Repository navigation
Codex permissions overlay and MCP elicitation / requestUserInput cards #1190
Description
Follow-up to #1171. Those ServerRequests currently JSON-RPC-error (-32601) so a turn cannot stall on a missing card.
-
item/permissions/requestApproval— not allow/deny. Params: cwd, permissions (fileSystem entries + network.enabled), threadId, turnId, itemId, startedAtMs. Reply{ permissions: GrantedPermissionProfile, scope: "turn"|"session", strictAutoReview? }. Sandbox overlay grant. New UI, or keep auto-error until a card exists (today: error). -
mcpServer/elicitation/request— MCP elicitation/create passthrough: serverName, threadId, optional turnId, plus one of mode form | openai/form | openaiForm | url. Reply{ action: accept|decline|cancel, content? }. First-party Solenta MCP uses default_tools_approval_mode=approve (Explicit Grok worker forks are impossible when approval policy isnever#846) so it should not hit this if we keep that config; user-registered MCP might. -
item/tool/requestUserInput(stable bundle; description says EXPERIMENTAL) —{threadId, turnId, itemId, isBlocking, questions[{id, header, question, options, isOther, isSecret}]}. Closer to Claude AskUserQuestion / pendingQuestion (Question card never appears on grok/kimi: headless CLIs self-answer or forbid their question tool #647). Blocking without a reply stalls the turn.
Also writeStdin on item/commandExecution/requestApproval is input to an existing terminal, not a Bash card (#1171 already errors it).
Gate each method on a fake app-server. Do not enable on-request solely for these.
Activity
currentbits commentedon Sep 27, 2026
Investigation of #1333 now proves that the missing mcpServer/elicitation/request handling breaks ordinary MCP tool approvals, not only optional server-side forms. Codex 0.157.1 emits form mode with
_meta.codex_approval_kind="mcp_tool_call"for unannotated tools. Solenta returns -32601; Codex showsuser rejected MCP tool calland never invokes the server. Same isolated tool: rejecting through current helpers produces 0 server calls; accepting that harmless probe produces 1 successful call. Girder has 72 tools with no annotations, so its read-only deploy_plan also hits this gap. Full evidence and corrective scope are in #1333. A narrow tool-approval implementation can address the common failure before general form/URL elicitation UI.currentbits commentedon Sep 28, 2026
Continuing the approved MCP repair after #1370. Plan: inspect the installed Codex request/response schemas and existing prompt UI; add typed MCP form handling and native requestUserInput on the existing pending-permission channel; validate responses at the host boundary and preserve deny/stop behavior; gate with fake app-server and renderer regressions. Sandbox permission overlays are a separate grant surface and remain fail-closed while this work focuses on MCP input.
currentbits commentedon Sep 28, 2026
Implementation progress on
fix/codex-input-forms: flat MCP forms and URL consent plus nativerequestUserInputnow use the existing permission queue. Host validation uses the already bundled MCP SDK/Ajv, keeps invalid answers pending, and preserves typed values/question IDs. Secret answers are masked and excluded from Solenta permission transcript events.serverRequest/resolvedclears transport and UI state, preventing late replies; two regressions failed before this fix and now pass. So far 44 focused backend checks, 34 renderer checks and typecheck pass. Completing process-level input round trips and visual review next. Nested/custom schemas and sandbox permission overlays remain fail-closed; this is a partial delivery of #1190.currentbits commentedon Sep 28, 2026
Reviewable implementation: PR #1371, commit
9ae985151a5b0f8b4fc83a408564c493d6348d9d. Local validation passed: 4,048 backend tests (unrestricted rerun after local socket/cache sandbox errors), 2,636 renderer tests, production build/typecheck/preload synchronization, and final focused input checks. Hosted run 36402581220 is in progress. No native-model input round trip or visual screenshot verification has been completed. Leaving #1190 open because sandbox permission overlays and richer schemas remain outside this PR.currentbits commentedon Sep 28, 2026
PR #1371 is green at
9ae985151a5b0f8b4fc83a408564c493d6348d9d: all six hosted test/smoke jobs passed on macOS, Windows and Ubuntu (run 36402581220). The branch is reviewable and unmerged. Visual verification and a native-model input round trip remain unverified; native browser automation could not establish an active session, the browser connector was unavailable, and the app preview pane was closed. Sandbox permission overlays and richer form schemas are still intentionally unsupported, so #1190 stays open.currentbits commentedon Sep 28, 2026
Continuing verification of PR #1371. Confirmed review finding: the README development steps omit the separate memory-server dependency install. An isolated copy of codexInput.js fails with MODULE_NOT_FOUND without those dependencies and accepts the same native question once they are available. Packaging and CI already install them. Updating the development setup to require the existing nested install; retaining the shared bundled SDK instead of duplicating it at the root. Next: bounded live Codex input probe, then final review/check status.
