@dtlabs/ai-toolkit 0.24.2 → 0.24.3

package/CHANGELOG.md

@@ -1,4 +1,12 @@
 ## 0.1.4 (2026-07-21)
+## [0.24.3](https://github.com/dtlab-tech/ai-toolkit/compare/v0.24.2...v0.24.3) (2026-10-27)
+
+
+### Bug Fixes
+
+* don't fail a worker call over a read-only permission denial ([1b4c521](https://github.com/dtlab-tech/ai-toolkit/commit/1b4c5217b42e9c9dcb74c9bbe60f209522644f9c))
+* **workflow-control:** don't fail a worker call over a read-only permission denial ([fb283c6](https://github.com/dtlab-tech/ai-toolkit/commit/fb283c6a0f44f56d0ca152bcf84bf81c1ca10125))
+
 ## [0.24.2](https://github.com/dtlab-tech/ai-toolkit/compare/v0.24.1...v0.24.2) (2026-10-26)
 
 

package/lib/workflow-control.js

@@ -230,10 +230,27 @@ function createControl(options) {
       tokenLedger.push({ agent: identity.nativeName, model: definition.model,
         phase_delta_tokens: measuredTokens, usage: result.result?.usage || null, evidence_path: evidence.file });
       evidence.save({ response: result, attempts });
+      // A denial on a read-only tool (Read/Glob/Grep) means the agent couldn't fetch some EXTRA
+      // context — a real, recurring pattern where a path the model constructs itself (e.g. a
+      // single leading backslash with no drive letter) resolves outside the project directory
+      // and is correctly denied. Confirmed via production evidence twice, on two different
+      // paths: the agent recovers and still produces a complete, structurally valid result, which
+      // this unconditional check threw away anyway, wasting the entire call and forcing a resume.
+      // Any OTHER tool (Write/Edit/Bash/...) stays an immediate, unconditional failure — a denial
+      // there is a near-miss on a real side effect, not a missed read, and must never be silently
+      // tolerated regardless of what the rest of the response looks like.
+      const READ_ONLY_DENIAL_TOOLS = new Set(['Read', 'Glob', 'Grep'])
       const denials = result.result?.permission_denials;
       if (Array.isArray(denials) && denials.length) {
-        const tools = [...new Set(denials.map(d => d.tool_name || 'unknown'))].join(', ');
-        throw new Error('Worker permission denied: ' + id + '; tools: ' + tools);
+        const nonReadOnly = denials.filter(d => !READ_ONLY_DENIAL_TOOLS.has(d.tool_name));
+        if (nonReadOnly.length) {
+          const tools = [...new Set(nonReadOnly.map(d => d.tool_name || 'unknown'))].join(', ');
+          throw new Error('Worker permission denied: ' + id + '; tools: ' + tools);
+        }
+        // Read-only denial(s) only: fall through to the normal result-validity checks below —
+        // an agent that actually proceeded with missing context will still fail there (a bad
+        // exitCode/is_error, or the caller's own downstream structural validation), the same way
+        // it would if no denial had ever happened.
       }
       if (result.exitCode !== 0 || result.parseError || result.timedOut ||
           !result.result || result.result.is_error !== false) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dtlabs/ai-toolkit",
-  "version": "0.24.2",
+  "version": "0.24.3",
   "description": "AI Toolkit — reusable agents and procedures for developers to build AI-powered applications.",
   "files": [
     "docs/",