MillasDev/memory
Watch
2
0
Fork
You've already forked memory
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(agent-permissions-and-tools): give architect context7/codegraph/webfetch; make code-implementer a pure file editor; harden deploy.sh MCP merging #2

Merged
MillasAgent merged 4 commits from fix/agent-permissions-and-tools into main 2026-08-22 23:08:33 +00:00
Conversation 1 Commits 4 Files changed 9 +266 -34
MillasAgent commented 2026-08-22 22:54:20 +00:00
Owner
Copy link

fix(agent-permissions-and-tools): give architect context7/codegraph/webfetch; make code-implementer a pure file editor; harden deploy.sh MCP merging

Summary

Three commits on top of feat/cleanup-pass-1:

  1. 302c463 fix(tools): enable MCP and missing agent permissions — adds mcp.codegraph, drops the Context7 "api key" placeholder, gives architect webfetch: allow + Research mode, gives security-auditor a git allowlist, gives orchestrator an external_directory allowlist.
  2. b972ec5 refactor(roles): code-implementer becomes pure file editor — implementer gets read/edit/glob/grep/list: allow and bash/task/external_directory/webfetch: deny; orchestrator learns a shell_requests execution protocol.
  3. 55a16d1 fix(review): address double-blind review findings — security-auditor + arch-quality-reviewer findings: invert external_directory rule order (was a no-op), rewrite stale Constraints section, harden deploy.sh to merge the bundled mcp: block, document a growing URL allowlist, add schema_version: 1 to shell_requests, add pre-check that refuses git operations from shell_requests, tighten git log*/git diff*/git show* patterns, etc.

Notes for reviewers

  • The branch is built on top of feat/cleanup-pass-1 (PR #1, still open). When PR #1 merges, this will rebase cleanly onto main.
  • The PR diff against main includes 4 cleanup-pass-1 commits + 3 new commits. The 4 cleanup-pass-1 commits were already double-blind reviewed (PASS WITH NITS, all nits fixed in commit 50fb796 of that branch).
  • bash workspace/opencode/deploy.sh --check exits 0 on the final state.
  • The architect URL allowlist is advisory (opencode schema forbids object-form for webfetch at the agent level). The architect reads its own body to know which URLs are pre-approved; URLs the user wants added go into the allowlist over time.
  • deploy.sh now merges the bundled mcp: block into the user's ~/.config/opencode/opencode.jsonc during --install — without headers.Authorization, so the bundle never propagates any API key.

Verification

$ bash workspace/opencode/deploy.sh --check
[deploy] validating agents in ...
[deploy] validating skills in ...
[deploy] validating commands in ...
[deploy] validation OK
exit=0

