feat: LLM-25394 support Codex persist approval

src/ApprovalOptionId.ts

@@ -1,6 +1,9 @@
 export const ApprovalOptionId = {
     AllowOnce: "allow_once",
-    AllowAlways: "allow_always",
+    AllowForSession: "allow_for_session",
+    AllowPersist: "allow_persist",
+    AllowCommandPrefixRule: "allow_command_prefix_rule",
+    ApplyNetworkPolicyAmendment: "apply_network_policy_amendment",
     RejectOnce: "reject_once",
 } as const;
 

src/CodexAcpClient.ts

@@ -201,9 +201,10 @@ export class CodexAcpClient {
 
     async resumeSession(request: acp.ResumeSessionRequest): Promise<SessionMetadata> {
         await this.refreshSkills(request.cwd, request._meta);
+        const sessionConfig = await this.createSessionConfig(request.cwd, request.mcpServers ?? []);
 
         const response = await this.codexClient.threadResume({
-            config: await this.createSessionConfig(request.cwd, request.mcpServers ?? []),
+            config: sessionConfig.config,
             cwd: request.cwd,
             modelProvider: this.getResumeModelProvider(),
             threadId: request.sessionId,
@@ -215,12 +216,14 @@ export class CodexAcpClient {
             currentModelId: currentModelId,
             models: codexModels,
             currentServiceTier: response.serviceTier ?? null,
+            configBackedMcpServerNames: sessionConfig.configBackedMcpServerNames,
         }
     }
 
     async loadSession(request: acp.LoadSessionRequest): Promise<SessionMetadataWithThread> {
+        const sessionConfig = await this.createSessionConfig(request.cwd, request.mcpServers ?? []);
         const response = await this.codexClient.threadResume({
-            config: await this.createSessionConfig(request.cwd, request.mcpServers ?? []),
+            config: sessionConfig.config,
             cwd: request.cwd,
             modelProvider: this.getResumeModelProvider(),
             threadId: request.sessionId,
@@ -232,15 +235,17 @@ export class CodexAcpClient {
             currentModelId: currentModelId,
             models: codexModels,
             currentServiceTier: response.serviceTier ?? null,
+            configBackedMcpServerNames: sessionConfig.configBackedMcpServerNames,
             thread: response.thread,
         };
     }
 
     async newSession(request: acp.NewSessionRequest): Promise<SessionMetadata> {
         await this.refreshSkills(request.cwd, request._meta);
+        const sessionConfig = await this.createSessionConfig(request.cwd, request.mcpServers);
 
         const response = await this.codexClient.threadStart({
-            config: await this.createSessionConfig(request.cwd, request.mcpServers),
+            config: sessionConfig.config,
             modelProvider: this.getModelProvider(),
             cwd: request.cwd,
         });
@@ -255,6 +260,7 @@ export class CodexAcpClient {
             currentModelId: currentModelId,
             models: codexModels,
             currentServiceTier: response.serviceTier ?? null,
+            configBackedMcpServerNames: sessionConfig.configBackedMcpServerNames,
         };
     }
 
@@ -266,7 +272,7 @@ export class CodexAcpClient {
         return this.codexClient.getMcpServerStartupVersion();
     }
 
-    private async createSessionConfig(projectPath: string, mcpServers: Array<McpServer>): Promise<JsonObject> {
+    private async createSessionConfig(projectPath: string, mcpServers: Array<McpServer>): Promise<SessionConfig> {
         const mergedConfig = {
             ...mergeGatewayConfig(this.config, this.gatewayConfig),
             projects: {
@@ -275,21 +281,30 @@ export class CodexAcpClient {
                 }
             },
         };
+        const configuredMcpServerNames = await this.getConfigMcpServerNames(projectPath);
         if (mcpServers.length === 0) {
-            return mergedConfig;
+            return {
+                config: mergedConfig,
+                configBackedMcpServerNames: configuredMcpServerNames,
+            };
         }
 
         // Deduplicates new servers against existing config to prevent Codex from deep-merging
         // incompatible field types (e.g., mixing url and stdio schemas).
-        const existingNames = await this.getConfigMcpServerNames(projectPath);
-        const uniqueServers = mcpServers.filter(mcp => !existingNames.has(mcp.name));
+        const uniqueServers = mcpServers.filter(mcp => !configuredMcpServerNames.has(mcp.name));
         if (uniqueServers.length === 0) {
-            return mergedConfig;
+            return {
+                config: mergedConfig,
+                configBackedMcpServerNames: configuredMcpServerNames,
+            };
         }
 
         return {
-            ...mergedConfig,
-            "mcp_servers": Object.fromEntries(uniqueServers.map(mcp => [mcp.name, this.createMcpSeverConfig(mcp)])),
+            config: {
+                ...mergedConfig,
+                "mcp_servers": Object.fromEntries(uniqueServers.map(mcp => [mcp.name, this.createMcpSeverConfig(mcp)])),
+            },
+            configBackedMcpServerNames: configuredMcpServerNames,
         };
     }
 
