@lazyingart/agintiflow 0.20.303 → 0.20.305

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.303",
+  "version": "0.20.305",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -2370,6 +2370,35 @@ try {
       /outside the active task artifact scope/.test(String(outsideScopedRead.reason || "")),
     "task-scoped artifact tools could read an unrelated repository file"
   );
+  const writeScopedRead = await executeWorkspaceTool(
+    "read_file",
+    { path: "unrelated.md" },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+      workspaceWritePathScopeRoots: ["output/task-scope"],
+    }
+  );
+  assert(
+    writeScopedRead.content === "unrelated\n",
+    "write-scoped artifact work could not read safe workspace evidence"
+  );
+  const outsideWriteScopedWrite = await executeWorkspaceTool(
+    "write_file",
+    { path: "outside-scoped-write.md", content: "blocked\n" },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+      workspaceWritePathScopeRoots: ["output/task-scope"],
+    }
+  );
+  assert(
+    outsideWriteScopedWrite.blocked === true &&
+      /outside the active task artifact scope/.test(
+        String(outsideWriteScopedWrite.reason || "")
+      ),
+    "write-scoped artifact work could mutate an unrelated repository file"
+  );
   const filenameSearch = await executeWorkspaceTool(
     "search_files",
     { path: ".", query: "routine_entry.py", maxResults: 5 },

package/scripts/smoke-progressive-tool-selection.js

@@ -5575,12 +5575,77 @@ const scopedRuntime = nextStepRuntimeConfig(
   }
 );
 assertStrict.equal(scopedRuntime.scopedArtifactTask, true);
-assertStrict.deepEqual(scopedRuntime.workspacePathScopeRoots, ["output/wechat_worker/task"]);
+assertStrict.deepEqual(scopedRuntime.workspaceWritePathScopeRoots, ["output/wechat_worker/task"]);
+assertStrict.equal(
+  scopedRuntime.workspacePathScopeRoots,
+  undefined,
+  "task artifact output incorrectly hid repository evidence from safe reads"
+);
 assertStrict.equal(
   scopedRuntime.repositoryGroundingRequired,
   undefined,
   "an explicit task artifact root still activated generic repository grounding"
 );
+const readOnlyAuditRequest =
+  "Check readiness, read configs/model-policy.json, and report git status without changing source files or sending messages.";
+const readOnlyAuditPrompt = `AGINTI_EVIDENCE_SCOPE_JSON: ${JSON.stringify({
+  mode: "task",
+  request: readOnlyAuditRequest,
+  artifact_root: "/workspace/output/webapp/agent/tasks/read-only-audit",
+})}`;
+const readOnlyAuditRuntime = nextStepRuntimeConfig(
+  {
+    provider: "localllm",
+    goal: readOnlyAuditPrompt,
+    commandCwd: "/workspace",
+  },
+  {
+    goal: readOnlyAuditPrompt,
+    commandCwd: "/workspace",
+    meta: {
+      goalContract: {
+        revision: 1,
+        currentRequest: readOnlyAuditRequest,
+      },
+      activeExecutionContract: {
+        revision: 1,
+        startedMutationRevision: 0,
+        requiresWorkspaceMutation: false,
+        requiresFileMutation: false,
+        requiresSourceGrounding: false,
+      },
+      projectVerification: { mutationRevision: 0 },
+    },
+  }
+);
+assertStrict.equal(
+  readOnlyAuditRuntime.scopedArtifactTask,
+  undefined,
+  "an optional host result directory incorrectly sandboxed a read-only workspace audit"
+);
+assertStrict.equal(
+  readOnlyAuditRuntime.workspaceWritePathScopeRoots,
+  undefined,
+  "a read-only workspace audit inherited an unrelated artifact write scope"
+);
+const readOnlyAuditTools = selectProgressiveTools(allTools, {
+  config: {
+    provider: "localllm",
+    progressiveTools: true,
+    ...readOnlyAuditRuntime,
+  },
+  goal: readOnlyAuditPrompt,
+  profile: "auto",
+  messages: [{ role: "user", content: readOnlyAuditPrompt }],
+});
+assert(
+  names(readOnlyAuditTools).includes("run_command"),
+  "a command-evidence audit omitted run_command from the compact local surface"
+);
+assert(
+  names(readOnlyAuditTools).includes("read_file"),
+  "an audit with an exact workspace input omitted read_file from the compact local surface"
+);
 const scopedPathWriteDescriptor = {
   type: "function",
   function: {
@@ -5683,9 +5748,9 @@ assertStrict.equal(
   "long-context compaction discarded the host-owned artifact scope"
 );
 assertStrict.deepEqual(
-  longScopedRuntime.workspacePathScopeRoots,
+  longScopedRuntime.workspaceWritePathScopeRoots,
   ["output/wechat_worker/long-scoped-task"],
-  "long-context artifact repair escaped its exact task root"
+  "long-context artifact writes escaped their exact task root"
 );
 assertStrict.equal(
   longScopedRuntime.completionFreshMutationRequired,

