[aidan-sims]

Owner: Aidan Sims

The codex and opencode agents had no way to turn off their CLI's own tools, so a task that needs strict no-tools (FDE-2584) still offered shell, edit and similar tools to the model. Both agents now accept a builtin_tools selection ({"disable": "*" | [...]} or {"only": [...]}) in their agent config, as claude_code already does. With no selection, the config and argv stay exactly as before.

• opencode: the selection becomes opencode's permission config. disable: "*" and only deny "*" but still allow agent-env's MCP tools (<server>_*) and the CLI's two non-tool checks (external_directory, doom_loop). Without them, MCP tools disappear and kept file tools refuse paths outside the workspace.
• codex: the selection becomes -c overrides added after the role overrides (for example features.shell_tool=false). Codex turns some tools on and off together, so a list must name a whole group (for example exec_command with write_stdin), otherwise it is rejected.
• codex apply_patch: no setting turns it off; each GPT model's catalog entry offers it. When a selection drops it, the agent writes a copy of the CLI's own catalog (codex debug models --bundled, or the model_catalog_json config.toml names) with apply_patch_tool_type: null and passes it with -c model_catalog_json=.... The copy is made from the installed CLI, so it follows the pinned version. If the catalog can't be read, the turn fails instead of keeping the tool.
• Each card's agent-config schema lists the tool names as an enum, so deploy_agent accepts a selection.

Validation: pytest tst/unit/agents/opencode tst/unit/agents/codex tst/unit/task_step/test_verify_a2a_builtin_tools.py tst/unit/agents/claude_code gives 592 passed and 39 skipped, and the new tests fail on main. ruff check is clean on the touched files. ruff format --check fails on them, and the files weren't reformatted. With the pinned CLIs (opencode-ai 1.17.18, codex 0.147.0) and a local fake model, opencode under disable: "*" offers only the MCP tool, and codex on gpt-5.4 offers no tools (only its MCP tools when an MCP server is configured).

Not in this PR:

• A run of either agent image (the pinned CLIs were run directly instead).
• The ticket's AC2 expects exactly {"*": "deny"}. This PR adds the allows above so agent-env's MCP tools stay available.
• The ticket's AC3 expects per-tool lists for codex. Grouped tools must be listed together instead.
• Publishing new hub agent versions (done separately by Env Pod after release).

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge, with no new actionable findings.

Summary

Adds builtin_tools selections to the Codex and OpenCode agents while preserving their default behavior and MCP tools.

• Codex turns agent tool selections into per-turn CLI settings.
• OpenCode agent settings can narrow the tools a turn receives.

There are no changes since the previous reviewed revision. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A["Agent config: builtin_tools"] --> B{"Agent"}
  B -->|OpenCode| C["Build permission rules"]
  C --> D["Run OpenCode with MCP tools preserved"]
  B -->|Codex| E["Build tool settings"]
  E --> F{"Remove apply_patch?"}
  F -->|Yes| G["Copy catalog with apply_patch disabled"]
  F -->|No| H["Run Codex"]
  G --> H

Loading

_{Reviews (3) · Last reviewed commit: "ci: retrigger Integration Tests" · Reviewed by Greptile}