From 07dc085f201c1433cab32f76353d8708ce59e8db Mon Sep 17 00:00:00 2001 From: Gary Basin Date: Thu, 16 Jul 2026 16:02:16 -0400 Subject: [PATCH] fix(preview): let the atrium-preview tool actually install in sandboxes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #547 shipped the tool, but no sandbox could see it: values.local.yaml sets TOOL_ALLOWLIST: "none" to hide the ~78 upstream plugins, and install_tool_shims skips every tool not on the list. Verified in a live prod sandbox mid-turn: command -v atrium-preview -> MISSING centaur-tools list | preview -> NOT-IN-CATALOG echo $TOOL_ALLOWLIST -> none That file's own comment called this shot: "When a tool is actually wired up (creds granted + deps installable), list its package name here." It now is — the token is in centaur-infra-env and iron-proxy injects it — so list it. The matched name is the tool's DIRECTORY name, not pyproject's [project] name (install_tool_shims.py: tool_name = package_dir.name). Both are atrium-preview here, but the comment now says which one it is so the next tool doesn't guess. Only reachable by running a real turn on prod: CI never installs tool shims, and the tool builds, lints, and passes its own tests regardless of this env var. --- infra/values.local.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/infra/values.local.yaml b/infra/values.local.yaml index 7f21adfb..d54d57ec 100644 --- a/infra/values.local.yaml +++ b/infra/values.local.yaml @@ -46,8 +46,9 @@ sandbox: # turns on `vmetrics`/`cloudwatch`). An EMPTY value means "install all" # (upstream backward compat), so use a no-match placeholder. When a tool is # actually wired up (creds granted + deps installable), list its package - # name here, comma-separated. - TOOL_ALLOWLIST: "none" + # name here, comma-separated. The name matched is the tool's DIRECTORY name + # under centaur/tools (install_tool_shims.py compares package_dir.name). + TOOL_ALLOWLIST: "atrium-preview" # To surface Codex's live "thinking" in the transcript, set # CODEX_MODEL_REASONING_SUMMARY: "auto" here (Codex >= 0.139 emits no summaries # by default; consumed by services/sandbox/entrypoint.sh). Left off for now — the