feat: LLM-25394 support Codex persist approval

src/ApprovalOptionId.ts

@@ -1,7 +1,11 @@
 export const ApprovalOptionId = {
     AllowOnce: "allow_once",
-    AllowAlways: "allow_always",
+    AllowForSession: "allow_for_session",
+    AllowPersist: "allow_persist",
+    AllowCommandPrefixRule: "allow_command_prefix_rule",
+    ApplyNetworkPolicyAmendment: "apply_network_policy_amendment",
     RejectOnce: "reject_once",
+    Cancel: "cancel",
 } as const;
 
 export type ApprovalOptionId = typeof ApprovalOptionId[keyof typeof ApprovalOptionId];

src/CodexAcpClient.ts

@@ -23,6 +23,7 @@ import {logger} from "./Logger";
 import type {
     AccountLoginCompletedNotification,
     AccountUpdatedNotification,
+    ConfigEdit,
     GetAccountResponse,
     ListMcpServerStatusParams,
     ListMcpServerStatusResponse,
@@ -309,6 +310,24 @@ export class CodexAcpClient {
         }
     }
 
+    // Makes an ACP-provided MCP server durable so Codex core can append
+    // mcp_servers.<server>.tools.<tool>.approval_mode afterward:
+    // https://github.com/openai/codex/blob/main/codex-rs/app-server/src/config_api.rs
+    async persistMcpServer(mcpServer: McpServer): Promise<void> {
+        const edits: ConfigEdit[] = [{
+            keyPath: `mcp_servers.${mcpServer.name}`,
+            value: this.createMcpSeverConfig(mcpServer),
+            mergeStrategy: "upsert",
+        }];
+
+        await this.codexClient.configBatchWrite({
+            edits,
+            filePath: null,
+            expectedVersion: null,
+            reloadUserConfig: true,
+        });
+    }
+
     private getModelProvider(): string | null {
         return this.gatewayConfig?.modelProvider ?? this.modelProvider;
     }

src/CodexAcpServer.ts

@@ -51,7 +51,7 @@ export interface SessionState {
     rateLimits: RateLimitsMap | null;
     account: Account | null;
     cwd: string;
-    sessionMcpServers?: Array<string>;
+    sessionMcpServers: Map<string, acp.McpServer>;
 }
 
 interface PendingMcpStartupSession {
@@ -161,7 +161,6 @@ export class CodexAcpServer implements acp.Agent {
 
         const accountResponse = await this.runWithProcessCheck(() => this.codexAcpClient.getAccount());
         const {sessionId, currentModelId, models} = sessionMetadata;
-        const sessionMcpServers = this.resolveSessionMcpServers(requestedMcpServers, "sessionId" in request);
         const currentModel = this.findCurrentModel(models, currentModelId);
         const sessionState: SessionState = {
             sessionId: sessionId,
@@ -176,7 +175,7 @@ export class CodexAcpServer implements acp.Agent {
             rateLimits: null,
             account: accountResponse.account,
             cwd: request.cwd,
-            sessionMcpServers: sessionMcpServers,
+            sessionMcpServers: this.createSessionMcpServers(requestedMcpServers, "sessionId" in request),
         }
         this.sessions.set(sessionId, sessionState);
 
@@ -372,7 +371,6 @@ export class CodexAcpServer implements acp.Agent {
 
         const accountResponse = await this.runWithProcessCheck(() => this.codexAcpClient.getAccount());
         const {sessionId, currentModelId, models, thread} = sessionMetadata;
-        const sessionMcpServers = this.resolveSessionMcpServers(requestedMcpServers, true);
         const currentModel = this.findCurrentModel(models, currentModelId);
         const sessionState: SessionState = {
             sessionId: sessionId,
@@ -387,7 +385,7 @@ export class CodexAcpServer implements acp.Agent {
             rateLimits: null,
             account: accountResponse.account,
             cwd: request.cwd,
-            sessionMcpServers: sessionMcpServers,
+            sessionMcpServers: this.createSessionMcpServers(requestedMcpServers, true),
         };
         this.sessions.set(sessionId, sessionState);
 
@@ -641,24 +639,23 @@ export class CodexAcpServer implements acp.Agent {
         return sessionState;
     }
 
-    private resolveSessionMcpServers(
+    private createSessionMcpServers(
         mcpServers: Array<acp.McpServer>,
         recoverFromStartup: boolean,
-    ): Array<string> {
+    ): Map<string, acp.McpServer> {
         // Explicit MCP servers from the request are the primary source of truth for the session.
-        const requestedServerNames = getRequestedMcpServerNames(mcpServers);
-        if (requestedServerNames.length > 0) {
-            return requestedServerNames;
+        if (mcpServers.length > 0) {
+            return new Map(mcpServers.map(server => [server.name, server]));
         }
         // Fresh sessions without MCP config should not inherit any session MCP state.
         if (!recoverFromStartup) {
-            return [];
+            return new Map();
         }
         // Without a thread-scoped startup completion event, loadSession/resumeSession can no longer
         // recover omitted session MCP server names. Treat the session set as unknown unless ACP
         // explicitly provided mcpServers in the request.
         logger.log("Skipping MCP server recovery for load/resume without explicit mcpServers");
-        return [];
+        return new Map();
     }
 
     private publishMcpStartupStatusAsync(sessionId: string): void {
@@ -719,7 +716,7 @@ export class CodexAcpServer implements acp.Agent {
         try {
             const eventHandler = new CodexEventHandler(this.connection, sessionState);
             const approvalHandler = new CodexApprovalHandler(this.connection, sessionState);
-            const elicitationHandler = new CodexElicitationHandler(this.connection, sessionState);
+            const elicitationHandler = new CodexElicitationHandler(this.connection, sessionState, this.codexAcpClient);
             await this.codexAcpClient.subscribeToSessionEvents(params.sessionId,
                 (event) => {
                     elicitationHandler.handleNotification(event);
@@ -868,7 +865,3 @@ export class CodexAcpServer implements acp.Agent {
         }
     }
 }
-
-function getRequestedMcpServerNames(mcpServers: Array<acp.McpServer>): Array<string> {
-    return Array.from(new Set(mcpServers.map(server => server.name)));
-}

src/CodexAppServerClient.ts

@@ -9,6 +9,8 @@ import type {
     AccountLoginCompletedNotification, AccountUpdatedNotification,
     ConfigReadParams,
     ConfigReadResponse,
+    ConfigBatchWriteParams,
+    ConfigWriteResponse,
     GetAccountParams,
     GetAccountResponse,
     ListMcpServerStatusParams,
@@ -195,6 +197,10 @@ export class CodexAppServerClient {
         return await this.sendRequest({ method: "config/read", params: params });
     }
 
+    async configBatchWrite(params: ConfigBatchWriteParams): Promise<ConfigWriteResponse> {
+        return await this.sendRequest({ method: "config/batchWrite", params });
+    }
+
     getMcpServerStartupVersion(): number {
         return this.mcpServerStartupVersion;
     }