From 855ec0cdc33ed0f888a3d6ca68fc0eaf95461f24 Mon Sep 17 00:00:00 2001 From: hermes Date: Fri, 16 Oct 2026 06:50:29 +0000 Subject: [PATCH] test(agents): opencode answers only through the idx tools opencode kept its built-in tools, so it could route around the server under test: on published 0.3.1 it answered a quote from web search, and on the live `changes` case it queried the ownership SQLite file with bash and timed out. Deny every tool but `idx_*`, as Claude, pi, and Hermes already are. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh --- docs/SMOKE.md | 5 +++-- tests/agents/agent-smoke.sh | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/SMOKE.md b/docs/SMOKE.md index 682b791..4035634 100644 --- a/docs/SMOKE.md +++ b/docs/SMOKE.md @@ -106,8 +106,9 @@ each run keeps a copy next to its output as `..mcp-stderr`. output but still deletes every copied agent config. - Tools are auto-approved for the run (Claude `dontAsk` with `mcp__idx__*`, Codex `default_tools_approval_mode="approve"`); Claude and pi - also get no built-in tools, and Hermes only the `idx` toolset, so they - can only answer through MCP. + also get no built-in tools, Hermes only the `idx` toolset, and opencode a + permission that denies everything but `idx_*`, so they can only answer + through MCP. - `IDX_AGENT_MODEL_` picks a model (for example `IDX_AGENT_MODEL_CLAUDE=sonnet`). `IDX_AGENT_EXEC_PREFIX` prefixes every agent command, for hosts that inject API keys through a wrapper. diff --git a/tests/agents/agent-smoke.sh b/tests/agents/agent-smoke.sh index 7fca924..55472f6 100755 --- a/tests/agents/agent-smoke.sh +++ b/tests/agents/agent-smoke.sh @@ -276,7 +276,8 @@ setup_opencode() { mkdir -p "$work/opencode/cwd" jq -n --argjson s "$server_json" \ '{"$schema": "https://opencode.ai/config.json", - mcp: {idx: {type: "local", command: ([$s.command] + $s.args), environment: $s.env, enabled: true}}}' \ + mcp: {idx: {type: "local", command: ([$s.command] + $s.args), environment: $s.env, enabled: true}}, + permission: {"*": "deny", "idx_*": "allow"}}' \ > "$work/opencode/cwd/opencode.json" } run_opencode() {