Bypass review for always-allow MCP tools in auto-review

[maja-openai]

Why

When an MCP or app tool is configured with approval mode approve (always allow), users expect that decision to be authoritative. In guardian auto-review mode, ARC could still return ask-user, which then routed the approval question into guardian with the ARC reason as context. That meant a tool explicitly configured as always allowed still went through both safety monitors before running.

This change keeps the existing ARC behavior for non-auto-review sessions, but avoids the ARC-to-guardian sequence when approvals_reviewer = auto_review and the tool approval mode is approve.

What changed

• Short-circuit MCP tool approval handling when approval_mode == approve and approvals_reviewer == auto_review.
• Updated the MCP approval regression test so the auto-review case asserts neither ARC nor guardian is called.
• Preserved existing tests that verify ARC can still block always-allow MCP tools outside guardian auto-review mode.

Verification

• cargo test -p codex-core --lib mcp_tool_call

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 98778ddf41

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[owenlin0]

hmm do we need this line? && context.approvals_reviewer == Some(ApprovalsReviewer::AutoReview)

should approve in the tool context just mean approve whether it's a human or auto-reviewer? cc @mzeng-openai

[owenlin0]

oh, is it due to this behavior?

Preserved existing tests that verify ARC can still block always-allow MCP tools outside guardian auto-review mode.

[mzeng-openai]

That's my read as well. I'd get feedback from @fouad-openai and see if we can get rid of this as well as a follow up, but not blocking this change.

[maja-openai]

[codex] Yes, that guard is intentional for this PR scope. The requested behavior is to bypass ARC only for always-allow tools when approvals are routed to guardian auto-review; non-auto-review approval modes should preserve the existing ARC path so ARC can still block. I agree the broader policy could be revisited as a follow-up with @fouad-openai.