Tech-debt items closed

  • TD-7 — Context7 placeholder removed; mcp.codegraph added.
  • RC-1 (no mcp.codegraph), RC-2 (architect webfetch), RC-3 (architect body forbids network), RC-4 (architect body never mentions MCP), RC-5 (implementer frontmatter), RC-6 (implementer body assumes bash), RC-7 (security-auditor bash), RC-10 (orchestrator external_directory).
# fix(agent-permissions-and-tools): give architect context7/codegraph/webfetch; make code-implementer a pure file editor; harden deploy.sh MCP merging ## Summary Three commits on top of feat/cleanup-pass-1: 1. 302c463 fix(tools): enable MCP and missing agent permissions — adds mcp.codegraph, drops the Context7 "api key" placeholder, gives architect webfetch: allow + Research mode, gives security-auditor a git allowlist, gives orchestrator an external_directory allowlist. 2. b972ec5 refactor(roles): code-implementer becomes pure file editor — implementer gets read/edit/glob/grep/list: allow and bash/task/external_directory/webfetch: deny; orchestrator learns a shell_requests execution protocol. 3. 55a16d1 fix(review): address double-blind review findings — security-auditor + arch-quality-reviewer findings: invert external_directory rule order (was a no-op), rewrite stale Constraints section, harden deploy.sh to merge the bundled mcp: block, document a growing URL allowlist, add schema_version: 1 to shell_requests, add pre-check that refuses git operations from shell_requests, tighten git log*/git diff*/git show* patterns, etc. ## Notes for reviewers - The branch is built on top of feat/cleanup-pass-1 (PR #1, still open). When PR #1 merges, this will rebase cleanly onto main. - The PR diff against main includes 4 cleanup-pass-1 commits + 3 new commits. The 4 cleanup-pass-1 commits were already double-blind reviewed (PASS WITH NITS, all nits fixed in commit 50fb796 of that branch). - `bash workspace/opencode/deploy.sh --check` exits 0 on the final state. - The architect URL allowlist is **advisory** (opencode schema forbids object-form for webfetch at the agent level). The architect reads its own body to know which URLs are pre-approved; URLs the user wants added go into the allowlist over time. - deploy.sh now merges the bundled mcp: block into the user's ~/.config/opencode/opencode.jsonc during --install — without headers.Authorization, so the bundle never propagates any API key. ## Verification ``` $ bash workspace/opencode/deploy.sh --check [deploy] validating agents in ... [deploy] validating skills in ... [deploy] validating commands in ... [deploy] validation OK exit=0 ``` ## Tech-debt items closed - TD-7 — Context7 placeholder removed; mcp.codegraph added. - RC-1 (no mcp.codegraph), RC-2 (architect webfetch), RC-3 (architect body forbids network), RC-4 (architect body never mentions MCP), RC-5 (implementer frontmatter), RC-6 (implementer body assumes bash), RC-7 (security-auditor bash), RC-10 (orchestrator external_directory). 
- workspace/opencode/opencode.jsonc: declare mcp.codegraph; drop the
  literal "api key" placeholder (closes TD-7; addresses RC-1).
- agents/architect.md: webfetch: allow; add Research mode section
  teaching context7 + CodeGraph + webfetch usage; drop the "no
  network" body instruction (RC-2, RC-3, RC-4).
- agents/security-auditor.md: add git log*/diff*/show* bash allowlist
  (RC-7).
- agents/orchestrator.md: add external_directory allowlist for
  ~/.config/opencode/* (RC-10).
- README.md §Quick start: rewrite the Context7 API key paragraph to
  reflect that the bundle ships unauthenticated; document the two
  bundled MCP servers.
- agents/code-implementer.md: frontmatter restricted to
  read/edit/glob/grep/list (allow); bash, task, external_directory,
  webfetch all deny. Body step 2.5 stops instructing self-test;
  output JSON gains a shell_requests array (RC-5, RC-6).
- agents/orchestrator.md: Universal rules gain a shell execution
  protocol that consumes shell_requests, runs them, and re-dispatches
  the implementer with results. The orchestrator owns all shell and
  git during implementation.
- CHANGELOG.md: add Unreleased section documenting both commits.
- AGENTS.md §5.1 / §6 / §7 / §8: codify the new per-agent permission
  conventions, the shell-execution boundary, and the resolved TD-7.
- orchestrator.md: invert external_directory rule order (was no-op:
  glob exception came before catch-all); add Shell execution protocol
  step 0 that pre-checks shell_requests for git commands and refuses
  them; validate shell_requests schema_version 1; document timeout
  guidance for slow builds.
- code-implementer.md: rewrite the Constraints section that still
  referenced the old edit: ask and bash git allowlist; add
  schema_version: 1 to the shell_requests JSON example; document
  timeout guidance.
- architect.md: document a growing URL allowlist in Research mode
  (advisory — opencode schema forbids object-form for webfetch at the
  agent level); add urls_fetched to the Mode B output JSON for user
  review; tighten bash allowlist to two-form (git log / git log *)
  to avoid matching git login / git logs.
- security-auditor.md: same two-form bash allowlist tightening with a
  comment explaining the tree-sitter split assumption.
- deploy.sh: add read_bundled_mcp helper that returns the bundled
  mcp: block (without headers.Authorization, never propagating API
  keys); extend patch_global_config to merge the bundled MCP servers
  into the user's opencode.jsonc on install. The eight CodeGraph
  commands and the codegraph subagent are now reachable after install
  without a per-project workaround.
- AGENTS.md §8: closure note that the original item 1 (Context7
  placeholder) was resolved in commit 302c463.
- README.md §Quick start: command -v codegraph verification note for
  the MCP server requirement.
- CHANGELOG.md: second Fixed + Changed blocks under [Unreleased]
  documenting each review-driven fix.
MillasAgent commented 2026-08-22 23:02:25 +00:00
Author
Owner
Copy link

Follow-up to the review fixes commit. The previous commit removed the Context7 "api key" placeholder entirely; per maintainer feedback, the placeholder served as documentation showing where and how to add a real key. Restored as a // commented example in workspace/opencode/opencode.jsonc (using the correct CONTEXT7_API_KEY header — not Authorization, which is the REST API format). The line is not active, so unauthenticated mode still works at default rate limits. README §Quick start updated to point at the example.

Follow-up to the review fixes commit. The previous commit removed the Context7 `"api key"` placeholder entirely; per maintainer feedback, the placeholder served as documentation showing where and how to add a real key. Restored as a `//` commented example in `workspace/opencode/opencode.jsonc` (using the correct `CONTEXT7_API_KEY` header — not `Authorization`, which is the REST API format). The line is not active, so unauthenticated mode still works at default rate limits. README §Quick start updated to point at the example.
- workspace/opencode/opencode.jsonc: the previous commit removed the
  literal 'Authorization: api key' line entirely. That was an
  over-correction: the placeholder served as documentation showing
  users exactly where and how to add a real Context7 key. Restored
  it as a // commented example using the correct CONTEXT7_API_KEY
  header (not Authorization, which is the REST API format). The line
  is not active, so unauthenticated mode still works at default rate
  limits; the user can uncomment and add a trailing comma to
  activate with a real key.
- README.md §Quick start: paragraph updated to point at the
  commented example instead of describing a missing line.
- CHANGELOG.md: bullet added to the second ### Fixed block under
  [Unreleased] documenting the over-correction and the new state.
- AGENTS.md §7: TD-7 row updated to reflect that the placeholder is
  now a documented commented example (not removed, not active).
MillasAgent deleted branch fix/agent-permissions-and-tools 2026-08-22 23:08:33 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
MillasDev/memory!2
No description provided.