Use untrusted default for Codex MCP auto mode

packages/server/src/server/agent/providers/codex-mcp-agent.test.ts

@@ -541,7 +541,7 @@ describe("CodexMcpAgentClient (MCP integration)", () => {
         provider: "codex-mcp",
         cwd,
         modeId: "full-access",
-        approvalPolicy: "on-request",
+        approvalPolicy: "untrusted",
       } as AgentSessionConfig;
 
       let session: AgentSession | null = null;
@@ -676,7 +676,7 @@ describe("CodexMcpAgentClient (MCP integration)", () => {
         provider: "codex-mcp",
         cwd,
         modeId: "full-access",
-        approvalPolicy: "on-request",
+        approvalPolicy: "untrusted",
       } as AgentSessionConfig;
 
       let session: AgentSession | null = null;
@@ -751,7 +751,7 @@ describe("CodexMcpAgentClient (MCP integration)", () => {
         provider: "codex-mcp",
         cwd,
         modeId: "full-access",
-        approvalPolicy: "on-request",
+        approvalPolicy: "untrusted",
       } as AgentSessionConfig;
 
       let session: AgentSession | null = null;
@@ -837,7 +837,7 @@ describe("CodexMcpAgentClient (MCP integration)", () => {
         provider: "codex-mcp",
         cwd,
         modeId: "full-access",
-        approvalPolicy: "on-request",
+        approvalPolicy: "untrusted",
       } as AgentSessionConfig;
 
       let session: AgentSession | null = null;

packages/server/src/server/agent/providers/codex-mcp-agent.ts

@@ -98,7 +98,7 @@ const MODE_PRESETS: Record<
     sandbox: "read-only",
   },
   auto: {
-    approvalPolicy: "on-request",
+    approvalPolicy: "untrusted",
     sandbox: "workspace-write",
   },
   "full-access": {
@@ -559,7 +559,6 @@ class CodexMcpAgentSession implements AgentSession {
     this.pendingPermissionHandlers.delete(requestId);
     this.pendingPermissions.delete(requestId);
     this.resolvedPermissionRequests.add(requestId);
-
     const status = response.behavior === "allow" ? "granted" : "denied";
     this.emitEvent({
       type: "timeline",