package/scripts/smoke-scs-evidence-visibility.js

@@ -205,6 +205,20 @@ const readOnlyReviewContract = deriveScsTaskContract({
   taskProfile: "review",
 });
 
+const readOnlyOperatorAuditRequest =
+  "This is a short imperfect operator audit. Check these three things without changing source files or sending messages: 1) run curl -fsS http://127.0.0.1:8008/readyz and state whether LocalLLM is ready; 2) read configs/model-policy.json and name the configured AgInTi provider order; 3) run git status --short and say only whether tracked source changes exist, without treating ignored runtime output as source. Cover all three numbered items in one concise answer and write the normal task result.";
+const readOnlyOperatorAuditContract = deriveScsTaskContract({
+  goal: [
+    readOnlyOperatorAuditRequest,
+    `AGINTI_EVIDENCE_SCOPE_JSON: ${JSON.stringify({
+      mode: "task",
+      request: readOnlyOperatorAuditRequest,
+      artifact_root: "/tmp/aginti-read-only-audit",
+    })}`,
+  ].join("\n\n"),
+  taskProfile: "auto",
+});
+
 const explicitReviewRepairContract = deriveScsTaskContract({
   goal: [
     "Review focus: inspect changed files and fix confirmed defects.",
@@ -374,6 +388,34 @@ assert.equal(
   true,
   "an explicit review-and-fix focus lost its positive mutation request"
 );
+assert.equal(
+  readOnlyOperatorAuditContract.requiresWorkspaceMutation,
+  false,
+  "a host-managed task response was mistaken for a workspace mutation"
+);
+assert.equal(
+  readOnlyOperatorAuditContract.requiresFileMutation,
+  false,
+  "an observational source-status mention was mistaken for a source mutation"
+);
+assert(
+  readOnlyOperatorAuditContract.requiredEvidence.some(
+    (item) => item.category === "command"
+  ) &&
+    !readOnlyOperatorAuditContract.requiredEvidence.some(
+      (item) => ["artifact", "file"].includes(item.category)
+    ),
+  "the phrase 'cover all items' invented cover-art or file evidence"
+);
+assert(
+  readOnlyOperatorAuditContract.forbiddenActions.some((item) =>
+    /changing source files or sending messages/i.test(item)
+  ) &&
+    !readOnlyOperatorAuditContract.forbiddenActions.some((item) =>
+      /run curl/i.test(item)
+    ),
+  "a colon after a without-clause swallowed the following command"
+);
 assert(
   pageSafeReportContract.requiredEvidence.some((item) => item.category === "file"),
   "a scoped existing-report edit did not require file evidence"

package/src/agent-runner.js

@@ -15034,8 +15034,30 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
   const scopedRootRelative = resolvedScopedRoot
     ? path.relative(commandCwd, resolvedScopedRoot)
     : "";
-  const scopedArtifactTask = Boolean(
+  const exactScopedOutputs = Array.isArray(groundingTaskContract.exactOutputPaths)
+    ? groundingTaskContract.exactOutputPaths
+        .map((item) => String(item || "").trim())
+        .filter(Boolean)
+    : [];
+  const exactOutputsStayInsideScopedRoot = Boolean(
     resolvedScopedRoot &&
+      exactScopedOutputs.length > 0 &&
+      exactScopedOutputs.every((item) => {
+        const absoluteOutput = path.resolve(commandCwd, item);
+        const relativeOutput = path.relative(resolvedScopedRoot, absoluteOutput);
+        return (
+          relativeOutput === "" ||
+          (!relativeOutput.startsWith("..") && !path.isAbsolute(relativeOutput))
+        );
+      })
+  );
+  const scopedArtifactTask = Boolean(
+    (
+      groundingTaskContract.scopedArtifactDeliverable === true ||
+      groundingTaskContract.scopedArtifactOperation === true ||
+      exactOutputsStayInsideScopedRoot
+    ) &&
+      resolvedScopedRoot &&
       scopedRootRelative &&
       !scopedRootRelative.startsWith("..") &&
       !path.isAbsolute(scopedRootRelative)
@@ -15043,7 +15065,7 @@ export function nextStepRuntimeConfig(config = {}, state = {}) {
   if (scopedArtifactTask) {
     runtimeConfig.scopedArtifactTask = true;
     runtimeConfig.scopedArtifactRoot = scopedRootRelative.replace(/\\/g, "/");
-    runtimeConfig.workspacePathScopeRoots = [runtimeConfig.scopedArtifactRoot];
+    runtimeConfig.workspaceWritePathScopeRoots = [runtimeConfig.scopedArtifactRoot];
   }
   if (
     (

