fix(runner): separate Codex approvals from questions

packages/paperclip-runner/test/acpx-codex-package-contract.test.mjs

@@ -136,6 +136,13 @@ test("the Codex patch enforces isolated instructions, tools, and skills", () =>
   }
 });
 
+test("the Codex patch keeps MCP tool approvals on the governed permission channel", () => {
+  assert.match(
+    codexPatch,
+    /!context\.isToolApproval && this\.shouldUseAcpElicitation\(params\)/,
+  );
+});
+
 test("the Claude patch removes ambient project and local configuration", () => {
   for (const token of [
     "PAPERCLIP_ACPX_ISOLATED_CONTEXT",

patches/@agentclientprotocol__codex-acp@1.6.2.patch

@@ -1,6 +1,15 @@
 diff --git a/dist/index.js b/dist/index.js
 --- a/dist/index.js
 +++ b/dist/index.js
+@@ -25341,7 +25341,7 @@
+   async handleElicitation(params) {
+     try {
+       const context = this.createMcpElicitationContext(params);
+-      if (this.shouldUseAcpElicitation(params)) {
++      if (!context.isToolApproval && this.shouldUseAcpElicitation(params)) {
+         const response2 = await this.connection.request(
+           methods.client.elicitation.create,
+           this.buildElicitationRequest(params, context),
 @@ -25563,7 +25563,7 @@
              toolCall: {
                toolCallId: context.correlatedCallId,