feat(mcp): Add local mode support for Codex CLI

[r1bilski]

This implements generating project-level config for mcp for codexcli.

closes #1103

[dyoshikawa]

@r1bilski Thank you! I'll be glad if work on the points:

Code Review & Security Review

Code Review

Overall: Good - The implementation follows existing patterns (GeminiCliMcp, OpencodeMcp) well, and the intent is clear.

Issues to Address

1. README.md not updated (High priority)

   • The Supported Tools and Features section still shows 🌏 🔧 (global-only) for Codex CLI's mcp column. Since this PR adds local mode support, it should be updated to ✅ 🌏 🔧.
   • This is also documented in feature-change-guidelines.md.

2. Consider .codex/config.toml in gitignore.ts (Medium priority)

   • Other tools' MCP config files (.mcp.json, .gemini/settings.json, etc.) are added to gitignore, but .codex/config.toml is not.
   • If this is intentional (since config.toml may contain other Codex settings, similar to the isDeletable(): false reasoning), please document the rationale in the PR description.
   • Per feature-change-guidelines.md: "Evaluate whether gitignore.ts needs additions or changes in its generated output."

Minor Suggestions

3. getSettablePaths parameter naming (Low priority)
   • Changing { global } to _options is inconsistent with other tools like GeminiCliMcp. Consider using { global: _global } or keeping the destructuring pattern for consistency.

Positives

• readFileContent → readFileContentOrNull + smolToml.stringify({}) fallback is appropriate
• isDeletable(): false follows the same pattern as GeminiCliMcp/OpencodeMcp — correct defensive design
• Good test coverage: local mode full workflow integration test (fromFile → toRulesyncMcp → fromRulesyncMcp), E2E test, and isDeletable test added
• Existing test bug fix (mcpServers → mcp_servers reference) is a nice catch

Security Review

No security issues found. This PR is safe to merge from a security perspective.

• Path traversal/injection: Only hardcoded relative paths (.codex, config.toml) are used. checkPathTraversal() exists as additional protection.
• File system security: TOCTOU window in readFileContentOrNull is a pre-existing pattern across the project, with negligible risk in a CLI tool context.
• TOML parsing: smolToml.parse() is a safe data parser with type checking in convertFromCodexFormat.
• Global/local mode switch: Controlled by baseDir parameter — no new attack surface introduced.
• Malicious code/backdoors: None detected.

---

🤖 Generated with Claude Code

[dyoshikawa]

Code Review & Security Review

Code Review

Overall: Good - The implementation follows existing patterns (GeminiCliMcp, OpencodeMcp) well, and the intent is clear.

Issues to Address

1. README.md not updated (High priority)

   • The Supported Tools and Features section still shows global-only for Codex CLI's mcp column. Since this PR adds local mode support, it should be updated accordingly.
   • This is also documented in feature-change-guidelines.md.

2. Consider .codex/config.toml in gitignore.ts (Medium priority)

   • Other tools' MCP config files (.mcp.json, .gemini/settings.json, etc.) are added to gitignore, but .codex/config.toml is not.
   • If this is intentional (since config.toml may contain other Codex settings, similar to the isDeletable(): false reasoning), please document the rationale in the PR description.
   • Per feature-change-guidelines.md: "Evaluate whether gitignore.ts needs additions or changes in its generated output."

Minor Suggestions

3. getSettablePaths parameter naming (Low priority)
   • Changing { global } to _options is inconsistent with other tools like GeminiCliMcp. Consider using { global: _global } or keeping the destructuring pattern for consistency.

Positives

• readFileContent to readFileContentOrNull + smolToml.stringify({}) fallback is appropriate
• isDeletable(): false follows the same pattern as GeminiCliMcp/OpencodeMcp - correct defensive design
• Good test coverage: local mode full workflow integration test, E2E test, and isDeletable test added
• Existing test bug fix (mcpServers to mcp_servers reference) is a nice catch

Security Review

No security issues found. This PR is safe to merge from a security perspective.

• Path traversal/injection: Only hardcoded relative paths are used. checkPathTraversal() exists as additional protection.
• File system security: TOCTOU window in readFileContentOrNull is a pre-existing pattern across the project, with negligible risk in a CLI tool context.
• TOML parsing: smolToml.parse() is a safe data parser with type checking in convertFromCodexFormat.
• Global/local mode switch: Controlled by baseDir parameter - no new attack surface introduced.
• Malicious code/backdoors: None detected.

[r1bilski]

Whoops, I forgot to update the docs :)
I resolved 1 and 2.

3. I'd say is good as is. We're not using the options so I think it's slightly clearer to ignore the whole parameter instead of destructuring.

[cm-dyoshikawa]

Thank you, LGTM！