package/src/progressive-tool-selection.js

@@ -4,7 +4,11 @@ import {
   hasLocalResearchWorkspaceIntent,
   shouldStartWithDeepResearch,
 } from "./research-routing.js";
-import { hasAgintiEvidenceScope, scopedChatopsEvidenceGoal } from "./scs-evidence.js";
+import {
+  deriveScsTaskContract,
+  hasAgintiEvidenceScope,
+  scopedChatopsEvidenceGoal,
+} from "./scs-evidence.js";
 import {
   INTEGRATION_TEXT_WORKSPACE_PROFILE_ID,
   isIntegrationTextWorkspaceToolAllowed,
@@ -2204,6 +2208,32 @@ function compactToolNames({ config, goal, profile, messages }) {
   const explicitBundles = bundlesForProfile(profileId(config, profile));
   const inferred = inferredBundles(taskText(goal, config, messages));
   const explicitProfileTools = profileToolNames(profile);
+  const taskContract = deriveScsTaskContract({
+    goal: goal || config.goal || "",
+    taskProfile: profileId(config, profile),
+  });
+  const contractRequiredTools = [];
+  if (
+    (Array.isArray(taskContract.requiredEvidence) &&
+      taskContract.requiredEvidence.some(
+        (item) => String(item?.category || "") === "command"
+      )) ||
+    (Array.isArray(taskContract.requiredProjectCommands) &&
+      taskContract.requiredProjectCommands.length > 0)
+  ) {
+    contractRequiredTools.push("run_command");
+  }
+  if (
+    Array.isArray(taskContract.exactInputPaths) &&
+    taskContract.exactInputPaths.length > 0
+  ) {
+    contractRequiredTools.push("read_file");
+  }
+  for (const name of taskContract.requiredToolCalls || []) {
+    if (COMPACT_ELIGIBLE_TOOL_NAMES.has(String(name || "").trim())) {
+      contractRequiredTools.push(String(name).trim());
+    }
+  }
   const bundleOrder = [];
   for (const bundle of explicitBundles) bundleOrder.push(bundle);
   for (const bundle of inferred) {
@@ -2232,7 +2262,10 @@ function compactToolNames({ config, goal, profile, messages }) {
     for (const name of COMPACT_TOOL_BUNDLES[bundle] || []) append(name);
   }
   for (const name of explicitProfileTools) append(name);
-  return names;
+  const missingContractTools = [
+    ...new Set(contractRequiredTools.filter((name) => !seen.has(name))),
+  ];
+  return [...missingContractTools, ...names];
 }
 
 /**
@@ -2739,21 +2772,9 @@ export function selectProgressiveTools(
   if (config.scopedArtifactTask === true && config.scopedArtifactRoot) {
     const available = new Map(enabled.map(({ name, tool }) => [name, tool]));
     const scopedWorkspaceTools = [
-      constrainScopedArtifactPath(
-        available.get("list_files"),
-        config.scopedArtifactRoot,
-        { commandCwd: config.commandCwd }
-      ),
-      constrainScopedArtifactPath(
-        available.get("read_file"),
-        config.scopedArtifactRoot,
-        { commandCwd: config.commandCwd }
-      ),
-      constrainScopedArtifactPath(
-        available.get("search_files"),
-        config.scopedArtifactRoot,
-        { commandCwd: config.commandCwd }
-      ),
+      available.get("list_files"),
+      available.get("read_file"),
+      available.get("search_files"),
       constrainScopedArtifactPath(
         available.get("write_file"),
         config.scopedArtifactRoot,
@@ -2767,9 +2788,9 @@ export function selectProgressiveTools(
       available.get("run_command"),
     ].filter(Boolean);
 
