovals = new Map<number | string, number | string>();
     return;
   }
   if (call.tool === "needs_approval") {
+    if (!elicitationsAllowed) {
+      // Exactly what Codex returns when it declines the elicitation for the
+      // client: an error result, no prompt, no explanation.
+      reply(id, {
+        content: [{ type: "text", text: "access was not approved" }],
+        isError: true,
+      });
+      return;
+    }
     const elicitationId = nextServerRequestId++;
     pendingApprovals.set(elicitationId, id);
     write({
       replyError(message.id, -32600, "thread/start before the initialized notification");
       return;
     }
+    // Codex DECLINES every MCP elicitation itself on a thread whose approval
+    // policy does not allow them, so a thread started without one can never
+    // receive an approval prompt. The fixture models that: it only elicits
+    // when the bridge asked for a policy that permits elicitations.
+    const params = Option.getOrUndefined(decodeThreadStartParams(message.params));
+    elicitationsAllowed = params?.approvalPolicy === "on-request";
     reply(message.id, { thread: { id: THREAD_ID } });
     return;
   }