fix(api): scope tool policies to agent vocabulary - #114
Merged
Conversation
Gavel AI-fix could select codex-agent while carrying a Claude tool policy. The blanket runtime guard rejected the run even though Codex exposes none of those named tools. Treat positively known foreign built-ins as inapplicable for support checks and profile validation. Keep selected-runtime and unknown names fail-closed so unsupported Codex policies are never silently dropped.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe change allows known foreign built-in tools in ChangesForeign tool policy handling
Suggested reviewers: Merge Risk: ⚪ Minimal · up to Policies can now include inert allow entries for another agent’s built-in tools without blocking the selected runtime, while restrictive, unknown, and supported-tool policies retain validation. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Gavel summary
Totals: 0 passed · 0 failed · 0 skipped · - |
Gavel summary
Totals: 4847 passed · 1 failed · 23 skipped · 14m2s Failing testsapproval — Approval broker > cancels the durable row when the calling context ends |
The previous commit treated every tool name from another agent's vocabulary as inapplicable, so a Claude-style `Bash: deny` or `Bash: ask` on a codex run passed RequireToolPolicySupport and codex ran with its shell fully available — the silent widening the guard exists to refuse. Captain's own history normaliser maps codex shell to Bash, so those names describe the same capability, not a tool codex lacks. The rule also made enforcement depend on how complete the hand-kept vocabulary table is: adding a Claude tool name to it would have loosened every codex run. Narrow the exemption to allow entries. An allow only pre-approves a tool the agent already has, so on an agent without that tool it constrains nothing and can be skipped safely; this is enough for the portable allowlist in #110. A deny or ask on any name, foreign or not, is refused exactly as before, and ask is once again refused unconditionally. validateResolvedPermissions applies the same policy-aware rule. Restore the deny/ask tests to their original form, since that behaviour is unchanged, and add tests that pin the new behaviour directly: a foreign allowlist is accepted on codex-agent, codex-cli and gemini-cli; a mixed map still fails on the runtime's own tools; a foreign deny or ask still fails; a name no agent declares still fails; the API modes treat no name as foreign; and profile resolution skips a foreign allow but refuses a foreign deny. Document the exemption in the approvals page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gavel AI-fix can select codex-agent while carrying a Claude-style
permissions.toolsmap. Captain treated every non-empty map as a Codex policy and rejected the run, even though those tool names do not exist in Codex.Scope policy checks to the selected agent's declared built-ins. Known foreign names are inapplicable, while selected-runtime and unknown names remain fail-closed; runtime profile validation uses the same rule.
Fixes #110
Summary by CodeRabbit
Bug Fixes
Documentation