@robota-sdk/agent-tool-defaults 3.0.0-beta.83 → 3.0.0-beta.84

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @robota-sdk/agent-tool-defaults
 
+## 3.0.0-beta.84
+
+### Patch Changes
+
+- c7f213c: `createDefaultTools` returned the same `WebFetch`/`WebSearch` tool instances on every call — the
+  two module-level singletons `@robota-sdk/agent-tools` exports — unlike every other tool in the set,
+  which was already built fresh per call. Two sessions built from separate `createDefaultTools({cwd})`
+  calls that were open at the same time shared those two tools without meaning to, which a resource
+  guard keyed by object identity (as `@robota-sdk/agent-roundtable-robota`'s does) rejected as reused
+  even though nothing about either tool needs to be shared across sessions. `WebFetch`/`WebSearch` are
+  now built per call, the same way `Glob`/`Grep` already were.
+- Updated dependencies [9f46375]
+- Updated dependencies [9c6a8db]
+- Updated dependencies [9c6a8db]
+  - @robota-sdk/agent-core@3.0.0-beta.84
+  - @robota-sdk/agent-tools@3.0.0-beta.84
+
 ## 3.0.0-beta.83
 
 ### Patch Changes

package/dist/node/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@robota-sdk/agent-tools");function t(t){let n=(0,e.routesFilesThroughSandbox)(t.sandboxClient),{sandboxClient:r,...i}=t,a=n?t:i;return[(0,e.createShellTool)(t),(0,e.createBashTool)(t),(0,e.createReadTool)(a),(0,e.createWriteTool)(a),(0,e.createEditTool)(a),...n?[]:[(0,e.createGlobTool)(t),(0,e.createGrepTool)(t)],e.webFetchTool,e.webSearchTool,(0,e.createAskUserQuestionTool)(),...t.retrievalAdapter?[(0,e.createRetrievalTool)({adapter:t.retrievalAdapter})]:[],...t.computerDriver?(0,e.createComputerTool)({driver:t.computerDriver}):[]]}exports.createDefaultTools=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@robota-sdk/agent-tools");function t(t){let n=(0,e.routesFilesThroughSandbox)(t.sandboxClient),{sandboxClient:r,...i}=t,a=n?t:i;return[(0,e.createShellTool)(t),(0,e.createBashTool)(t),(0,e.createReadTool)(a),(0,e.createWriteTool)(a),(0,e.createEditTool)(a),...n?[]:[(0,e.createGlobTool)(t),(0,e.createGrepTool)(t)],(0,e.createWebFetchTool)(),(0,e.createWebSearchTool)(),(0,e.createAskUserQuestionTool)(),...t.retrievalAdapter?[(0,e.createRetrievalTool)({adapter:t.retrievalAdapter})]:[],...t.computerDriver?(0,e.createComputerTool)({driver:t.computerDriver}):[]]}exports.createDefaultTools=t;

