`51bdf4d`

Remove workspace boundary from read-only tools (read, glob, grep)

Authored by

espadonne 1 month ago

Status	File	+	-
M	`src/loader/tools/file_tools.py`	4	6
M	`src/loader/tools/search_tools.py`	2	3
M	`tests/test_tool_safety.py`	6	6
M	`tests/test_turn_iteration.py`	2	2

src/loader/tools/file_tools.pymodified

          **kwargs: Any,
      ) -> ToolResult:
          try:
 +            # Reads are safe — don't enforce workspace boundary
              path = resolve_workspace_path(
                  file_path,
 -                workspace_root=self.workspace_root,
 +                workspace_root=None,
+             )
          except FileNotFoundError:
              return ToolResult(f"File not found: {file_path}", is_error=True)
 -        except PermissionError as exc:
 -            return ToolResult(f"Permission denied: {exc}", is_error=True)
          except Exception as exc:
              return ToolResult(f"Error resolving file path: {exc}", is_error=True)
          **kwargs: Any,
      ) -> ToolResult:
          try:
 +            # Glob is read-only — don't enforce workspace boundary
              base_path = resolve_workspace_path(
                  path,
 -                workspace_root=self.workspace_root,
 +                workspace_root=None,
+             )
          except FileNotFoundError:
              return ToolResult(f"Directory not found: {path}", is_error=True)
 -        except PermissionError as exc:
 -            return ToolResult(f"Permission denied: {exc}", is_error=True)
          except Exception as exc:
              return ToolResult(f"Error resolving directory: {exc}", is_error=True)

src/loader/tools/search_tools.pymodified

          **kwargs: Any,
      ) -> ToolResult:
          try:
 +            # Grep is read-only — don't enforce workspace boundary
              base_path = resolve_workspace_path(
                  path,
 -                workspace_root=self.workspace_root,
 +                workspace_root=None,
+             )
          except FileNotFoundError:
              return ToolResult(f"Path not found: {path}", is_error=True)
 -        except PermissionError as exc:
 -            return ToolResult(f"Permission denied: {exc}", is_error=True)
          except Exception as exc:
              return ToolResult(f"Error resolving search path: {exc}", is_error=True)

tests/test_tool_safety.pymodified

  @pytest.mark.asyncio
 -async def test_read_tool_blocks_symlink_escape(temp_dir: Path) -> None:
 +async def test_read_tool_allows_outside_workspace(temp_dir: Path) -> None:
 +    """Reads are safe and should not enforce workspace boundaries."""
      outside = temp_dir.parent / "outside.txt"
      outside.write_text("outside\n")
 -    inside_link = temp_dir / "escape.txt"
 -    inside_link.symlink_to(outside)
      tool = ReadTool(workspace_root=temp_dir)
 -    result = await tool.execute(file_path=str(inside_link))
 +    result = await tool.execute(file_path=str(outside))
 -    assert result.is_error
 -    assert "workspace boundary" in result.output.lower()
 +    assert not result.is_error
 +    assert "outside" in result.output
 +    outside.unlink()
  @pytest.mark.asyncio

tests/test_turn_iteration.pymodified

                      ToolCall(
                          id="read-1",
                          name="read",
 -                        arguments={"file_path": "README.md"},
 +                        arguments={"file_path": str(readme)},
+                     )
                  ],
+             )
+     )
      assert decision.action == TurnIterationAction.CONTINUE
 -    assert decision.new_actions_taken == ["read: {'file_path': 'README.md'}"]
 +    assert decision.new_actions_taken == [f"read: {{'file_path': '{readme}'}}"]
      assert prepared.summary.assistant_messages[-1].tool_calls[0].name == "read"
      assert len(prepared.summary.tool_result_messages) == 1
      assert "Loader runtime notes" in prepared.summary.tool_result_messages[0].content