blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(#108): restreint Code Mode Codex au namespace MCP IdeA et documente les tools au démarrage

Browse Source 
Codex Code Mode pouvait appeler n'importe quel outil MCP directement,
contournant la médiation d'approbation. On force
[features.code_mode].direct_only_tool_namespaces = ["mcp__idea"] sur
chaque surface qui écrit le config.toml Codex (permission projector,
lifecycle, migration run-dir, assistant de ticket), et on ajoute
initialize.instructions côté serveur MCP pour orienter Codex vers le
bon outil idea_* dès la connexion, sans dépendre de la recherche
sémantique différée.

QA : domain 283/0, application 126/0 + agent_lifecycle 73/0 +
change_agent_profile 19/0 + ticket_assistant 5/0, infrastructure 339/0
dont mcp_server 37/0, backend 68/0 (7 ignored). Les échecs web-server
observés sur cargo test --workspace (Too many open files, cookies)
sont une contamination de ressources inter-tests ; les deux tests
concernés repassent isolément.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-29 22:51:38 +02:00
parent af6b76935c
commit d0b65a92bd
9 changed files with 228 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
crates/infrastructure/src/assistant/mod.rs
View File

@ -5,7 +5,10 @@ use std::sync::Arc;
use application::McpRuntime;
use async_trait::async_trait;
use domain::ports::{SecretStore, SessionPlan};
use domain::profile::{McpConfigStrategy, OpenCodeProviderConfig, StructuredAdapter};
use domain::profile::{
McpConfigStrategy, OpenCodeProviderConfig, StructuredAdapter, CODEX_CODE_MODE_FEATURES_TABLE,
CODEX_CODE_MODE_FEATURES_TOML,
};
use domain::{
AgentProfile, AgentRuntime, AssistantContextError, AssistantContextProvider,
ContextInjectionPlan, EffectivePermissions, FileSystem, FsError, Issue, IssueRef, MarkdownDoc,
@ -522,6 +525,11 @@ fn codex_config_toml(
text = set_top_level_toml_value(&text, "model", model);
}
text = replace_toml_table_block(&text, "mcp_servers.idea", mcp_declaration.trim_end());
text = replace_toml_table_block(
&text,
CODEX_CODE_MODE_FEATURES_TABLE,
CODEX_CODE_MODE_FEATURES_TOML.trim_end(),
);
text = ensure_codex_project_trust(&text, run_dir);
text = ensure_codex_project_trust(&text, project_root);
if !text.ends_with('\n') {
@ -645,6 +653,60 @@ fn parent_dir(base: &ProjectPath, rel: &str) -> String {
}
}
#[cfg(test)]
mod codex_config_toml_tests {
use domain::profile::McpTransport;
use super::*;
#[test]
fn assistant_codex_config_replaces_code_mode_and_preserves_user_content() {
let declaration = McpServerWiring::new(
"idea".to_owned(),
vec!["mcp-server".to_owned()],
McpTransport::Stdio,
)
.to_config_toml();
let existing = "user_key = \"keep\"\n\n[features.code_mode]\ndirect_only_tool_namespaces = [\"old\"]\n\n[features.preview]\nenabled = true\n\n[user.table]\nvalue = 1\n";
let rendered = codex_config_toml(
Some(existing),
&declaration,
"/run/assistant",
"/proj",
None,
);
assert!(
rendered.contains("user_key = \"keep\""),
"unmanaged top-level key preserved: {rendered}"
);
assert!(
rendered.contains("[user.table]\nvalue = 1"),
"unmanaged table preserved: {rendered}"
);
assert!(
rendered.contains("[features.preview]\nenabled = true"),
"unmanaged sibling features table preserved: {rendered}"
);
assert!(
rendered
.contains("[features.code_mode]\ndirect_only_tool_namespaces = [\"mcp__idea\"]"),
"assistant Codex config should inject direct-only IdeA MCP namespace: {rendered}"
);
assert_eq!(
rendered.matches("[features.code_mode]").count(),
1,
"assistant Codex config should replace, not duplicate, code mode table: {rendered}"
);
assert!(
rendered.contains("[projects.\"/run/assistant\"]")
&& rendered.contains("[projects.\"/proj\"]"),
"trust entries should still be generated: {rendered}"
);
}
}
#[cfg(test)]
mod opencode_provider_config_json_tests {
use domain::ports::SecretRef;

