## What changed
Include `tool_name` in MCP tool approval elicitation metadata and forward available `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` values under `tool_annotations`. Omit unspecified hints and the annotation title.
Reuse the stored tool approval metadata when available so annotation hints reach the approval request.
## Testing
Extend unit tests to cover tool names, annotation hints, and omission of unspecified hints. Update integration coverage to verify that the approval tool name matches the executed MCP call and that `readOnlyHint` is preserved.
GitOrigin-RevId: f082fe7fd87fde9f4895149e09210c7cb9d1e582
## Why
MCP tool calls reported every aborted approval as "user cancelled MCP tool call", including interrupted requests and automatic cancellations in `exec` mode.
## What changed
Carry `user`, `interrupted`, or `non_interactive` cancellation reasons through MCP approval metadata and resolution. Mark explicit TUI cancellations as user actions, interrupted requests as interruptions, and automatic `exec` cancellations as non-interactive.
Use the reason to report when a call was cancelled before approval or because interactive approval is unavailable in `exec` mode. Preserve the existing cancellation message for clients that omit the reason.
## Testing
Update tests to verify that a closed approval response carries the interruption reason and that `exec` cancellation responses include the non-interactive reason.
GitOrigin-RevId: be2a5f7fef539b5db2add53b46aea27e2b8a66fc
## Why
MCP requests that need human input, including browser sign-in, must be handled by the root thread. Subagents need guidance to hand these blockers to their parent without prompting the user or automatically accepting requests that require input.
## What changed
- Reject interactive MCP elicitations and tool approval prompts in subagents with guidance to ask the parent and wait before retrying.
- Recognize browser authentication and `codex_requires_user_input` metadata even when the form schema is empty, while preserving automatic permission approvals and review decisions.
- Carry user-interaction eligibility through MCP runtime creation and connection reuse, and guard prompt registration.
- Preserve connector authentication diagnostics alongside handoff guidance, subject to normal tool-output limits.
## Testing
Add unit and integration coverage for blocked subagent prompts, root browser authentication, automatic approval and review, connection reuse, and authentication diagnostic preservation and truncation. Add a request-history snapshot for browser-auth handoff guidance.
GitOrigin-RevId: 83e146b6e5c1a2a22a34681ad45615f504b3c96c
## What changed
- Recognize `codex_sensitive_action: true` on MCP approval elicitations.
- Route marked actions to the synchronous Guardian reviewer instead of extension fast approval. Absent or false values preserve the existing path.
- Cover ordinary and strict auto-review configurations, including marked, unmarked, and explicitly false metadata.
GitOrigin-RevId: dce13d1696568ca81c8d2b08a7ef0d5f13e155bf
## Why
Standard MCP forms can require user-entered values even when tool permissions are
otherwise auto-approved in full-access sessions.
## What changed
- Recognize the `openai/standard-form-input` client extension and surface
non-approval forms in full-access, user-initiated root threads.
- Keep approval forms, automation and subagent threads, headless sessions, and
clients without the capability on their existing decline or review paths.
- Treat the capability as client-only so it is not advertised to MCP servers,
and enable it after session startup so required servers cannot block startup
waiting for form input.
## Testing
Add unit and app-server coverage for accepted form round trips, declined cases,
approval metadata safeguards, resumed threads, and extension filtering.
GitOrigin-RevId: 053bfe397a5c79eceef90a81d13e2aca6353af43
## What changed
- Recognize the `codex_strict_auto_review` MCP elicitation marker and route
marked approval requests through the configured automatic reviewer.
- Accept only canonical automatic-review approvals and fail closed without a
user prompt when review is unavailable, denied, malformed, disallowed by
policy, or requests persistence.
- Validate Codex Apps approval metadata against the active MCP invocation and
build the review request from the trusted invocation details.
## Testing
- Add unit coverage for strict review decisions, malformed markers, reviewer
failures, explicit policy denials, and lifecycle cleanup.
- Add app-server round-trip coverage for approvals, denials, configuration
constraints, spoofed metadata, persistent requests, and subsequent turns.
GitOrigin-RevId: af73b45a9b63118f25f6429d95b3222c5dbb59fb
# Motivation
Browser Use origin-access prompts are MCP elicitations, not direct
tool-call approval prompts, so they were bypassing the Guardian approval
path. We need a generic opt-in that lets eligible MCP elicitations use
Guardian when the current turn already routes approvals there.
# Description
Add a generic elicitation reviewer hook in codex-mcp and wire codex-core
to pass a Guardian reviewer callback when creating the MCP connection
manager. The reviewer validates explicit mcp_tool_call opt-in metadata,
builds a Guardian MCP tool-call review request from
server/tool/connector metadata and tool params, and maps Guardian
approval, denial, timeout, and cancellation decisions back to MCP
elicitation responses.
The new option to trigger this in the `_meta` object is:
```
"codex_request_type": "approval_request",
```
# Testing
- RUST_MIN_STACK=8388608 NEXTEST_STATUS_LEVEL=leak cargo nextest run
--no-fail-fast --cargo-profile ci-test --test-threads 2
- cargo clippy --tests -- -D warnings
- cargo fmt -- --config imports_granularity=Item --check
- cargo shear
- pnpm run format
- python3 .github/scripts/verify_cargo_workspace_manifests.py
- python3 .github/scripts/verify_tui_core_boundary.py
- python3 .github/scripts/verify_bazel_clippy_lints.py
- git diff --check
Greg Brisebois