fix(evo): classify host-brokered run tool - #59
Conversation
Co-Authored-By: Paperclip <noreply@paperclip.ing>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aae8b9ce1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) | ||
| HOST_BROKERED_EVO_TOOL_NAMES = frozenset({"scaffolde_evo_agent_dispatch"}) | ||
| HOST_BROKERED_EVO_TOOL_NAMES = frozenset( | ||
| {"scaffolde_evo_agent_dispatch", "scaffolde_evo_run"} |
There was a problem hiding this comment.
When operators assess strict process-profile isolation, docs/security/execution-profiles.md:183-186 still states that only scaffolde_evo_agent_dispatch is host brokered and that other plugin tools fail before spawn. Adding scaffolde_evo_run here makes that security guarantee false, so update the execution-profile documentation to describe the expanded host-side authority.
Useful? React with 👍 / 👎.
| ) | ||
| HOST_BROKERED_EVO_TOOL_NAMES = frozenset({"scaffolde_evo_agent_dispatch"}) | ||
| HOST_BROKERED_EVO_TOOL_NAMES = frozenset( | ||
| {"scaffolde_evo_agent_dispatch", "scaffolde_evo_run"} |
There was a problem hiding this comment.
A repo-wide search finds no schema or handler registration for scaffolde_evo_run, only this allowlist entry and its test, so this externally supplied plugin capability is being special-cased in the core classifier. Every additional brokered plugin action would consequently require another core patch, while a generic frozen-entry/profile authority marker could preserve fail-closed classification without accumulating vendor-specific names here.
AGENTS.md reference: AGENTS.md:L122-L125
Useful? React with 👍 / 👎.
| local, host_brokered = classify_evo_tools( | ||
| ["terminal", "read_file", "scaffolde_evo_agent_dispatch", "scaffolde_evo_run"] | ||
| ) |
There was a problem hiding this comment.
This test only proves membership in the classifier sets; it does not exercise scaffolde_evo_run through ParentBrokerAdapter, session.start, worker-side classification, and frozen parent dispatch. The existing process-integration tests use only scaffolde_evo_agent_dispatch, so this test remains green if the newly admitted handler cannot actually execute—the same launch path this change is intended to repair. Add an integration test using a real registered scaffolde_evo_run handler and the worker/broker path.
AGENTS.md reference: AGENTS.md:L84-L87
Useful? React with 👍 / 👎.
1 participant
Summary
Scaffolde candidate profiles intentionally expose both host-brokered Evo tools:
scaffolde_evo_agent_dispatchscaffolde_evo_runThe strict process-profile classifier only recognized the first, so real candidate launches failed before
run_owned_processand correctly produced no execution receipt. Add the missing exact authority classification; unknown tools remain fail-closed.Verification
uv run --with pytest python -m pytest -q tests/agent/test_subagent_tool_boundary.py tests/agent/test_subagent_process_integration.py— 14 passedgit diff --check— passEvo v1 tool classification is undefined for: [scaffolde_evo_run]