fix(runner): separate Codex approvals from questions

packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.test.ts

@@ -93,7 +93,7 @@ describe("Codex ACPX runtime adapter", () => {
       OPENAI_API_KEY: "credential-secret",
     });
     expect(runtimeOptions?.spawnCwd).toBe("/workspace");
-    expect(runtimeOptions?.elicitationModes).toEqual([]);
+    expect(runtimeOptions?.elicitationModes).toEqual(["form"]);
     expect(await port.identity()).toEqual({
       acpxRecordId: "record-1",
       backendSessionId: "backend-1",

packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.ts

@@ -228,7 +228,7 @@ export async function openQualifiedAcpxRuntime(
       overrides: { [options.profile.agent]: [VERIFIED_COMMAND_SENTINEL] },
     }),
     permissionMode: options.permissionMode,
-    elicitationModes: options.profile.agent === "codex" ? [] : ["form"],
+    elicitationModes: ["form"],
     nonInteractivePermissions: "fail",
     permissionPolicy: {
       ...options.permissionPolicy,

packages/paperclip-runner/test/acpx-codex-package-contract.test.mjs

@@ -130,6 +130,13 @@ test("the Codex patch enforces isolated instructions, tools, and skills", () =>
   }
 });
 
+test("the Codex patch keeps MCP tool approvals on the governed permission channel", () => {
+  assert.match(
+    codexPatch,
+    /!context\.isToolApproval && this\.shouldUseAcpElicitation\(params\)/,
+  );
+});
+
 test("the Claude patch removes ambient project and local configuration", () => {
   for (const token of [
     "PAPERCLIP_ACPX_ISOLATED_CONTEXT",

patches/@agentclientprotocol__codex-acp@1.6.2.patch

@@ -1,6 +1,15 @@
 diff --git a/dist/index.js b/dist/index.js
 --- a/dist/index.js
 +++ b/dist/index.js
+@@ -25341,7 +25341,7 @@
+   async handleElicitation(params) {
+     try {
+       const context = this.createMcpElicitationContext(params);
+-      if (this.shouldUseAcpElicitation(params)) {
++      if (!context.isToolApproval && this.shouldUseAcpElicitation(params)) {
+         const response2 = await this.connection.request(
+           methods.client.elicitation.create,
+           this.buildElicitationRequest(params, context),
 @@ -25563,7 +25563,7 @@
              toolCall: {
                toolCallId: context.correlatedCallId,

pnpm-lock.yaml

@@ -17,7 +17,7 @@ patchedDependencies:
     hash: axsvv3fhdlmmbmnhpi2cywic6q
     path: patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch
   '@agentclientprotocol/codex-acp@1.6.2':
-    hash: grbydorkxatbzksnwwfuawwtim
+    hash: elxjibratyxkrkkxxyoqtz36pe
     path: patches/@agentclientprotocol__codex-acp@1.6.2.patch
   acpx@0.12.0:
     hash: b2ggqg6aj4hdob4whk6vq6jmc4
@@ -176,7 +176,7 @@ importers:
     dependencies:
       '@agentclientprotocol/codex-acp':
         specifier: ^1.6.2
-        version: 1.6.2(patch_hash=grbydorkxatbzksnwwfuawwtim)
+        version: 1.6.2(patch_hash=elxjibratyxkrkkxxyoqtz36pe)
       '@paperclipai/adapter-utils':
         specifier: workspace:*
         version: link:../../adapter-utils
@@ -479,7 +479,7 @@ importers:
         version: 0.70.0(patch_hash=fymctidcjqjhi4cj72qtivlxry)(@anthropic-ai/sdk@0.121.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))
       '@agentclientprotocol/codex-acp':
         specifier: 1.6.2
-        version: 1.6.2(patch_hash=grbydorkxatbzksnwwfuawwtim)
+        version: 1.6.2(patch_hash=elxjibratyxkrkkxxyoqtz36pe)
       acpx:
         specifier: 0.13.1
         version: 0.13.1(patch_hash=lzpwjtiaybzoijy455dfycwavu)
@@ -8538,7 +8538,7 @@ snapshots:
       - '@anthropic-ai/sdk'
       - '@modelcontextprotocol/sdk'
 
-  '@agentclientprotocol/codex-acp@1.6.2(patch_hash=grbydorkxatbzksnwwfuawwtim)':
+  '@agentclientprotocol/codex-acp@1.6.2(patch_hash=elxjibratyxkrkkxxyoqtz36pe)':
     dependencies:
       '@agentclientprotocol/sdk': 1.4.0(zod@4.4.3)
       '@openai/codex': 0.148.0