From 80632a53f2c0356cec382c82e2bc8f9fcae15ef2 Mon Sep 17 00:00:00 2001 From: witbrock Date: Fri, 18 Sep 2026 00:18:05 -0400 Subject: [PATCH] Separate operator MCP from inherited read-only client filters --- docs/engineering/codex_dgx_worker.md | 4 +++- scripts/codex_von_access.py | 12 +++++++----- tests/backend/test_codex_von_operator_access.py | 7 ++++--- 3 files changed, 14 insertions(+), 9 deletions(-) diff --git a/docs/engineering/codex_dgx_worker.md b/docs/engineering/codex_dgx_worker.md index 0b2876e9..1380c1a5 100644 --- a/docs/engineering/codex_dgx_worker.md +++ b/docs/engineering/codex_dgx_worker.md @@ -865,7 +865,9 @@ An ordinary coding worker keeps workspace confinement, disabled Von MCP and controller-mediated effects. A prepared trusted SAIL operator instance may opt in with an owner-installed `operator_access` object containing `enabled: true` and an absolute `mcp_command` argument array. Both coding and inbox launches then -use host access (`danger-full-access`) and that principal-bound MCP command. +use host access (`danger-full-access`) and that principal-bound MCP command +under a dedicated `von_operator` server entry. The ordinary `von` entry stays +disabled, so its inherited read-only tool filter cannot hide operator tools. This is deliberate host-operator authority, comparable to an authorised local interactive coding session; it is not a sandbox or hostile-process isolation. Do not enable it merely because an agent is called a manager. diff --git a/scripts/codex_von_access.py b/scripts/codex_von_access.py index 0d341572..e5b3cdae 100644 --- a/scripts/codex_von_access.py +++ b/scripts/codex_von_access.py @@ -29,15 +29,17 @@ def launch_access_args(config, *, inbox=False): "--sandbox", "danger-full-access", "-c", - "mcp_servers.von.enabled=true", + "mcp_servers.von.enabled=false", "-c", - "mcp_servers.von.command=" + json.dumps(command[0]), + "mcp_servers.von_operator.enabled=true", "-c", - "mcp_servers.von.args=" + json.dumps(command[1:]), + "mcp_servers.von_operator.command=" + json.dumps(command[0]), "-c", - "mcp_servers.von.startup_timeout_sec=60", + "mcp_servers.von_operator.args=" + json.dumps(command[1:]), "-c", - "mcp_servers.von.tool_timeout_sec=180", + "mcp_servers.von_operator.startup_timeout_sec=60", + "-c", + "mcp_servers.von_operator.tool_timeout_sec=180", ] args = ["-c", "mcp_servers.von.enabled=false"] if inbox: diff --git a/tests/backend/test_codex_von_operator_access.py b/tests/backend/test_codex_von_operator_access.py index 10cfb848..5b39873f 100644 --- a/tests/backend/test_codex_von_operator_access.py +++ b/tests/backend/test_codex_von_operator_access.py @@ -41,9 +41,10 @@ def test_operator_has_the_same_explicit_access_in_both_routes(inbox): inbox=inbox, ) assert args[:2] == ["--sandbox", "danger-full-access"] - assert "mcp_servers.von.enabled=true" in args - assert 'mcp_servers.von.command="/operator/python"' in args - assert not any("enabled=false" in value for value in args) + assert "mcp_servers.von_operator.enabled=true" in args + assert 'mcp_servers.von_operator.command="/operator/python"' in args + assert "mcp_servers.von.enabled=false" in args + assert not any("mcp_servers.von.enabled=true" in value for value in args) @pytest.mark.parametrize(