currentbits commentedon Sep 28, 2026
PR #1371 is ready at
311e86a2593455e1d6ac26ac4abbaaf7c2bcc75c. All six hosted test/smoke jobs pass on macOS, Ubuntu and Windows: https://github.com/currentbits/solenta/actions/runs/36410678066. The review follow-up documents installation of the existing memory-server dependencies required by source builds; packaging and CI already install them.New live evidence: real Codex CLI 0.144.1 with gpt-5.6-sol completed both synthetic protocol probes using production parsing, validation and JSON-RPC response code. The MCP fixture received its typed enum/integer/boolean response, including
false. A native request_user_input question received its selected answer. Both emitted serverRequest/resolved and the model continued. The native probe enabled features.default_mode_request_user_input only for its isolated process; user configuration was unchanged.Visual verification remains incomplete. Computer Use could open a browser tab, but subsequent input was rejected even immediately after refreshing state; the Solenta Browser preview pane was closed. Temporary preview files/server and isolated probe directories have been cleaned up. These live checks verify the protocol, not the rendered card.
PR remains unmerged. This issue stays open for the remaining file-change/sandbox permission overlays and unsupported schemas; those still fail closed.
currentbits commentedon Sep 28, 2026
User approved merging PR #1371 and publishing a nightly. Release steps: merge the reviewed head 311e86a; build from the resulting origin/main commit in the dedicated disposable release worktree; run packaging/notarization/isolated boot checks; verify release assets and record the tag. Remaining scope in this issue stays open.
currentbits commentedon Sep 28, 2026
PR #1371 merged at 65d15d0. Nightly publication is temporarily paused before upload because the first post-merge run failed in two tests outside the input changes: Linux eject-command.test.js:161 (whole-command
includes("-m")assertion, including a random cwd) and Windows sidebar.test.tsx (20s file timeout). The merge tree exactly matches green PR head 311e86a. One rerun of failed jobs is in progress: https://github.com/currentbits/solenta/actions/runs/36416352786. Follow-up work was suggested separately rather than changing this release's code.The macOS release build is signed/notarized and passed Gatekeeper plus isolated boot/health/vector-inference checks. A read-only probe loaded codexInput.js from the packaged app, accepted typed false/integer values and rejected an out-of-range value, confirming the nested MCP SDK/validator is present. Release publication will resume after CI status is resolved.
currentbits commentedon Sep 28, 2026
Post-merge CI is now green: all six checks pass in run 36416352786, attempt 2. Only the two failed jobs were rerun; source is unchanged. The eject assertion's false positive was confirmed with a cwd containing
-mwhile the actual Codex resume arguments contain no such flag. Nightly packaging/publication has resumed at 65d15d0.currentbits commentedon Sep 28, 2026
Released PR #1371 in nightly-202609281156-65d15d0b: https://github.com/currentbits/solenta/releases/tag/nightly-202609281156-65d15d0b
Source: merged commit 65d15d0. All six hosted checks pass after one rerun of the two documented failures. macOS: signed, notarized, stapled, Gatekeeper accepted, isolated app boot/health/vector-inference probe passed. Packaged MCP input validation passed its valid/invalid-value probe. GitHub reports all three assets uploaded, and their SHA-256 digests and sizes match local artifacts.
