Repository navigation
feat(agents): deny six unused tools for Code, Fix and Refactor - #777
Merged
Merged
Conversation
Code, Fix and Refactor now deny Monitor, TaskStop, Workflow, Artifact, ListAgents and ReportFindings on top of the shared deny list, so they start and stop no other agent. Research keeps the shared list only. The frontmatter stays a deny list with no tools key. The guard gains a keep set (DENY_AGENT_KEEP) that no deny-list agent outside Harden and Polish may deny, a pin over all three Code-family slugs, row probes for each extra name, and body probes that run every extra name through the real collectors. The body-size ceilings of the three agents move to the measured size: the added bytes are frontmatter tool-list bytes, and no body text was cut. Refs #775
Record the Code-family extra deny list in the agent design guide. Mark the disallowedTools platform assumption as verified live, add Fix and Refactor to its drift text, and record the headless Bash timeout result. Update the tracker-servers comment to list the four deny-list agents. Refs #775
Name Code, Fix, Refactor and Research in the shared deny-list comment. Add the headless probe date to the date column of the Bash timeout row.
The ceiling guard measured the default and curation-off builds of each Code-family variant only. The tdd-off and curation-tdd-off builds of Code had no guard, and the tdd-off build was already 8 bytes over the Code ceiling. Each build now has its own ceiling at its measured size, and an absent build fails the guard instead of skipping it. Both ceilings are registered in the numeric floor manifest with old value, new value and reason. The code-body-max description said a later addition funds itself with a cut, but the same entry records a raise that no cut paid for. The text now matches the either-way rule.
The text said Code, Fix and Refactor deny six tools so they start and stop no other agent. That is false for Monitor, Artifact and ReportFindings. The text now says no path of these agents uses the six tools: they run commands in the foreground, start and message no agent, publish no page and report no review findings. Task: resolve-batch-b
The deny-extra comment gave a false reason for all six denied names. It now gives one true reason for each pair of names. The keep-set comment said the set leaves out WebFetch and WebSearch, but the set lists both. The comment now matches the set. Comment text only. Task: resolve-batch-b
The test-harness goldens and budgets KB said ceilings only fall and a ceiling rises only on maintainer authorisation. The repo rule is that a floor or ceiling may move either way, and its description and the PR give the old value, the new value and the reason. The KB now states that rule. The Recorded Exceptions rows stay as history. The file is shorter than before. Task: resolve-batch-b
Owner
Author
Review and test evidence (head 5dba1e4)Code review, cycle 1 (at cf08334)Result: APPROVED. Gate level lean (security, testing, reliability). Blocking: 0. Should-Fix: 1 MEDIUM. Pre-existing: 0. Suggestions: 5. The change removes tool access from the Code, Fix and Refactor agents. It adds no tool access. Resolve (cycle 1)9 issues: 5 fixed, 4 deferred, 0 false positive, 0 duplicate. The 9 issues are the review findings plus two text corrections.
Deferred (LOW, not in this PR): a check of the Code-family frontmatter in the feature-off builds; a drift symptom for the ToolSearch row; a follow-up number for the headless-timeout row; a name-shape check for the tool vocabulary. New ceilings (old value, new value, reason):
Evidence
Merge readiness: waits for an approving review and the PR body update. CI and threads are clear. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Code, Fix and Refactor start with six tools that no Code path uses. Each start uses tokens for these tools. This change adds the six tools to the deny-list of these agents.
Changes
disallowedTools). The agents keep Skill, ToolSearch, web tools and every user MCP tool.code-body-max: 9,657 to 9,742fix-body-max: 7,266 to 7,351refactor-body-max: 5,952 to 6,037code-body-tdd-off-max: none to 9,750code-body-curation-tdd-off-max: none to 9,398Why a Deny-List
The issue asks for an allow-list. This change does not use one. An allow-list removes the user's MCP and web tools. The scan step and the compliance load need those tools.
The
tools:key names MCP tools per server (mcp__<server>). No entry keeps all user MCP tools.The issue measured 26.6 percent with a six-tool allow-list. That list is not used, for the reason above.
Breaking Changes
None expected.
Testing
Validation: the full build and suite pass at
5dba1e40. Result: 408 files, 19,215 tests passed, 8 skipped.Headless measure
claude -p, no MCP server.An interactive host saves more, because the Artifact tool reaches subagents there.
Shipped-file check
One headless spawn each of the built Code agent from
mainand from this branch. Only the name line of each file was changed.5dba1e40): 23,403 start tokens.claude -p, no MCP server. Each spawn replied "OK" through its one hand-back call and made no other tool call.Known Limits
Related Issues
Closes #775