7
crates/infrastructure/src/orchestrator/mcp/server.rs
View File

@ -42,6 +42,10 @@ use super::tools::{self, ToolMapError};
/// The MCP protocol version this server speaks (advertised on `initialize`).
const MCP_PROTOCOL_VERSION: &str = "2024-11-05";
/// Compact MCP instructions advertised at initialization. The first 512 chars are
/// intentionally self-contained because some clients truncate this field.
const MCP_INSTRUCTIONS: &str = "Use IdeA tools by intent: ticket work -> idea_ticket_*; ask/delegate to one agent -> idea_ask_agent, several -> idea_ask_agents; durable project facts -> idea_memory_*; project/agent context -> idea_context_*. Then use idea_skill_* for assigned workflows, idea_template_* for agent templates, idea_workstate_* for live status, idea_run_in_background/background tools for long commands, agent lifecycle tools to launch/stop/resume/swap agents, and sprint tools for planning.";
/// The IdeA MCP server: an entry adapter over [`OrchestratorService::dispatch`].
///
/// Cheap to clone the dependencies it holds; one instance serves one project's
@ -340,7 +344,8 @@ impl McpServer {
json!({
"protocolVersion": MCP_PROTOCOL_VERSION,
"capabilities": { "tools": {} },
"serverInfo": { "name": "idea-orchestrator", "version": env!("CARGO_PKG_VERSION") }
"serverInfo": { "name": "idea-orchestrator", "version": env!("CARGO_PKG_VERSION") },
"instructions": MCP_INSTRUCTIONS
})
}

