fix(tui): support legacy app-server approvals

codex-rs/tui_app_server/src/app/app_server_adapter.rs

@@ -3,10 +3,14 @@ use crate::app_event::AppEvent;
 use crate::app_server_session::AppServerSession;
 use crate::app_server_session::app_server_rate_limit_snapshot_to_core;
 use crate::app_server_session::status_account_display_from_auth_mode;
+use crate::exec_command::escape_command;
 use crate::local_chatgpt_auth::load_local_chatgpt_auth;
 use codex_app_server_client::AppServerEvent;
 use codex_app_server_protocol::AuthMode;
 use codex_app_server_protocol::ChatgptAuthTokensRefreshParams;
+use codex_app_server_protocol::CommandAction;
+use codex_app_server_protocol::CommandExecutionRequestApprovalParams;
+use codex_app_server_protocol::FileChangeRequestApprovalParams;
 use codex_app_server_protocol::JSONRPCErrorError;
 use codex_app_server_protocol::JSONRPCNotification;
 use codex_app_server_protocol::RequestId;
@@ -98,8 +102,10 @@ impl App {
     ) {
         match &notification {
             ServerNotification::ServerRequestResolved(notification) => {
-                self.pending_app_server_requests
+                let resolved = self
+                    .pending_app_server_requests
                     .resolve_notification(&notification.request_id);
+                self.note_app_server_request_resolved(resolved).await;
             }
             ServerNotification::AccountRateLimitsUpdated(notification) => {
                 self.chat_widget.on_rate_limit_snapshot(Some(
@@ -159,6 +165,13 @@ impl App {
         app_server_client: &AppServerSession,
         request: ServerRequest,
     ) {
+        if self
+            .try_handle_legacy_approval_request(app_server_client, &request)
+            .await
+        {
+            return;
+        }
+
         if let Some(unsupported) = self
             .pending_app_server_requests
             .note_server_request(&request)
@@ -199,6 +212,102 @@ impl App {
         }
     }
 
+    /// Bridges deprecated v1 approval requests into the v2 approval UI path.
+    ///
+    /// The TUI only has one live approval surface. Legacy exec/patch requests
+    /// therefore need to be tracked under their original request IDs for
+    /// response serialization, while the visible request is rewritten into the
+    /// current thread-scoped v2 shape for routing and rendering.
+    async fn try_handle_legacy_approval_request(
+        &mut self,
+        app_server_client: &AppServerSession,
+        request: &ServerRequest,
+    ) -> bool {
+        if !matches!(
+            request,
+            ServerRequest::ExecCommandApproval { .. } | ServerRequest::ApplyPatchApproval { .. }
+        ) {
+            return false;
+        }
+
+        match bridge_legacy_approval_request(request) {
+            Ok((thread_id, bridged_request)) => {
+                if let Some(unsupported) = self
+                    .pending_app_server_requests
+                    .note_server_request(request)
+                {
+                    tracing::warn!(
+                        request_id = ?unsupported.request_id,
+                        message = unsupported.message,
+                        "rejecting unsupported app-server request"
+                    );
+                    self.chat_widget
+                        .add_error_message(unsupported.message.clone());
+                    if let Err(err) = self
+                        .reject_app_server_request(
+                            app_server_client,
+                            unsupported.request_id,
+                            unsupported.message,
+                        )
+                        .await
+                    {
+                        tracing::warn!("{err}");
+                    }
+                    return true;
+                }
+
+                let result = if self.primary_thread_id == Some(thread_id)
+                    || self.primary_thread_id.is_none()
+                {
+                    self.enqueue_primary_thread_request(bridged_request).await
+                } else {
+                    self.enqueue_thread_request(thread_id, bridged_request)
+                        .await
+                };
+                if let Err(err) = result {
+                    self.reject_failed_legacy_approval_enqueue(
+                        app_server_client,
+                        request,
+                        err.to_string(),
+                    )
+                    .await;
+                }
+            }
+            Err(message) => {
+                tracing::warn!(request_id = ?request.id(), "{message}");
+                self.chat_widget.add_error_message(message.clone());
+                if let Err(err) = self
+                    .reject_app_server_request(app_server_client, request.id().clone(), message)
+                    .await
+                {
+                    tracing::warn!("{err}");
+                }
+            }
+        }
+
+        true
+    }
+
+    async fn reject_failed_legacy_approval_enqueue(
+        &mut self,
+        app_server_client: &AppServerSession,
+        request: &ServerRequest,
+        err: String,
+    ) {
+        let message = format!("failed to surface legacy exec approval: {err}");
+        let resolved = self
+            .pending_app_server_requests
+            .resolve_notification(request.id());
+        self.note_app_server_request_resolved(resolved).await;
+        self.chat_widget.add_error_message(message.clone());
+        if let Err(reject_err) = self
+            .reject_app_server_request(app_server_client, request.id().clone(), message)
+            .await
+        {
+            tracing::warn!("{reject_err}");
+        }
+    }
+
     async fn handle_chatgpt_auth_tokens_refresh_request(
         &mut self,
         app_server_client: &AppServerSession,
@@ -283,6 +392,62 @@ impl App {
     }
 }
 
