From 339751715c64496cb86246bfb3935f40e309dd3d Mon Sep 17 00:00:00 2001
From: jif <jif@openai.com>
Date: Mon, 24 Aug 2026 09:08:57 +0000
Subject: [PATCH] Use snapshot session sources for MCP projection (#40368)

## What changed

Pass the session source associated with each MCP configuration snapshot into
selected-environment server projection. This keeps Guardian reviewer isolation
decisions aligned with the snapshot being projected instead of rereading the
session's mutable configuration.

GitOrigin-RevId: 61fd891fec13f62cfea9886d13e2f94f6f60922f
---
 codex-rs/core/src/session/mcp.rs         | 8 +++++++-
 codex-rs/core/src/session/mcp_runtime.rs | 6 +++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/codex-rs/core/src/session/mcp.rs b/codex-rs/core/src/session/mcp.rs
index afec74ffe8..cdcc15b573 100644
--- a/codex-rs/core/src/session/mcp.rs
+++ b/codex-rs/core/src/session/mcp.rs
@@ -137,7 +137,12 @@ impl Session {
             )
             .await;
         let mcp_config = self
-            .project_selected_environment_mcp_servers(config, &environments, mcp_projection)
+            .project_selected_environment_mcp_servers(
+                &session_source,
+                config,
+                &environments,
+                mcp_projection,
+            )
             .await
             .config;
         let local_process_cwd = environments
@@ -281,6 +286,7 @@ impl Session {
             .await;
         let mcp_projection = self
             .project_selected_environment_mcp_servers(
+                &desired.session_source,
                 &desired.config,
                 &desired.environments,
                 mcp_projection,
diff --git a/codex-rs/core/src/session/mcp_runtime.rs b/codex-rs/core/src/session/mcp_runtime.rs
index 5a43effef0..9802e7e4c3 100644
--- a/codex-rs/core/src/session/mcp_runtime.rs
+++ b/codex-rs/core/src/session/mcp_runtime.rs
@@ -144,14 +144,13 @@ impl Session {
     /// Adds effective executor-owned configuration from this exact thread snapshot.
     pub(super) fn project_selected_environment_mcp_servers<'a>(
         &'a self,
+        session_source: &'a SessionSource,
         config: &'a Config,
         environments: &'a TurnEnvironmentSnapshot,
         mut projection: McpRuntimeProjection,
     ) -> BoxFuture<'a, McpRuntimeProjection> {
         Box::pin(async move {
-            if crate::guardian::is_guardian_reviewer_source(
-                &self.state.lock().await.session_configuration.session_source,
-            ) {
+            if crate::guardian::is_guardian_reviewer_source(session_source) {
                 return projection;
             }
 
@@ -286,6 +285,7 @@ impl Session {
     ) {
         let mcp_projection = self
             .project_selected_environment_mcp_servers(
+                &desired.session_source,
                 &desired.config,
                 &desired.environments,
                 mcp_projection,