Skip to content

Enforce Agent Plugin runtime boundaries - #37027

Merged
copyberry[bot] merged 1 commit into
mainfrom
copyberry/codex-internal-to-codex-oss/c9af66b051269f3226628ca280a58d32c808c38f
Aug 5, 2026
Merged

Enforce Agent Plugin runtime boundaries#37027
copyberry[bot] merged 1 commit into
mainfrom
copyberry/codex-internal-to-codex-oss/c9af66b051269f3226628ca280a58d32c808c38f

Conversation

@copyberry

@copyberry copyberry Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Enforce Agent Plugin runtime boundaries

What changed

  • Track Agent Plugin manifests through plugin, skill, and MCP loading so their capabilities use format-specific behavior without changing legacy plugins.
  • Discover only direct-child skills, exclude app and hook capabilities, isolate MCP data, and reject MCP configuration files that are non-regular or resolve outside the plugin root.
  • Bound model-visible skill instructions, plugin instructions, MCP descriptions, schemas, individual tools, and the aggregate Agent Plugin MCP tool set.
  • Stop MCP and OAuth redirects when Agent Plugins send configured or authorization headers, while retaining existing redirect behavior for legacy MCP servers.

Testing

  • Add coverage for capability filtering, skill discovery, isolated MCP data and reserved-path expansion, unsafe MCP configuration files, context limits, and redirect handling.
@jacobzhou-oai copyberry
Enforce Agent Plugin runtime boundaries (#37027)
56b82e6 
## What changed

- Track Agent Plugin manifests through plugin, skill, and MCP loading so their capabilities use format-specific behavior without changing legacy plugins.
- Discover only direct-child skills, exclude app and hook capabilities, isolate MCP data, and reject MCP configuration files that are non-regular or resolve outside the plugin root.
- Bound model-visible skill instructions, plugin instructions, MCP descriptions, schemas, individual tools, and the aggregate Agent Plugin MCP tool set.
- Stop MCP and OAuth redirects when Agent Plugins send configured or authorization headers, while retaining existing redirect behavior for legacy MCP servers.

## Testing

- Add coverage for capability filtering, skill discovery, isolated MCP data and reserved-path expansion, unsafe MCP configuration files, context limits, and redirect handling.

GitOrigin-RevId: c9af66b051269f3226628ca280a58d32c808c38f
@copyberry
copyberry Bot force-pushed the copyberry/codex-internal-to-codex-oss/c9af66b051269f3226628ca280a58d32c808c38f branch from dd979fa to 56b82e6 Compare August 5, 2026 04:55
@copyberry
copyberry Bot merged commit 56b82e6 into main Aug 5, 2026
25 of 32 checks passed
@copyberry
copyberry Bot deleted the copyberry/codex-internal-to-codex-oss/c9af66b051269f3226628ca280a58d32c808c38f branch August 5, 2026 04:56
@github-actions github-actions Bot locked and limited conversation to collaborators Aug 5, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

3 participants

@kennyzheng-builds @Ahmedmabdallah484 @jacobzhou-oai