+/// Re-expresses legacy approval payloads as the v2 request variants the UI
+/// already knows how to render.
+///
+/// The bridged request keeps the original `request_id`, so later approval
+/// responses can still resolve the server request using the matching v1 or v2
+/// wire format recorded in `PendingAppServerRequests`.
+fn bridge_legacy_approval_request(
+    request: &ServerRequest,
+) -> Result<(ThreadId, ServerRequest), String> {
+    match request {
+        ServerRequest::ExecCommandApproval { request_id, params } => Ok((
+            params.conversation_id,
+            ServerRequest::CommandExecutionRequestApproval {
+                request_id: request_id.clone(),
+                params: CommandExecutionRequestApprovalParams {
+                    thread_id: params.conversation_id.to_string(),
+                    turn_id: String::new(),
+                    item_id: params.call_id.clone(),
+                    approval_id: params.approval_id.clone(),
+                    reason: params.reason.clone(),
+                    network_approval_context: None,
+                    command: Some(escape_command(&params.command)),
+                    cwd: Some(params.cwd.clone()),
+                    command_actions: Some(
+                        params
+                            .parsed_cmd
+                            .clone()
+                            .into_iter()
+                            .map(CommandAction::from)
+                            .collect(),
+                    ),
+                    additional_permissions: None,
+                    skill_metadata: None,
+                    proposed_execpolicy_amendment: None,
+                    proposed_network_policy_amendments: None,
+                    available_decisions: None,
+                },
+            },
+        )),
+        ServerRequest::ApplyPatchApproval { request_id, params } => Ok((
+            params.conversation_id,
+            ServerRequest::FileChangeRequestApproval {
+                request_id: request_id.clone(),
+                params: FileChangeRequestApprovalParams {
+                    thread_id: params.conversation_id.to_string(),
+                    turn_id: String::new(),
+                    item_id: params.call_id.clone(),
+                    reason: params.reason.clone(),
+                    grant_root: params.grant_root.clone(),
+                },
+            },
+        )),
+        _ => Err("expected legacy approval request".to_string()),
+    }
+}
+
 fn resolve_chatgpt_auth_tokens_refresh_response(
     codex_home: &std::path::Path,
     auth_credentials_store_mode: codex_core::auth::AuthCredentialsStoreMode,
@@ -488,16 +653,23 @@ fn legacy_thread_notification(
 mod tests {
     use super::LegacyThreadNotification;
     use super::ServerNotificationThreadTarget;
+    use super::bridge_legacy_approval_request;
     use super::legacy_thread_notification;
     use super::server_notification_thread_target;
+    use codex_app_server_protocol::CommandExecutionRequestApprovalParams;
+    use codex_app_server_protocol::ExecCommandApprovalParams;
+    use codex_app_server_protocol::FileChangeRequestApprovalParams;
     use codex_app_server_protocol::JSONRPCNotification;
+    use codex_app_server_protocol::RequestId as AppServerRequestId;
     use codex_app_server_protocol::ServerNotification;
+    use codex_app_server_protocol::ServerRequest;
     use codex_app_server_protocol::Turn;
     use codex_app_server_protocol::TurnStartedNotification;
     use codex_app_server_protocol::TurnStatus;
     use codex_protocol::ThreadId;
     use pretty_assertions::assert_eq;
     use serde_json::json;
+    use std::collections::HashMap;
 