Linux x64, Windows x64 and macOS arm64 assets are published. Native Linux/Windows package boot verification remains tracked separately in #1366; cross-packaging alone does not prove it. Visual input-card verification also remains incomplete as documented. This partial-delivery issue stays open for file-change/sandbox overlays and unsupported schemas.
currentbits commentedon Sep 28, 2026
Visual verification is still pending, but the preview blocker is now diagnosed rather than attributed only to missing controls. Opening Browser cannot register its guest because BrowserPane omits the initial src; Electron does not create the guest until navigation, and preview navigation requires the missing binding. PR #1377 initializes about:blank. An actual Electron probe confirmed the before/after attachment behavior, and all 12 focused preview checks pass. The real Codex protocol evidence and shipped input forms remain valid; no screenshot or full visual pass is claimed yet.
currentbits commentedon Sep 28, 2026
The Browser registration blocker is now shipped in nightly-202609281438-22c8d443 via #1377: https://github.com/currentbits/solenta/releases/tag/nightly-202609281438-22c8d443. macOS verification and native Windows/Linux published-package checks pass (run 36438137739). The form/question protocol evidence remains valid; visual verification remains open pending the running app update/restart and an accessible Browser pane. Current preview.info still reports no open pane.
currentbits commentedon Sep 28, 2026
Input-card visual check completed using Computer Use in Safari against the actual shipped InputPrompt.tsx and ThreadView.module.css from PR #1371, served in a temporary local-only fixture. Screenshots inspected at 360px MCP-card width and 480px native-question width: labels, controls, action row and error text were readable without clipping.
Exercised through real UI: empty required fields block submission; dummy secret is masked; successful form response preserves numeric count=2, boolean enabled=false and selected tags=["a"]; native custom answer is retained; a simulated response error leaves controls editable, and retry succeeds and disables the card; Decline produces deny with no values; Cancel produces cancel with no values. Temporary fixture files and server were removed; worktree is clean. This complements the previously passing real Codex protocol probes; it is a component/browser check, not packaged Electron end-to-end proof.
In-app Browser verification remains pending. The running app's bundle still identifies nightly-202609280651-fc354ccb, which predates the Browser registration fix; the verified published build is nightly-202609281438-22c8d443. preview.info still reports no accessible pane. Computer Use refused Update clicks because the app changed during the interaction, so no update or restart was completed. No new source defect established.
currentbits commentedon Oct 15, 2026
Remaining scope implemented on branch coder/codex-permissions-overlay-and-mcp-elicit-7ce031 (not yet committed or opened as a PR).
item/permissions/requestApprovalnow uses the existing permission card, showing a JSON preview of cwd, reason and the requested profile. Accept replies{ permissions: <requested network/fileSystem only>, scope: "turn" }. Accept all replies withscope: "session". Deny and Stop both reply with an empty profile ({ permissions: {}, scope: "turn" }).strictAutoReviewis never sent. A malformed request (no permissions object) still gets -32601.item/fileChange/requestApprovalnow shows a diff card built from the fileChange item that streamed just before it (looked up by itemId), plus grantRoot and reason. It replies with accept/acceptForSession/decline/cancel. If no streamed item is found it still fails closed with -32601, so a blind approval can't happen.writeStdinand unknown methods still get -32601. on-request is unchanged.How it's gated: new fake app-server scenarios
ask-permissionsandask-file-changedrive a full runner and real JSON-RPC round-trip (allowAlways, deny, allow, stop). Unit tests cover the reply shapes. Electron suite: 4757 pass, 0 fail.Not verified: treating an empty GrantedPermissionProfile as a denial is read from the codex 0.159.2 generated schema. The protocol has no explicit deny, and this was never checked against a real app-server.
currentbits commentedon Oct 15, 2026
Landed from Solenta thread "Codex permissions overlay and MCP elicitation / requestUserI" (PR #1640). Closed on merge.
Merge origin/main: fileChange keeps the #1189 diff card, permissions …
Merge origin/main: fileChange keeps the #1189 diff card, permissions …