-    // Artifact isolation limits where the task may read or write; it must not
-    // erase the task's research, browser, or specialist capabilities. Keep
-    // inferred non-file tools while the workspace tools remain root-scoped.
+    // A host-owned artifact root confines artifact writes, but it must not hide
+    // the workspace evidence needed to produce those artifacts. Keep safe reads
+    // and inferred non-file tools available while write tools remain root-scoped.
     const scopedWorkspaceToolNames = new Set(
       scopedWorkspaceTools.map((tool) => openAiFunctionName(tool)).filter(Boolean)
     );

package/src/scs-evidence.js

@@ -1275,8 +1275,19 @@ function goalRequestsExplicitTestMutation(text = "") {
   );
 }
 
+function stripHostManagedResponseNarration(goal = "") {
+  return String(goal || "").replace(
+    /\b(?:and\s+)?(?:write|return|provide)\s+(?:(?:a|the)\s+)?(?:(?:concise|final|normal|structured)\s+)?(?:(?:agent|task)\s+)?(?:answer|response|result)\b(?!\s+(?:as|at|file|in|into|json|markdown|pdf|text|to|under)\b)/gi,
+    ""
+  );
+}
+
 function goalRequestsWorkspaceMutation(goal = "", taskProfile = "") {
-  const text = normalizedText(stripCompletedWorkNarration(stripForbiddenLanguage(goal)));
+  const text = normalizedText(
+    stripHostManagedResponseNarration(
+      stripCompletedWorkNarration(stripForbiddenLanguage(goal))
+    )
+  );
   const explicitAddMutation =
     goalRequestsExplicitTestMutation(text) ||
     /\badd\b(?:\s+(?:a|an|the|new|additional|specific))*\s+(?:code|documents?|files?|notes?|readme|scripts?|source|workspace)\b/.test(
@@ -1330,6 +1341,20 @@ function goalRequestsScopedArtifactDeliverable(goal = "") {
   return !projectSourceMutation;
 }
 
