fix(app-server): fix approval events in review mode

[owenlin0]

One of our partners flagged that they were seeing the wrong order of events when running review/start with command exec approvals:

{"method":"item/commandExecution/requestApproval","id":0,"params":{"threadId":"019c0b6b-6a42-7c02-99c4-98c80e88ac27","turnId":"0","itemId":"0","reason":"`/bin/zsh -lc 'git show b7a92b4eacf262c575f26b1e1ed621a357642e55 --stat'` requires approval: Xcode-required approval: Require explicit user confirmation for all commands.","proposedExecpolicyAmendment":null}}

{"method":"item/started","params":{"item":{"type":"commandExecution","id":"call_AEjlbHqLYNM7kbU3N6uw1CNi","command":"/bin/zsh -lc 'git show b7a92b4eacf262c575f26b1e1ed621a357642e55 --stat'","cwd":"/Users/devingreen/Desktop/SampleProject","processId":null,"status":"inProgress","commandActions":[{"type":"unknown","command":"git show b7a92b4eacf262c575f26b1e1ed621a357642e55 --stat"}],"aggregatedOutput":null,"exitCode":null,"durationMs":null},"threadId":"019c0b6b-6a42-7c02-99c4-98c80e88ac27","turnId":"0"}}

Key fix: In the review sub‑agent delegate we were forwarding exec (and patch) approvals using the parent turn id (parent_ctx.sub_id) as the approval call_id. That made item/commandExecution/requestApproval.itemId differ from the actual item/started id. We now forward the sub‑agent’s call_id from the approval event instead, so the approval item id matches the commandExecution item id in review flows.

Here’s the expected event order for an inline review/start that triggers an exec approval after this fix:

1. Response to review/start (JSON‑RPC response)

• Includes turn (status inProgress) and review_thread_id (same as parent thread for inline).

2. turn/started notification

• turnId is the review turn id (e.g., "0").

3. item/started → EnteredReviewMode

• item.id == turnId, marks entry into review mode.

4. item/started → commandExecution

• item.id == <call_id> (e.g., "review-call-1"), status: inProgress.

5. item/commandExecution/requestApproval request

• JSON‑RPC request (not a notification).
• params.itemId == <call_id> and params.turnId == turnId.

6. Client replies to approval request (Approved / Declined / etc).
7. If approved:

• Optional item/commandExecution/outputDelta notifications.
• item/completed → commandExecution with status and exitCode.

8. Review finishes:

• item/started → ExitedReviewMode
• item/completed → ExitedReviewMode
• (Agent message items may also appear, depending on review output.)

9. turn/completed notification

The key being #4 and #5 are now in the proper order with the correct item id.

[jif-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".