Repository navigation
Daemon: the opinions that leaked in move out to clients - #447
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0451c1b9aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1bae543 to
8618d15
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1bae5437bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eb96cf9270
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- The daemon no longer names the terminals Sonny runs in: the CLI that starts it leaves TERMINAL_PLACES (Rex, tmux, Herdr, cmux) out of tool shells through --shell-exclude. - Tool output is redacted only of the credentials the daemon holds; what else counts as a secret is a client's judgement. - The summarizer request states its byte bound without style advice, and the shell and wait descriptions state facts without advice or CLI flags. - delivery is a required submit field; the CLI and Sonny always send it. - A turn's model-call bound is the bot's max_rounds setting (--max-rounds), unbounded when unset, in place of a fixed 200. - The CLI preamble is runtime facts again; workflow rules live in Sonny's role files (#440). - src/AGENTS.md states the rule, and tests/daemon_knows_no_client.rs fails on a client, terminal or tool name in daemon source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P
…immed text Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P
… files keep the preamble's workflow lines - serve --redact-field NAME and --redact-block LABEL have the daemon redact those values from tool output; the CLI that starts it passes agent_client::SECRET_FIELDS and PRIVATE KEY, so redaction is as before. - task.md keeps the reviewer rule and the detach and wait-loop advice the tool descriptions dropped; lead.md asks a fork before steering. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P
…duplicates Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P
The CLI passes --redact-field once per name, which serve refused as given twice, so a daemon the CLI started exited before it served. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P
8a80a03 to
40dc64e
Compare
Requested by George · project thread
What
George asked whether opinions had leaked into the daemon, and if so to remove or rework them. The audit found ten; this PR fixes the ones that move cleanly out to clients. The approver move (item 10) and the sandbox's protected names (item 2) follow as their own PRs. Item 7 (prompts passed to providers verbatim) stays as it is, because Codex does the same.
REX_*,TMUX*,HERDR_*orCMUX_*from tool shells itself.agent_client::TERMINAL_PLACESlists them, and the CLI that starts the daemon passes each one as--shell-exclude, the same way as the[shell_environment_policy]excludes from Tool shells: Codex's opt-in shell environment excludes #412. Companions still inherit them.serve --redact-field NAMEand--redact-block LABEL. The CLI passesagent_client::SECRET_FIELDS(main's list) andPRIVATE KEY, so redaction behaves as it did before (George's pick).deliveryis required on submit (item 6). The daemon no longer picksrejectfor the caller. A submit without it getsinvalid_delivery, with the valid names in its facts. The CLI defaults toAGENT_DELIVERY, thenreject. Sonny sendsqueue,steerorrejectitself. PROTOCOL stays at 24, and docs/RUST_PROTOTYPE.md's "Protocol version 24" paragraph notes that delivery is required.MAX_ROUNDS = 200becomes the bot'smax_roundssetting (--max-rounds), unbounded when unset.0is refused.tests/daemon_knows_no_client.rsfails when daemon source outside the CLI's own files names a client, terminal or tool (Sonny, Herdr, cmux, tmux, Rex, lookout); tests may still name them.Tests and bench drivers send
delivery. The Python socket clients default it toreject. Tests that count 200 rounds setmax_rounds: 200.Speed and lightness
Nothing new runs on a turn's path. Redaction does the same work as on main, with the names read from the daemon's start flags instead of a constant. The round bound is read from settings the turn already holds. The terminal excludes reuse the
--shell-excludelist the daemon already applies when it spawns a shell. There is no new store work per turn.Checks
cargo test --workspace,cargo clippy --workspace --all-targets -D warnings,cargo fmt --check🤖 Generated with Claude Code
https://claude.ai/code/session_013jkdGCtBZA4DWhW2khSZ4P