blomios/IdeaSDK
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(#108): restreint Code Mode Codex au namespace MCP IdeA et documente les tools au démarrage

Browse Source 
Codex Code Mode pouvait appeler n'importe quel outil MCP directement,
contournant la médiation d'approbation. On force
[features.code_mode].direct_only_tool_namespaces = ["mcp__idea"] sur
chaque surface qui écrit le config.toml Codex (permission projector,
lifecycle, migration run-dir, assistant de ticket), et on ajoute
initialize.instructions côté serveur MCP pour orienter Codex vers le
bon outil idea_* dès la connexion, sans dépendre de la recherche
sémantique différée.

QA : domain 283/0, application 126/0 + agent_lifecycle 73/0 +
change_agent_profile 19/0 + ticket_assistant 5/0, infrastructure 339/0
dont mcp_server 37/0, backend 68/0 (7 ignored). Les échecs web-server
observés sur cargo test --workspace (Too many open files, cookies)
sont une contamination de ressources inter-tests ; les deux tests
concernés repassent isolément.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-29 22:51:38 +02:00
parent af6b76935c
commit d0b65a92bd
9 changed files with 228 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
crates/backend/src/lib.rs
View File

@ -69,6 +69,7 @@ use domain::ports::{
};
use domain::profile::{
AgentProfile, ContextInjection, McpConfigStrategy, McpTransport, StructuredAdapter,
CODEX_CODE_MODE_FEATURES_TABLE, CODEX_CODE_MODE_FEATURES_TOML,
};
use domain::remote::RemoteKind;
use domain::{
@ -3450,6 +3451,11 @@ fn codex_config_toml_for_migration(
"mcp_servers.idea",
mcp_declaration.trim_end(),
);
text = replace_toml_table_block(
&text,
CODEX_CODE_MODE_FEATURES_TABLE,
CODEX_CODE_MODE_FEATURES_TOML.trim_end(),
);
text = ensure_codex_project_trust(&text, run_dir);
text = ensure_codex_project_trust(&text, project_root);
if !text.ends_with('\n') {
@ -3944,11 +3950,18 @@ mod run_dir_migration_tests {
run_dir.join(".codex/config.toml"),
r#"approval_policy = "never"
sandbox_mode = "workspace-write"
user_key = "keep-me"
[mcp_servers.idea]
command = "stale"
args = ["mcp-server"]
transport = "stdio"
[features.code_mode]
direct_only_tool_namespaces = ["old"]
[features.preview]
enabled = true
"#,
)
.unwrap();
@ -3975,10 +3988,17 @@ transport = "stdio"
let config = std::fs::read_to_string(run_dir.join(".codex/config.toml")).unwrap();
assert!(config.contains(r#"approval_policy = "never""#));
assert!(config.contains(r#"sandbox_mode = "workspace-write""#));
assert!(config.contains(r#"user_key = "keep-me""#));
assert!(config.contains("[mcp_servers.idea]"));
assert!(config.contains(r#"default_tools_approval_mode = "approve""#));
assert!(config.contains("tool_timeout_sec = 86400"));
assert!(
config.contains("[features.code_mode]\ndirect_only_tool_namespaces = [\"mcp__idea\"]")
);
assert_eq!(config.matches("[features.code_mode]").count(), 1);
assert!(!config.contains(r#"command = "stale""#));
assert!(!config.contains(r#"direct_only_tool_namespaces = ["old"]"#));
assert!(config.contains("[features.preview]\nenabled = true"));
assert!(config.contains(&format!(r#"[projects."{}"]"#, run_dir.to_string_lossy())));
assert!(config.contains(&format!(r#"[projects."{}"]"#, project.root.as_str())));