fix: codex runs what you approve, and shows it first

[saucam]

Now also contains #374 (codex MCP approvals tied to the right call, #368). #374 was stacked on this branch, so merging it landed its change here. Merging this PR ships both. main has been merged in, which picked up #371; the one conflict was a test field in the mock provider, and both sides were kept.

What this fixes

On codex, anything you approved never actually ran. codeoid answered codex's approval requests with outdated decision words. Current codex rejected every reply as a failed approval, so approved commands and file edits silently didn't happen, and codeoid still marked them completed. Approvals now take effect: approve runs it, deny doesn't, and the record shows what really happened.

Making approvals real exposed what the approver was being shown. This PR also makes sure every codex approval shows what codex will actually do:

• File edits show the real change. codex sends the diff separately from the approval request, so the approval card used to be empty, and approving would have applied an unseen patch. The card now shows the actual diff, including patches that keep streaming in.
• Never a blind yes. codeoid declines without asking, with the reason on the card, when it can't show what would happen:
  • a change with no diff;
  • a request that also asks for session-wide write access;
  • input to a running terminal;
  • a command it isn't told;
  • an unknown request type;
  • network access without a host.
• A changed request isn't covered by a yes. If the patch changes while you're deciding, or the parent command finishes first, the yes is turned into a decline.
• Sub-commands are tracked one by one. When one command spawns several approvals, each has its own id, and each closes when the command finishes.
• Network access is its own approval. A bare network grant is codex_network_access, so Bash rules don't auto-approve it. A command that needs the network stays Bash, so Bash hooks still see it, with the host shown alongside.
• Roles cover codex's tools. A read-only role can't approve codex file edits, and opening network access needs a role that allows network.
• Status and records. A declined call no longer shows as "completed" or leaves the session showing "waiting approval". A call codex declined on its own is recorded in the audit log.

Verification

Ran against a real codex-cli 0.154.0 (codeoid start --local, the actual CLI):

• An approved rm a.txt deleted the file. A denied rm b.txt kept it, and its card stayed cancelled.
• An edit to note.txt produced two approvals. One showed the delete with the old contents, the other the add with the new; approving both left goodbye.
• Before the fix, with the same setup on main, an approved rm left the file in place. codex's own log recorded Rejected("approval request failed").

Tests:

• The fake codex used by the tests now checks replies against codex 0.154's published schema and follows its real message order (the old fixture used the same wrong words, which is why CI passed).
• New provider tests cover: the reply shapes for commands, file changes and permissions; the diff coming from the started item; streamed patches; each decline-without-asking case; sibling approvals; network naming.
• Session tests cover calls a backend settles itself, and the role-gate additions.
• All of them fail against the old code.
• Full suite: 2995 pass, 0 fail. Typecheck and lint are clean.

Not run: no end-to-end regression tier; codeoid has none.

Review: four rounds of security review, the cap. Every round's findings were fixed with tests:

• Round 1: High (blind file-change approval) and two Medium.
• Round 2: three Medium.
• Round 3: Medium/Low.
• Round 4: one Medium regression from round 3 (Bash hooks lost on a command that needs the network) and Lows.

Interaction with #371: #371 makes codex refuse calls a hook rewrote, since codex runs the input it proposed. That matters more once approvals take effect, which is what this PR does. The two touch the same file in separate places; whichever merges second needs a trivial rebase.

Follow-ups filed: #368 (codex MCP calls matched by server name), #372 (Telegram approvals don't show the input).

Closes #369
Closes #368

For agents: implementation detail

• src/daemon/providers/codex/index.ts.
  • approvalReply(method, params, allow): {decision:"accept"|"decline"} for item/commandExecution|fileChange/requestApproval. For item/permissions/requestApproval, allow returns {permissions: params.permissions ?? {}, scope:"turn"} and deny returns {permissions:{}}.
  • Recorded items. #startedItems stores command and file-change items from item/started, updated (as a fresh object) from item/fileChange/patchUpdated. It's cleared per turn and on item/completed.
  • approvalToTool(method, params, started) builds the shown input and returns unshowable for each of these:
    • a file change with no diff, or with grantRoot;
    • kind other than command;
    • a sub-command with an empty command (it never falls back to the parent's);
    • an empty command;
    • a network grant without a host.
    • Unshowable requests are declined with tool_start + tool_complete{success:false, declinedByBackend:true}.
  • Composite id ${itemId}:${approvalId}, used only when both are present. #openSubApprovals closes approved siblings on the parent's completion. #completedParents declines late siblings.
  • In-flight tracking. #approvalsInFlight is a refcount, and #patchChangedInFlight turns a yes into a decline when the patch changed during the decision.
  • Completion. success is true only for status === "completed". #declinedItems suppresses codex's declined completion for calls codeoid declined, because the card is already cancelled.
• src/daemon/session.ts.
  • tool_complete moves waiting_approval to thinking when no approvals or UI requests are pending.
  • A call that completes without reaching the gate drops its approval mapping and leftovers. It is audited as session.backend_settled when its card was waiting or the provider set declinedByBackend.
• ProviderEvent.tool_complete.declinedByBackend? is a new optional field.
• tool-safety.ts. codex_file_change is now in WRITE_TOOLS. The new OPEN_NETWORK_TOOLS = {codex_network_access} is denied unless network: true.
• Fixtures. fake-codex-validate.ts has approvalReplyError (0.154 enums). fake-codex.ts follows the 0.154 message order and has new scenarios. MockSessionProvider.ungatedToolIds lets a test announce a call without gating it.

🤖 Generated with Claude Code

[saucam]

@highflame-oracle review

[saucam]

@highflame-oracle review