Fix hosted versus local MCP access boundaries - #1617
Merged
Conversation
Remove repository-driven hosted MCP registration and the unnecessary Railway CLI Cloud install. Add a shell-only GitHub fallback preflight and document the fresh hosted-app acceptance boundary.
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Contributor
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in:45 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR updates Codex Cloud hosted-access policy, removes Railway CLI and committed hosted MCP setup from validation, adds stricter raw-environment checks, adds a GitHub shell-access checker, and records the resulting acceptance state in documentation. ChangesCodex Cloud hosted access and validation
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Comment |
BigSimmo
marked this pull request as ready for review
August 5, 2026 09:39
Document the exact connected-task evidence, persistent launcher variable, absent hosted tools, and design-only OAuth gateway fallback.
BigSimmo
marked this pull request as draft
August 5, 2026 09:48
Document the split provider control plane and keep raw launcher leaks fail-closed. Add sanitized capability-route output and focused contract coverage.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Require an explicit opt-in before live gh API calls, label Personal Pro as a documented assumption, reject any non-comment MCP generation in Cloud setup, and resolve the entry-point path the same way as other scripts. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo
commented
Aug 5, 2026
OwnerAuthor
Review findings disposition ( |
| Finding | Disposition |
|---|---|
| Live GitHub API calls with no confirmation guard | fixed — fails closed unless --allow-provider or ALLOW_GITHUB_SHELL_ACCESS=true; --self-test offline |
Entry-point symlink/argv[1] mismatch | fixed — uses path.resolve(process.argv[1]) |
hosted_workspace.class reported as measured fact | fixed — now hosted_workspace.class_documented= |
Anti-MCP guard only matched printf | fixed — rejects any non-comment mcp_servers. content |
Railway vs *_cloud naming inconsistency | documented — intentional so codex mcp login railway matches the entry name |
| Stale connected MCP blocks on re-run | already correct — prior *_connected tables lived inside the managed BEGIN/END markers, which setup still strips |
Proof:GITHUB_SHELL_ACCESS_SELF_TEST=PASS; unconfirmed live call exits 1; npx vitest run tests/codex-cloud-setup.test.ts → 20 passed; npm run check:codex-cloud → PASS.
BigSimmo
marked this pull request as ready for review
August 5, 2026 12:05
Name-scope the raw-env OPENAI_BASE_URL allowance in the probe, make check:github-shell-access offline by default with a :live opt-in, align Railway MCP docs/indexing, and harden the Cloud setup/static contracts. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Contributor
Review findings disposition ( |
| Finding | Disposition |
|---|---|
| Raw-env prose allowed continue after any FAIL | fixed — probe now name-scopes OPENAI_BASE_URL only (FAIL-KNOWN/exit 2); any other inherited provider name is FAIL+STOP/exit 1 |
Railway MCP default-read-path still said root .mcp.json only | fixed — docs/agents-guide.md row now separates Desktop/CLI MCP from hosted ChatGPT/Codex app path |
Anti-MCP comment guard was full-line/mcp_servers. only | fixed — strips trailing # comments and rejects any non-comment mcp_servers token; behavioural generated-config test remains stronger proof |
| Runtime acceptance dropped Railway CLI checks | documented — intentional for hosted OAuth-app path; comment in validateCodexCloudRuntime notes when to re-add |
| New audit not individually indexed | fixed — listed in docs/README.md |
railway vs *_cloud naming | documented / no change — intentional so codex mcp login railway matches the entry name |
check:github-shell-access fails by default | fixed — plain script is offline --self-test; live path is check:github-shell-access:live |
| Stale connected MCP blocks on re-run | already correct — managed BEGIN/END markers still strip prior *_connected tables |
| Live GitHub API calls without confirmation | already fixed + tightened — fail-closed opt-in retained; default npm entry no longer provider-backed |
hosted_workspace.class reported as measured fact | already fixed — remains hosted_workspace.class_documented= |
Entry-point symlink/argv[1] mismatch | fixed — uses realpathSync on both paths |
Proof:npm run check:github-shell-access → GITHUB_SHELL_ACCESS_SELF_TEST=PASS; raw-env exits 0/2/1 for clean / OPENAI_BASE_URL-only / unexpected names; npm run check:codex-cloud → PASS; node scripts/run-vitest.mjs run tests/codex-cloud-setup.test.ts → 21 passed; docs index/inventory/scripts/links checks passed.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
10 tasks
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
BigSimmo pushed a commit
that referenced
this pull request
Aug 5, 2026
…ote-container browser gate drift
- Honor GitHub shell-access opt-in over --self-test so live confirmation is never a silent stub - Clarify live vs offline GitHub preflight docs and acceptance notes - Warn that OPENAI_BASE_URL CONTINUE-RESTRICTED still forbids raw-parent/shim-bypass OpenAI calls - Tighten MCP text-guard residual notes and connected-setup assertions Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo
commented
Aug 5, 2026
OwnerAuthor