@@ -569,12 +584,18 @@ export type SessionMetadata = {
     currentModelId: string,
     models: Model[],
     currentServiceTier?: ServiceTier | null,
+    configBackedMcpServerNames?: Set<string>,
 }
 
 export type SessionMetadataWithThread = SessionMetadata & {
     thread: Thread,
 }
 
+type SessionConfig = {
+    config: JsonObject,
+    configBackedMcpServerNames: Set<string>,
+}
+
 function buildPromptItems(prompt: acp.ContentBlock[]): UserInput[] {
     return prompt.map((block): UserInput | null => {
         switch (block.type) {

src/CodexAcpServer.ts

@@ -57,7 +57,8 @@ export interface SessionState {
     cwd: string;
     fastModeEnabled: boolean;
     currentModelSupportsFast: boolean;
-    sessionMcpServers?: Array<string>;
+    sessionMcpServers: Array<string>;
+    configBackedMcpServerNames?: Set<string>;
 }
 
 interface PendingMcpStartupSession {
@@ -120,7 +121,6 @@ export class CodexAcpServer implements acp.Agent {
                     list: { }
                 },
                 mcpCapabilities: {
-                    acp: false,
                     http: true,
                     sse: false
                 }
@@ -179,7 +179,6 @@ export class CodexAcpServer implements acp.Agent {
 
         const account = await this.getActiveAccount();
         const {sessionId, currentModelId, models} = sessionMetadata;
-        const sessionMcpServers = this.resolveSessionMcpServers(requestedMcpServers, "sessionId" in request);
         const currentModel = this.findCurrentModel(models, currentModelId);
         const currentModelSupportsFast = modelSupportsFast(currentModel);
         const sessionState: SessionState = {
@@ -197,7 +196,8 @@ export class CodexAcpServer implements acp.Agent {
             cwd: request.cwd,
             fastModeEnabled: sessionMetadata.currentServiceTier === "fast",
             currentModelSupportsFast: currentModelSupportsFast,
-            sessionMcpServers: sessionMcpServers,
+            sessionMcpServers: this.createSessionMcpServers(requestedMcpServers, "sessionId" in request),
+            configBackedMcpServerNames: sessionMetadata.configBackedMcpServerNames ?? new Set(),
         }
         this.sessions.set(sessionId, sessionState);
 
@@ -439,7 +439,6 @@ export class CodexAcpServer implements acp.Agent {
 
         const account = await this.getActiveAccount();
         const {sessionId, currentModelId, models, thread} = sessionMetadata;
-        const sessionMcpServers = this.resolveSessionMcpServers(requestedMcpServers, true);
         const currentModel = this.findCurrentModel(models, currentModelId);
         const currentModelSupportsFast = modelSupportsFast(currentModel);
         const sessionState: SessionState = {
@@ -457,7 +456,8 @@ export class CodexAcpServer implements acp.Agent {
             cwd: request.cwd,
             fastModeEnabled: sessionMetadata.currentServiceTier === "fast",
             currentModelSupportsFast: currentModelSupportsFast,
-            sessionMcpServers: sessionMcpServers,
+            sessionMcpServers: this.createSessionMcpServers(requestedMcpServers, true),
+            configBackedMcpServerNames: sessionMetadata.configBackedMcpServerNames ?? new Set(),
         };
         this.sessions.set(sessionId, sessionState);
 
@@ -711,14 +711,13 @@ export class CodexAcpServer implements acp.Agent {
         return sessionState;
     }
 
-    private resolveSessionMcpServers(
+    private createSessionMcpServers(
         mcpServers: Array<acp.McpServer>,
         recoverFromStartup: boolean,
     ): Array<string> {
         // Explicit MCP servers from the request are the primary source of truth for the session.
-        const requestedServerNames = getRequestedMcpServerNames(mcpServers);
-        if (requestedServerNames.length > 0) {
-            return requestedServerNames;
+        if (mcpServers.length > 0) {
+            return mcpServers.map(server => server.name);
         }
         // Fresh sessions without MCP config should not inherit any session MCP state.
         if (!recoverFromStartup) {
@@ -942,7 +941,3 @@ export class CodexAcpServer implements acp.Agent {
         }
     }
 }
-
-function getRequestedMcpServerNames(mcpServers: Array<acp.McpServer>): Array<string> {
-    return Array.from(new Set(mcpServers.map(server => server.name)));
-}

src/CodexAppServerClient.ts

@@ -8,6 +8,8 @@ import type {
 import type {
     ConfigReadParams,
     ConfigReadResponse,
+    ConfigBatchWriteParams,
+    ConfigWriteResponse,
     GetAccountParams,
     GetAccountResponse,
     ListMcpServerStatusParams,