bug(control): tool approval settings prevent external MCP server startup #817

Problem

External operator MCP is enabled, but no listener starts after the managed Codex configuration contains per-tool approval settings. External Codex reports a transport send error to the configured loopback MCP endpoint.

Collected evidence

• Agent Code main process is running from the main checkout at the merged toolkit revision.
• Saved external-control settings say enabled; curl to the configured MCP port immediately returns connection refused (HTTP 000), and lsof confirms no listener.
• Codex config parses successfully. Its operator URL and credential match Agent Code settings; the operator skill ownership marker validates.
• The managed server block additionally contains nested mcp_servers.agent-code-control.tools.<tool>.approval_mode tables. Its exact-byte ownership hash no longer matches.
• Executing the actual createExternalCodexIntegration module against a private temporary copy of the current configuration reproduces: Managed Codex connection was edited; preserve or remove that block manually.
• The temporary copy remains unchanged. No live config or application state was modified during diagnosis.

Expected behavior

User-owned per-tool approval policy should coexist with Agent Code managing its connection URL and authentication. Benign tool-policy additions should not silently take the operator listener offline. Unrelated settings and intentional edits must remain protected.

Actual behavior and cause

externalCodexIntegration.ts treats every byte between ownership markers as exclusively app-owned. externalControl.ts stops the listener when integration reconciliation throws. Nested tool policy additions therefore make the enabled server unavailable. The writer that introduced these additions has not been independently identified.

Reproduction

1. Enable External operator MCP in Agent Code.
2. Add a per-tool approval table inside the generated server block through the external client/configuration.
3. Restart Agent Code or retry connection setup.
4. Observe enabled-but-not-running state and connection refusal.

Resolution requirements

• Separate connection ownership from user-owned nested tool policy; preserve policy and unrelated config during enable, retry, update, rotation and disable.
• Preserve refusal for true credential/URL ownership conflicts and invalid TOML.
• Add a regression based on the observed table structure with synthetic credentials, never a raw user configuration fixture.
• Verify a real loopback MCP initialize/tools-list exchange after recovery.

Refs #793 and #795. Discovered while developing #816; keep the transport repair distinct from the agent-names feature.