+function goalRequestsScopedArtifactOperation(goal = "") {
+  const text = normalizedText(stripCompletedWorkNarration(stripForbiddenLanguage(goal)));
+  const artifactOperation =
+    /\b(?:build|compile|create|draft|edit|export|generate|make|prepare|produce|render|repair|revise|save|update|write)\b[^.\n;]{0,180}\b(?:artifact|brief|cad|diagram|document|figure|image|markdown|memo|model|note|paper|pcb|pdf|presentation|prompt|report|research note|slide deck|slides?|spreadsheet|story|summary|transcript|video)\b/.test(text) ||
+    /\b(?:artifact|brief|cad|diagram|document|figure|image|markdown|memo|model|note|paper|pcb|pdf|presentation|prompt|report|research note|slide deck|slides?|spreadsheet|story|summary|transcript|video)\b[^.\n;]{0,120}\b(?:build|compile|create|draft|edit|export|generate|make|prepare|produce|render|repair|revise|save|update|write)\b/.test(text) ||
+    /(?:创建|生成|保存|编写|撰写|制作|导出|准备|修改|修订|修复|更新)[^。；\n]{0,100}(?:报告|笔记|摘要|文档|论文|图表|图片|模型|演示文稿|幻灯片|表格|故事|提示词|转录|视频)/.test(text);
+  if (!artifactOperation) return false;
+  const projectSourceMutation =
+    /\b(?:change|debug|edit|fix|implement|improve|modify|patch|refactor|repair|replace|rewrite|update)\b[^.\n;]{0,140}\b(?:app|application|code|codebase|implementation|library|package|repo|repository|runtime|source\s+code|src\/)\b/.test(text) ||
+    /\b(?:app|application|code|codebase|implementation|library|package|repo|repository|runtime|source\s+code|src\/)\b[^.\n;]{0,140}\b(?:change|debug|edit|fix|implement|improve|modify|patch|refactor|repair|replace|rewrite|update)\b/.test(text) ||
+    /(?:修改|修复|实现|改进|重构|调试|替换|更新)[^。；\n]{0,100}(?:代码|代码库|实现|运行时|应用|仓库|源码)/.test(text);
+  return !projectSourceMutation;
+}
+
 function goalRequestsTestExecution(goal = "") {
   const text = normalizedText(stripCompletedWorkNarration(stripForbiddenLanguage(goal)));
   return (
@@ -1448,7 +1473,12 @@ function inferRequirementCategories(goal = "", taskProfile = "", acceptanceCrite
   if (goalRequestsTestExecution(positiveGoal)) {
     categories.add("test");
   }
-  if (textHas(mandatoryEvidenceText, /\b(artifact|canvas|pdf|image|video|screenshot|cover|plot|chart|figure|docx|archive|copy to|export|generated|generate|draft)\b/) || /输出|产物|图片|视频|截图|封面|生成/.test(mandatoryEvidenceText)) {
+  if (
+    textHas(
+      mandatoryEvidenceText,
+      /\b(artifact|canvas|pdf|image|video|screenshot|plot|chart|figure|docx|archive|copy to|export|generated|generate|draft)\b|\b(?:album|book|paper|report|video)\s+cover\b|\bcover\s+(?:art|design|image)\b/
+    ) || /输出|产物|图片|视频|截图|封面|生成/.test(mandatoryEvidenceText)
+  ) {
     categories.add("artifact");
   }
   if (
@@ -1513,14 +1543,14 @@ function inferForbiddenActions(goal = "") {
   const text = String(goal || "");
   const forbidden = [];
   const isAction = (value = "") =>
-    /\b(use|open|click|browse|browser|upload|attach|submit|publish|deploy|run|execute|install|delete|remove|commit|push|call|api|alter|change|edit|fix|modify|patch|repair|rewrite|touch|write)\b/i.test(
+    /\b(use|open|click|browse|browser|upload|attach|submit|publish|deploy|run|execute|install|delete|remove|commit|push|call|api|alter|chang(?:e|ing)|edit(?:ing)?|fix(?:ing)?|modif(?:y|ying)|patch(?:ing)?|repair(?:ing)?|rewrit(?:e|ing)|send(?:ing)?|touch(?:ing)?|writ(?:e|ing))\b/i.test(
       value
     ) || /浏览器|网页|打开|点击|上传|提交|发布|部署|运行|执行|安装|删除|复制|移动|修改|编辑|修复|改写|写入|提交代码|推送|调用|API/.test(value);
   const patterns = [
     { re: /\b(do not|don't|dont|never|no need to)\s+([^.\n;]+)/gi, prefix: "User forbids" },
     // A sentence such as "without changing X, run tests and commit" starts a
     // positive instruction after the comma. Keep only the local without-clause.
-    { re: /\bwithout\s+([^.,\n;]+)/gi, prefix: "User forbids" },
+    { re: /\bwithout\s+([^.,:\uFF1A\n;]+)/gi, prefix: "User forbids" },
     { re: /不要([^。\n；]+)/g, prefix: "User forbids" },
     { re: /禁止([^。\n；]+)/g, prefix: "User forbids" },
   ];
@@ -2046,6 +2076,9 @@ export function deriveScsTaskContract({ goal = "", taskProfile = "", acceptanceC
   const scopedArtifactDeliverable = Boolean(
     artifactRoot && goalRequestsScopedArtifactDeliverable(evidenceGoal)
   );
+  const scopedArtifactOperation = Boolean(
+    artifactRoot && goalRequestsScopedArtifactOperation(evidenceGoal)
+  );
   return {
     version: 1,
     outcome: compact(evidenceGoal || "Complete the requested task.", 500),
@@ -2056,6 +2089,7 @@ export function deriveScsTaskContract({ goal = "", taskProfile = "", acceptanceC
     exactOutputPaths,
     requiredArtifactKinds,
     scopedArtifactDeliverable,
+    scopedArtifactOperation,
     excludedOutputPaths,
     artifactRoot,
     exactInputPaths,

package/src/workspace-tools.js

@@ -117,10 +117,15 @@ function matchingReadOnlyRoot(config, target) {
     .find((root) => isInside(root, target));
 }
 
-function configuredWorkspaceScopeRoots(config, root) {
-  const values = Array.isArray(config.workspacePathScopeRoots)
-    ? config.workspacePathScopeRoots
-    : [];
+function configuredWorkspaceScopeRoots(config, root, { writeAccess = false } = {}) {
+  const values = [
+    ...(Array.isArray(config.workspacePathScopeRoots)
+      ? config.workspacePathScopeRoots
+      : []),
+    ...(writeAccess && Array.isArray(config.workspaceWritePathScopeRoots)
+      ? config.workspaceWritePathScopeRoots
+      : []),
+  ];
   return values
     .map((item) => String(item || "").trim())
     .filter(Boolean)
@@ -267,12 +272,16 @@ export function normalizeWorkspaceInputPath(rawPath) {
   return rawPath;
 }
 