61
crates/infrastructure/src/permission/codex.rs
View File

@ -19,6 +19,7 @@ use domain::permission::{
EffectivePermissions, PermissionProjection, PermissionProjector, Posture, ProjectedFile,
ProjectionContext, ProjectorKey,
};
use domain::profile::{CODEX_CODE_MODE_FEATURES_TABLE, CODEX_CODE_MODE_FEATURES_TOML};
use domain::NetworkPolicy;
use super::toml_string;
@ -70,13 +71,15 @@ impl PermissionProjector for CodexPermissionProjector {
// `set_top_level_toml_value`). The mcp_servers/trust tables are NOT a
// permission concern and stay with the MCP wiring (LP3-3).
let mut contents = format!(
"sandbox_mode = {}\napproval_policy = {}\n\n[{}]\nnetwork_access = {}\n",
"sandbox_mode = {}\napproval_policy = {}\n",
toml_string(sandbox),
toml_string(approval),
SANDBOX_WORKSPACE_WRITE_TABLE,
network_access,
);
append_codex_model_config(&mut contents, ctx);
contents.push_str(&format!(
"\n[{}]\nnetwork_access = {}\n\n{}",
SANDBOX_WORKSPACE_WRITE_TABLE, network_access, CODEX_CODE_MODE_FEATURES_TOML,
));
let mut args = vec![
"--sandbox".to_owned(),
@ -111,12 +114,17 @@ fn codex_model_and_network_file(
ctx: &ProjectionContext,
network: Option<NetworkPolicy>,
) -> ProjectedFile {
let mut contents = format!(
"[{}]\nnetwork_access = {}\n",
let mut contents = String::new();
append_codex_model_config(&mut contents, ctx);
if !contents.is_empty() {
contents.push('\n');
}
contents.push_str(&format!(
"[{}]\nnetwork_access = {}\n\n{}",
SANDBOX_WORKSPACE_WRITE_TABLE,
codex_network_access(network),
);
append_codex_model_config(&mut contents, ctx);
CODEX_CODE_MODE_FEATURES_TOML,
));
ProjectedFile::MergeToml {
rel_path: CONFIG_REL_PATH.to_owned(),
managed_tables: codex_managed_tables(ctx),
@ -137,7 +145,10 @@ fn codex_managed_keys(ctx: &ProjectionContext, include_permissions: bool) -> Vec
}
fn codex_managed_tables(_ctx: &ProjectionContext) -> Vec<String> {
vec![SANDBOX_WORKSPACE_WRITE_TABLE.to_owned()]
vec![
SANDBOX_WORKSPACE_WRITE_TABLE.to_owned(),
CODEX_CODE_MODE_FEATURES_TABLE.to_owned(),
]
}
fn append_codex_model_config(contents: &mut String, ctx: &ProjectionContext) {
@ -198,6 +209,13 @@ mod tests {
resolve(Some(&PermissionSet::new(vec![], fallback)), None).unwrap()
}
fn expected_managed_tables() -> Vec<String> {
vec![
SANDBOX_WORKSPACE_WRITE_TABLE.to_owned(),
CODEX_CODE_MODE_FEATURES_TABLE.to_owned(),
]
}
// ---- product invariant + ownership ----------------------------------
#[test]
@ -213,15 +231,18 @@ mod tests {
contents,
} => {
assert_eq!(rel_path, CONFIG_REL_PATH);
assert_eq!(
managed_tables,
&vec![SANDBOX_WORKSPACE_WRITE_TABLE.to_owned()]
);
assert_eq!(managed_tables, &expected_managed_tables());
assert!(managed_keys.is_empty());
assert!(
contents.contains("[sandbox_workspace_write]\nnetwork_access = false"),
"network is denied by default: {contents:?}"
);
assert!(
contents.contains(
"[features.code_mode]\ndirect_only_tool_namespaces = [\"mcp__idea\"]"
),
"Code Mode direct tools must be restricted to IdeA MCP: {contents:?}"
);
}
ProjectedFile::Replace { .. } => panic!("Codex must emit a MergeToml file"),
}
@ -255,10 +276,7 @@ mod tests {
} => {
assert!(managed_keys.contains(&"model".to_owned()));
assert!(!managed_keys.contains(&"model_provider".to_owned()));
assert_eq!(
managed_tables,
&vec![SANDBOX_WORKSPACE_WRITE_TABLE.to_owned()]
);
assert_eq!(managed_tables, &expected_managed_tables());
assert!(contents.contains("model = \"gpt-5\""), "{contents}");
assert!(!contents.contains("model_provider"), "{contents}");
assert!(!contents.contains("model_providers"), "{contents}");
@ -296,10 +314,7 @@ mod tests {
contents,
} => {
assert_eq!(rel_path, CONFIG_REL_PATH);
assert_eq!(
managed_tables,
&vec![SANDBOX_WORKSPACE_WRITE_TABLE.to_owned()]
);
assert_eq!(managed_tables, &expected_managed_tables());
assert_eq!(
managed_keys,
&vec!["sandbox_mode".to_owned(), "approval_policy".to_owned()]
@ -316,6 +331,12 @@ mod tests {
contents.contains("[sandbox_workspace_write]\nnetwork_access = false"),
"network is denied by default: {contents:?}"
);
assert!(
contents.contains(
"[features.code_mode]\ndirect_only_tool_namespaces = [\"mcp__idea\"]"
),
"Code Mode direct tools must be restricted to IdeA MCP: {contents:?}"
);
}
ProjectedFile::Replace { .. } => panic!("Codex must emit a MergeToml file"),
}

29
crates/infrastructure/tests/mcp_server.rs
View File

@ -1887,6 +1887,35 @@ async fn initialize_answers_minimal_handshake() {
// Capability for tools is advertised, and the server identifies itself.
assert!(result["capabilities"]["tools"].is_object());
assert_eq!(result["serverInfo"]["name"], json!("idea-orchestrator"));
let instructions = result["instructions"]
.as_str()
.expect("initialize should advertise compact instructions");
let first_512 = instructions.chars().take(512).collect::<String>();
for needle in [
"idea_ticket_*",
"idea_ask_agent",
"idea_ask_agents",
"idea_memory_*",
"idea_context_*",
] {
assert!(
first_512.contains(needle),
"first 512 chars should route natural intent to {needle}; got {first_512:?}"
);
}
for needle in [
"idea_skill_*",
"idea_template_*",
"idea_workstate_*",
"background",
"agent lifecycle",
"sprint",
] {
assert!(
instructions.contains(needle),
"instructions should cover {needle}; got {instructions:?}"
);
}
}
/// Readiness de démarrage (fix race cold-launch, signal MCP) : un `initialize` reçu sur