Review findings disposition ( |
| Finding | Disposition |
|---|---|
| GitHub shell-access opt-in silently ran offline stub | fixed differently — opt-in now overrides --self-test; docs/acceptance note clarified |
OPENAI_BASE_URL CONTINUE-RESTRICTED residual redirect risk | fixed differently — kept intentional Personal Pro path; probe + docs warn against raw-parent/shim-bypass OpenAI calls |
| MCP comment-stripping guard residual weaknesses | documented — text-level limits noted in checker; connected-setup assertion tightened (mcp_servers absent) |
| Runtime acceptance dropped Railway CLI checks | no change — intentional for hosted OAuth-app path; re-add only if CLI token auth returns |
railway MCP rename complete | no change — intentional alignment with .mcp.json / codex mcp login railway |
| Generated docs counts / script refs | no change — already verified locally |
| Stale connected MCP blocks cleaned on re-run | no change — already correct via managed BEGIN/END markers |
| Railway CLI removal vs env-parity Cloud assumption | no change — docs/codex-cloud.md already requires separate CLI install for approved operator workflows |
Proof:npm run check:github-shell-access → GITHUB_SHELL_ACCESS_SELF_TEST=PASS; clean-env raw probe exit 0 / OPENAI_BASE_URL-only exit 2 with redirect warning; node scripts/check-codex-cloud-setup.mjs → PASS; npm run test -- tests/codex-cloud-setup.test.ts → 21 passed.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Keep GitHub shell --self-test offline regardless of ambient opt-in, document local-only Railway MCP enable ($CODEX_HOME / never-committed), and pin managed MCP cleanup plus exit-2 / CLI operator caveats. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
… into codex/cloud-mcp-hosted-boundary
Contributor
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
… into codex/cloud-mcp-hosted-boundary
8 tasks
Uh oh!
There was an error while loading. Please reload this page.
3 tasks
cursorBot
pushed a commit
that referenced
this pull request
Aug 5, 2026
* fix(gates): catch lint and type errors before push, not in CI Two open PRs burned full CI cycles this week on defects a single local command would have caught: #1606 on a react-hooks/set-state-in-effect lint error, #1618 on a TS2339 for `mode.devOnly` (a union member that lacks the property, where app-modes.ts already exports the correct `"devOnly" in mode` guard). Neither lint nor typecheck was in the pre-push path. Typecheck could not simply be added, because it was already unusable (outstanding-issues #210). tsconfig.json's `include` carries `.next/types/**/*.ts` and `.next/dev/types/**/*.ts` — gitignored build artifacts — so deleting a page leaves the stale generated validator importing a removed module. Reproduced rather than inferred: a planted `.next/dev/types/validator.ts` referencing a removed mockup page yields `error TS2307: Cannot find module .../mockups/deleted-mockup-route/page.js`, base config exit 2, source-only config exit 0. Full source typecheck is clean (71s cold, 8.8s warm). Red locally and green in CI is how the gate got abandoned, which is how the real type error then reached CI. - tsconfig.typecheck.json + `typecheck:source`: identical compiler options, minus the `.next` globs, with a separate tsbuildinfo so the two incremental caches cannot invalidate each other. Route-signature validation is not lost; `next build` still covers it in CI. - guard-push.mjs gains a fourth guard running eslint over the pushed files and this typecheck. Verified to reproduce both defects above with CI-identical messages. Scoped to the lint roots and to pushes that touch TS, skips loudly when node_modules is absent rather than pushing people to GUARD_PUSH_DISABLE=1, and overridable with SKIP_STATIC_GUARD=1. Also corrects a doc claim that made #1580 surprising: "mockups are exempt" was being read as blanket. Mockups are exempt from the wiring and reachability gates and nothing else — they are still typechecked, and their client chunks still count toward check:bundle-budget, which totals every built chunk rather than the initial production bundle. That the budget's scope contradicts ledger #13's "not an initial production bundle" position is a real unmade decision, now recorded as #237 rather than papered over. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T97Kqdj9Xh1Cubv5ms3KVy * docs(issues): capture the phone Category soft-menu fix salvaged from PR #1606#1606 is closed, but it carried the one fix nothing else in the queue provides: MobileResultFilterControl's native <select> paints a harsh system-blue highlight on phones, and #1615 keeps that native select (its change is the iOS 16px anti-zoom rule). So the fix does not survive #1615 landing. Records it as #238 with the two defects the redo must not repeat: the unresolved keyboard trap on disabled options, and the set-state-in-effect lint error that PR #1620's new pre-push guard would now catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T97Kqdj9Xh1Cubv5ms3KVy * issues: capture #239 stale Cloud acceptance pin on PR #1617, #240 remote-container browser gate drift * Tighten guard coordinator test Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix(gates): shared source-typecheck lease and safer static pre-push Treat typecheck:source:internal as a shared read-only coordinator lease with a distinct per-worktree buildinfo file, drop the pinned in-repo cache path, and harden staticGuard: acquire a short exclusive lease (fail-open when busy), use a private eslint cache, escalate lint on eslint policy changes, fail closed when the push tip is not HEAD, cover eslint-rules, and add Vitest coverage. Align hook/docs wording with the fourth guard and point CLAUDE.md at #252. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix(gates): keep tsBuildInfoFile when run-heavy has no npm_execpath Pre-push invokes run-heavy via plain node, so the npm_execpath spawn path was skipped and the fallback dropped effectiveForwarded — undoing the per-worktree buildinfo injection. Also warn when staticGuard passes on a dirty working tree. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: refresh scripts-index for lint:changed:internal Keep docs:check-inventory green after adding the pre-push eslint wrapper script to package.json. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix(gates): address Devin findings on static pre-push guard - Treat "Database focused-test capacity is full" as coordinator busy so shared typecheck slot exhaustion fails open instead of faking a type error. - Skip source typecheck when every changed .ts path is excluded by tsconfig.typecheck.json (edge functions, archive, scratch, worktrees). - Restore check-github-shell-access.mjs (and its Role notes) in the scripts index. * chore(ledger): record PR #1620 babysit * fix(gates): emit structured heavy-run admission-busy signal Prefer exit 75 + DATABASE_HEAVY_RUN_ADMISSION_BUSY over prose matching so tsc/eslint output that quotes busy strings cannot false-pass the static guard. * fix(gates): tip-check only when static work runs; isolate typecheck cache Addresses follow-up Devin on PR #1620: - Reorder staticGuard so tip-vs-HEAD fails closed only when lint/typecheck will actually read the working tree; ignore tag refs in the tip check. - Pin a distinct tsBuildInfoFile on tsconfig.typecheck.json so direct tsc does not collide with the base config cache (run-heavy still overrides). * fix(gates): keep lint failures when typecheck admission is busy Addresses Devin on PR #1620 — a prior eslint failure must still block the push if the follow-up source typecheck cannot get a coordinator slot. --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
4 tasks
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
codex mcp login railway.Why
Hosted ChatGPT/Codex does not register tools from
.mcp.json,.codex/config.toml, or container setup. The previous setup also installed Railway CLI even though hosted access comes from the OAuth app; that binary postinstall failed in a fresh Cloud task withENETUNREACH.The active workspace is Personal Pro. Codex settings offers GitHub, Slack, and Linear, but no Railway or Supabase connector control. The durable workaround uses Codex Cloud for repository/GitHub work and ChatGPT web for Railway and project-scoped read-only Supabase, without shared tokens.
Files and areas
Verification
node scripts/run-vitest.mjs run tests/codex-cloud-setup.test.ts— 1 file passed, 20 tests passed.npm run check:codex-cloud—[Codex Cloud Check] PASS: static Cloud contracts match.npm run check:github-shell-access -- --self-test—GITHUB_SHELL_ACCESS_SELF_TEST=PASS.npm run docs:check-scripts— 429 references resolved.npm run docs:check-index— all 50 roots/modules/routes covered.npm run docs:check-inventory— 214 script files, 223 npm scripts.npm run format— passed on the committed tree.git diff --check— passed.BigSimmo; GitHub, Slack, and Linear offered; Railway and Supabase absent.Clinical KB Database(sjrfecxgysukkwxsowpy) asACTIVE_HEALTHY; no row/schema/log call.oauth_refresh_token_missing;whoami,list-projects, andget-statusthen passed, with both production services reportingSUCCESS.task_e_6a7303bcdd988322bc979d5d2c0f946fpassed setup and all repository/runtime checks at76dfe85fa93787b3845d0bd460aa18ff753ca2ca, including verified base ancestry. A second independently provisioned task,task_e_6a7313d1364483228b7642cb942e674c, repeated those passes at7d485f88db391cc7e8e73c57ddbde61f532375fc. Both remain host-blocked: raw shell inherited theOPENAI_BASE_URLname after its UI removal, and neither task exposed Railway, GitHub, or Supabase tools.npm run verify:pr-local -- --files docs/audit/cloud-connection-acceptance-2026-08-05.md— passed the complete low-risk documentation plan, including runtime/lock parity, formatting, sitemap, docs index/inventory/scripts/links, ledger, and outstanding-issues guards.Checks not run
verify:pr-localattempt reached the full Vitest phase but exceeded the 10-minute command timeout and ended with timeout-inducedEPIPE; no assertion failure was observed before termination. It is partial evidence, not a pass. The final evidence-only documentation delta passed the complete focused PR-local gate.npm run check:docs-index, does not exist; the repository's actualnpm run docs:check-indexcommand passed.Safety and remaining controls
OPENAI_BASE_URLremains a fail-closed raw launcher defect. Generated profiles, shell policy, and command shims scrub it for normal repository commands without calling the raw boundary accepted.7144bc1c8ea599e6e419dbef3da1a9c4bbcd7fb4.RAG impact: no retrieval behaviour change — Cloud tooling and documentation only.
Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy) and read-onlySummary by CodeRabbit
Documentation
New Features
Bug Fixes