-export function resolveWorkspacePath(config, inputPath = ".", { allowReadOnlyRoots = false } = {}) {
+export function resolveWorkspacePath(
+  config,
+  inputPath = ".",
+  { allowReadOnlyRoots = false, writeAccess = false } = {}
+) {
   const root = workspaceRoot(config);
   const rawPath = sanitizePathInput(inputPath);
   const workspacePath = normalizeWorkspaceInputPath(rawPath);
   const absolutePath = path.resolve(root, workspacePath);
-  const scopedRoots = configuredWorkspaceScopeRoots(config, root);
+  const scopedRoots = configuredWorkspaceScopeRoots(config, root, { writeAccess });
 
   if (scopedRoots.length && !scopedRoots.some((scopeRoot) => isInside(scopeRoot, absolutePath))) {
     throw new Error(`Path is outside the active task artifact scope: ${rawPath}`);
@@ -451,7 +460,7 @@ export function checkWorkspaceToolUse(toolName, args, config) {
       const operations = parsePatchDocument(args.patch);
       for (const operation of operations) {
         for (const candidate of [operation.path, operation.newPath].filter(Boolean)) {
-          const target = resolveWorkspacePath(config, candidate);
+          const target = resolveWorkspacePath(config, candidate, { writeAccess: true });
           const policy = pathPolicy(toolName, target.relativePath);
           if (!policy.allowed) return policy;
         }
@@ -462,6 +471,7 @@ export function checkWorkspaceToolUse(toolName, args, config) {
     }
     const target = resolveWorkspacePath(config, args.path || ".", {
       allowReadOnlyRoots: !WORKSPACE_WRITE_TOOL_NAMES.includes(toolName),
+      writeAccess: WORKSPACE_WRITE_TOOL_NAMES.includes(toolName),
     });
     const policy = pathPolicy(toolName, target.relativePath);
     if (!policy.allowed) return policy;
@@ -1006,7 +1016,7 @@ async function deleteChange(target, action = "delete_file", details = {}) {
 }
 
 async function writeFile(config, args) {
-  const target = resolveWorkspacePath(config, args.path);
+  const target = resolveWorkspacePath(config, args.path, { writeAccess: true });
   const mode = args.mode === "overwrite" ? "overwrite" : "create";
   const exists = await fs
     .stat(target.absolutePath)
@@ -1033,7 +1043,7 @@ async function applyPatch(config, args) {
     return applyPatchDocument(config, args);
   }
 
-  const target = resolveWorkspacePath(config, args.path);
+  const target = resolveWorkspacePath(config, args.path, { writeAccess: true });
   const { content: beforeText, hash } = await readTextFile(target);
   if (args.baseHash && args.baseHash !== hash) {
     throw new Error(`Base hash mismatch for ${target.relativePath}; read the file again before patching.`);
@@ -1234,10 +1244,12 @@ async function applyPatchDocument(config, args) {
     if (seenPaths.has(operation.path)) throw new Error(`Patch contains duplicate file operations for ${operation.path}.`);
     seenPaths.add(operation.path);
 
-    const target = resolveWorkspacePath(config, operation.path);
+    const target = resolveWorkspacePath(config, operation.path, { writeAccess: true });
     const policy = pathPolicy("apply_patch", target.relativePath);
     if (!policy.allowed) throw new Error(policy.reason);
-    const newTarget = operation.newPath ? resolveWorkspacePath(config, operation.newPath) : null;
+    const newTarget = operation.newPath
+      ? resolveWorkspacePath(config, operation.newPath, { writeAccess: true })
+      : null;
     if (newTarget) {
       const newPolicy = pathPolicy("apply_patch", newTarget.relativePath);
       if (!newPolicy.allowed) throw new Error(newPolicy.reason);
@@ -1300,7 +1312,7 @@ async function applyPatchDocument(config, args) {
       continue;
     }
     if (operation.newPath) {
-      const newTarget = resolveWorkspacePath(config, operation.newPath);
+      const newTarget = resolveWorkspacePath(config, operation.newPath, { writeAccess: true });
       const policy = pathPolicy("apply_patch", newTarget.relativePath);
       if (!policy.allowed) throw new Error(policy.reason);
       changes.push(await writeChange(newTarget, item.afterText, "apply_patch_move", { fromPath: target.relativePath, patchFormat: "multi-file" }));