feat: ENABLE_<CLI> toggles + default-deny for Gemini, OpenCode, Hermes#30
Open
feat: ENABLE_<CLI> toggles + default-deny for Gemini, OpenCode, Hermes#30
Conversation
Introduce per-CLI install toggles for Codex, OpenCode, Gemini, Hermes
(replicating the existing ENABLE_HERMES pattern across the other three
secondary CLIs), and default the three less-vetted CLIs to OFF.
Security posture rationale (the substantive change vs. the original
"toggles only" PR): the App container holds the rotated workspace PAT
(~/.databrickscfg, written by pat_rotator.py) and all repos under
~/projects/, so any process that runs there has effective full
workspace access. That makes the supply-chain bar for runtime CLIs
higher than for a local dev tool. Claude Code (Anthropic) and Codex
(OpenAI) ship from vendors with mature signing / SBOM / advisory
pipelines and stay enabled by default. Gemini, OpenCode, and Hermes
don't have equivalent supply-chain processes; they become opt-in.
Operators flip ENABLE_<CLI>=true in app.yaml to install them.
Note that this changes the default user experience: a fresh deploy
ships with two CLIs (Claude, Codex) instead of five. Operators who
want the previous behaviour can flip the three toggles back in their
own app.yaml override.
Mechanics:
- 4-line gate at the top of each setup_*.py: read env var, exit 0 if false
- app.yaml documents all four toggles in one comment block
Claude Code stays always-on — it's the primary CLI and setup_claude.py
also creates ~/projects and writes app-wide MCP config that other agents
can re-use. Disentangling those would expand scope; can be a follow-up.
Smoke-tested locally:
$ ENABLE_CODEX=false python3 setup_codex.py
ENABLE_CODEX=false — skipping Codex CLI setup
$ # exit 0, no further side effects
Follow-ups (out of scope):
- Flip the Python-level defaults to "false" too, so a missing app.yaml
also fails-closed. Currently each setup_*.py reads
os.environ.get("ENABLE_X", "true") which is a fail-open default.
- Add an audit GH Action equivalent for the still-enabled CLIs against
npm advisories (Codex's @openai/codex via dependency-audit.yml is
already covered).
Co-authored-by: Isaac
dgokeeffe
force-pushed
the
feat/cli-toggles
branch
from
8d44956 to
513193f
Compare
dgokeeffe
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduce per-CLI install toggles (
ENABLE_CODEX,ENABLE_OPENCODE,ENABLE_GEMINI, mirroring the existingENABLE_HERMES), and default Gemini, OpenCode, and Hermes to OFF. A fresh CoDA deploy now ships with two CLIs running by default — Claude Code and Codex.Security posture rationale
The App container holds the rotated workspace PAT (
~/.databrickscfg, written bypat_rotator.pyevery 10 min) and the user's repos under~/projects/. Any process that runs in there has effective full workspace access. That puts a higher bar on "what installs by default" than for local dev tools.Operators who want the previous five-CLI experience flip the three toggles back to
"true"in their own app.yaml override.Behavioural change for existing deploys
Operators upgrading to this version see Gemini/OpenCode/Hermes disappear unless they explicitly opt in. This is intentional — see rationale above — but worth calling out to reviewers as the substantive UX delta.
Mechanics
setup_*.py: read env var, exit 0 if false. Exact pattern reusessetup_hermes.py's existing structure.app.yamldocuments all four toggles in one comment block.setup_claude.pyis intentionally not gated — it bootstraps~/projects/and writes app-wide MCP config that the other CLIs reuse.Test plan
app.yaml, setENABLE_GEMINI=true, redeploy; confirm Gemini installsENABLE_OPENCODE=trueandENABLE_HERMES=truepytest tests/— toggle-introduction tests should still passFollow-ups (out of scope for this PR)
"false"too, so a missingapp.yamlalso fails-closed. Currently eachsetup_*.pyreadsos.environ.get("ENABLE_X", "true")which is fail-open if app.yaml is absent.@openai/codexis already independency-audit.yml; Claude Code is installed via curl so out of npm-audit scope).This pull request and its description were written by Isaac.