Let Codex plugin approval prompts reach the client

Author: RhysSullivan

packages/plugins/mcp/src/sdk/appserver-connector.test.ts

@@ -78,6 +78,30 @@ describe("codex app-server bridge", () => {
     ),
   );
 
+  it.effect("starts the thread with an approval policy that lets prompts through", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        // Codex declines MCP elicitations ITSELF on a thread whose approval
+        // policy does not allow them — the prompt never reaches the client and
+        // the tool just reports "access was not approved". The fixture only
+        // elicits when the bridge asked for a permitting policy, so reaching
+        // the handler at all is the assertion.
+        const connection = yield* withConnection(appServerInput("messages"));
+        let prompted = false;
+        connection.client.setRequestHandler("elicitation/create", () => {
+          prompted = true;
+          return Promise.resolve({ action: "accept" as const, content: {} });
+        });
+
+        const result = yield* Effect.promise(() =>
+          connection.client.callTool({ name: "needs_approval", arguments: {} }),
+        );
+        expect(prompted, "the plugin's own approval prompt reached the client").toBe(true);
+        expect(result.isError).toBeFalsy();
+      }),
+    ),
+  );
+
   it.effect("a declined elicitation reaches the app-server as a decline, not an approval", () =>
     Effect.scoped(
       Effect.gen(function* () {

packages/plugins/mcp/src/sdk/appserver-connector.ts

@@ -17,6 +17,8 @@
 //
 //   MCP upstream                      app-server downstream
 //   initialize                    →   initialize → initialized → thread/start
+//                                     (with an approval policy that lets the
+//                                      plugin's own prompts reach the client)
 //   tools/list                    →   mcpServerStatus/list (one server's tools)
 //   tools/call                    →   mcpServer/tool/call
 //   elicitation/create (to client) ←  mcpServer/elicitation/request
@@ -277,7 +279,18 @@ class AppServerClientTransport implements Transport {
       return;
     }
     this.#sendDownstream({ jsonrpc: "2.0", method: "initialized" });
-    const started = await this.#request("thread/start", { sessionStartSource: "startup" });
+    // `approvalPolicy` is load-bearing, not a default worth inheriting: on a
+    // thread whose policy is `never` (or a granular one without
+    // `mcpElicitations`) Codex DECLINES every MCP elicitation itself and never
+    // forwards it, which surfaces as an unexplained "access was not approved"
+    // on any tool that asks — `read_messages` above all. `on-request` is the
+    // policy that routes the plugin's own approval prompt to the client, where
+    // executor's elicitation bridge answers it. Nothing else can escalate here:
+    // this thread runs no turns, so there is no shell or exec approval to ask.
+    const started = await this.#request("thread/start", {
+      sessionStartSource: "startup",
+      approvalPolicy: "on-request",
+    });
     if (!started.ok) {
       this.#fail(message.id, started.error);
       return;

packages/plugins/mcp/src/sdk/appserver-test-server.ts

@@ -29,6 +29,10 @@ const decodeInitializeParams = Schema.decodeUnknownOption(
   Schema.Struct({ clientInfo: Schema.Struct({ name: Schema.String }) }),
 );
 
+const decodeThreadStartParams = Schema.decodeUnknownOption(
+  Schema.Struct({ approvalPolicy: Schema.optional(Schema.String) }),
+);
+
 const decodeThreadParams = Schema.decodeUnknownOption(
   Schema.Struct({
     threadId: Schema.optional(Schema.String),
@@ -77,6 +81,7 @@ const replyError = (id: number | string, code: number, message: string): void =>
 };
 
 let initializedSeen = false;
+let elicitationsAllowed = false;
 let nextServerRequestId = 1000;
 /** Elicitation request id → the pending tool call's request id. */
 const pendingApprovals = new Map<number | string, number | string>();
@@ -134,6 +139,15 @@ const handleToolCall = (id: number | string, params: unknown): void => {
     return;
   }
   if (call.tool === "needs_approval") {
+    if (!elicitationsAllowed) {
+      // Exactly what Codex returns when it declines the elicitation for the
+      // client: an error result, no prompt, no explanation.
+      reply(id, {
+        content: [{ type: "text", text: "access was not approved" }],
+        isError: true,
+      });
+      return;
+    }
     const elicitationId = nextServerRequestId++;
     pendingApprovals.set(elicitationId, id);
     write({
@@ -200,6 +214,12 @@ readline.createInterface({ input: process.stdin }).on("line", (line) => {
       replyError(message.id, -32600, "thread/start before the initialized notification");
       return;
     }
+    // Codex DECLINES every MCP elicitation itself on a thread whose approval
+    // policy does not allow them, so a thread started without one can never
+    // receive an approval prompt. The fixture models that: it only elicits
+    // when the bridge asked for a policy that permits elicitations.
+    const params = Option.getOrUndefined(decodeThreadStartParams(message.params));
+    elicitationsAllowed = params?.approvalPolicy === "on-request";
     reply(message.id, { thread: { id: THREAD_ID } });
     return;
   }