     #[test]
     fn legacy_warning_notification_extracts_thread_id_and_message() {
@@ -580,4 +752,81 @@ mod tests {
             ServerNotificationThreadTarget::InvalidThreadId("not-a-thread-id".to_string())
         );
     }
+
+    #[test]
+    fn bridges_legacy_remote_exec_approval_requests() {
+        let params = ExecCommandApprovalParams {
+            conversation_id: ThreadId::new(),
+            call_id: "call-2".to_string(),
+            approval_id: Some("approval-2".to_string()),
+            command: vec!["printf".to_string(), "hello world".to_string()],
+            cwd: "/tmp/project".into(),
+            reason: Some("Need shell".to_string()),
+            parsed_cmd: Vec::new(),
+        };
+        let request = ServerRequest::ExecCommandApproval {
+            request_id: AppServerRequestId::Integer(8),
+            params: params.clone(),
+        };
+
+        let (thread_id, bridged_request) =
+            bridge_legacy_approval_request(&request).expect("request should bridge");
+
+        assert_eq!(thread_id, params.conversation_id);
+        assert_eq!(
+            bridged_request,
+            ServerRequest::CommandExecutionRequestApproval {
+                request_id: AppServerRequestId::Integer(8),
+                params: CommandExecutionRequestApprovalParams {
+                    thread_id: params.conversation_id.to_string(),
+                    turn_id: String::new(),
+                    item_id: "call-2".to_string(),
+                    approval_id: Some("approval-2".to_string()),
+                    reason: Some("Need shell".to_string()),
+                    network_approval_context: None,
+                    command: Some("printf 'hello world'".to_string()),
+                    cwd: Some("/tmp/project".into()),
+                    command_actions: Some(Vec::new()),
+                    additional_permissions: None,
+                    skill_metadata: None,
+                    proposed_execpolicy_amendment: None,
+                    proposed_network_policy_amendments: None,
+                    available_decisions: None,
+                },
+            }
+        );
+    }
+
+    #[test]
+    fn bridges_legacy_patch_approval_requests() {
+        let params = codex_app_server_protocol::ApplyPatchApprovalParams {
+            conversation_id: ThreadId::new(),
+            call_id: "patch-1".to_string(),
+            file_changes: HashMap::new(),
+            reason: Some("Need write access".to_string()),
+            grant_root: Some("/tmp/project".into()),
+        };
+        let request = ServerRequest::ApplyPatchApproval {
+            request_id: AppServerRequestId::Integer(9),
+            params: params.clone(),
+        };
+
+        let (thread_id, bridged_request) =
+            bridge_legacy_approval_request(&request).expect("request should bridge");
+
+        assert_eq!(thread_id, params.conversation_id);
+        assert_eq!(
+            bridged_request,
+            ServerRequest::FileChangeRequestApproval {
+                request_id: AppServerRequestId::Integer(9),
+                params: FileChangeRequestApprovalParams {
+                    thread_id: params.conversation_id.to_string(),
+                    turn_id: String::new(),
+                    item_id: "patch-1".to_string(),
+                    reason: Some("Need write access".to_string()),
+                    grant_root: Some("/tmp/project".into()),
+                },
+            }
+        );
+    }
 }