package/dist/node/index.js

@@ -1,2 +1,2 @@
-import{createAskUserQuestionTool as e,createBashTool as t,createComputerTool as n,createEditTool as r,createGlobTool as i,createGrepTool as a,createReadTool as o,createRetrievalTool as s,createShellTool as c,createWriteTool as l,routesFilesThroughSandbox as u,webFetchTool as d,webSearchTool as f}from"@robota-sdk/agent-tools";function p(p){let m=u(p.sandboxClient),{sandboxClient:h,...g}=p,_=m?p:g;return[c(p),t(p),o(_),l(_),r(_),...m?[]:[i(p),a(p)],d,f,e(),...p.retrievalAdapter?[s({adapter:p.retrievalAdapter})]:[],...p.computerDriver?n({driver:p.computerDriver}):[]]}export{p as createDefaultTools};
+import{createAskUserQuestionTool as e,createBashTool as t,createComputerTool as n,createEditTool as r,createGlobTool as i,createGrepTool as a,createReadTool as o,createRetrievalTool as s,createShellTool as c,createWebFetchTool as l,createWebSearchTool as u,createWriteTool as d,routesFilesThroughSandbox as f}from"@robota-sdk/agent-tools";function p(p){let m=f(p.sandboxClient),{sandboxClient:h,...g}=p,_=m?p:g;return[c(p),t(p),o(_),d(_),r(_),...m?[]:[i(p),a(p)],l(),u(),e(),...p.retrievalAdapter?[s({adapter:p.retrievalAdapter})]:[],...p.computerDriver?n({driver:p.computerDriver}):[]]}export{p as createDefaultTools};
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/create-default-tools.ts"],"sourcesContent":["/**\n * The DEFAULT TOOL SET — a composition leaf.\n *\n * ARCH-035 moved this out of `@robota-sdk/agent-framework`. It is a defaults aggregator, and\n * `.agents/project-structure.md` classifies that family as a composition leaf \"imported only at\n * composition roots (entry-point-only)\" — not something a mid-layer assembly library owns, publishes\n * and self-consumes.\n *\n * The move is what carries the guarantee. `agent-subagent-runner` may depend on `agent-framework`\n * (it needs `createSubagentSession` and friends) but has no manifest edge to THIS package, so\n * `import { createDefaultTools } from '@robota-sdk/agent-tool-defaults'` does not resolve there at\n * all. A neutral runner composing the product's tool surface is now a compile error rather than a\n * scan finding — the same shape ARCH-021 achieved on the provider axis with\n * `@robota-sdk/agent-builtin-providers`.\n *\n * `DEFAULT_TOOL_DESCRIPTIONS` deliberately did NOT come along: its only consumer builds the system\n * prompt synchronously, and dragging it here would force either a static edge back into this leaf or\n * a second async hop through prompt building. It stays beside its consumer in `agent-framework`.\n */\nimport {\n  createAskUserQuestionTool,\n  createShellTool,\n  createBashTool,\n  createReadTool,\n  createWriteTool,\n  createEditTool,\n  createRetrievalTool,\n  createComputerTool,\n  createGlobTool,\n  createGrepTool,\n  webFetchTool,\n  webSearchTool,\n  routesFilesThroughSandbox,\n} from '@robota-sdk/agent-tools';\n\nimport type { FunctionTool } from '@robota-sdk/agent-core';\nimport type { ISandboxClient, IRetrievalAdapter, IComputerDriver } from '@robota-sdk/agent-tools';\n\n/**\n * Create the default set of CLI tools.\n * Returns the standard tools.\n */\nexport interface ICreateDefaultToolsOptions {\n  sandboxClient?: ISandboxClient;\n  /** Host-selected executable for Shell and Bash. */\n  shellExecutable?: string;\n  /**\n   * The execution root every file tool is contained by. REQUIRED — ARCH-010.\n   *\n   * It was optional, and `child-process-subagent-worker.ts` called this factory with no argument at\n   * all: `cwd` was `undefined`, the path guard was fail-open, and the subagent's `Read` returned\n   * `/etc/hostname`. Requiring it means a construction site that forgets does not compile, which is\n   * the only way a containment root stays a contract rather than a convention.\n   */\n  cwd: string;\n  /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */\n  retrievalAdapter?: IRetrievalAdapter;\n  /**\n   * SELFHOST-010: when present, adds the adapter-gated `ComputerView` + `Computer` tools. Unlike the\n   * shell tool's host `spawn` fallback, computer-use has NO host fallback — with no driver the tools are\n   * simply ABSENT (there is no safe library-side \"local\" screen to fall back to).\n   */\n  computerDriver?: IComputerDriver;\n}\n\n/**\n * ARCH-035: returns `FunctionTool[]`, which is what every factory below actually returns.\n *\n * An earlier revision cast each one to `IToolWithEventService` because session assembly consumes that\n * interface. The cast was lossy in the direction that mattered: `ICapabilityPack.tools` is\n * `readonly FunctionTool[]`, so a pack CONSUMING this set could not assign it without a second cast\n * back — one erasure creating the need for another. `FunctionTool` satisfies `IToolWithEventService`,\n * so session assembly is unaffected and no cast is needed at either end.\n */\nexport function createDefaultTools(options: ICreateDefaultToolsOptions): FunctionTool[] {\n  // Issue #3081: the sandbox's filesystem relation decides where file tools read and write. On a\n  // SEPARATE filesystem every file tool goes through the sandbox — and `Glob`/`Grep`, which have no\n  // sandbox path, are withheld, so a search can never read the host while an edit writes the\n  // sandbox. On a SHARED filesystem (commands confined over the host's) file tools stay on the host\n  // under the path guard, and only commands run through the sandbox.\n  const separate = routesFilesThroughSandbox(options.sandboxClient);\n  const { sandboxClient: _commandsOnly, ...hostFileOptions } = options;\n  const fileOptions = separate ? options : hostFileOptions;\n  return [\n    createShellTool(options),\n    createBashTool(options),\n    createReadTool(fileOptions),\n    createWriteTool(fileOptions),\n    createEditTool(fileOptions),\n    // SEC-007: built per call, NOT the module-level singletons. A singleton is context-free by\n    // construction, so registering one meant `Glob`/`Grep` could enumerate outside the session's\n    // working directory while `Read`/`Write`/`Edit` were contained.\n    ...(separate ? [] : [createGlobTool(options), createGrepTool(options)]),\n    webFetchTool,\n    webSearchTool,\n    createAskUserQuestionTool(),\n    // Retrieval is adapter-gated: absent when no adapter is supplied (there is no host fallback).\n    ...(options.retrievalAdapter\n      ? [createRetrievalTool({ adapter: options.retrievalAdapter })]\n      : []),\n    // Computer-use is adapter-gated on the driver: absent when no driver is supplied. There is NO host\n    // fallback (unlike the shell tool's host spawn) — no library-side \"local\" screen exists.\n    ...(options.computerDriver ? createComputerTool({ driver: options.computerDriver }) : []),\n  ];\n}\n"],"mappings":"uUA0EA,SAAgB,EAAmB,EAAqD,CAMtF,IAAM,EAAW,EAA0B,EAAQ,aAAa,EAC1D,CAAE,cAAe,EAAe,GAAG,GAAoB,EACvD,EAAc,EAAW,EAAU,EACzC,MAAO,CACL,EAAgB,CAAO,EACvB,EAAe,CAAO,EACtB,EAAe,CAAW,EAC1B,EAAgB,CAAW,EAC3B,EAAe,CAAW,EAI1B,GAAI,EAAW,CAAC,EAAI,CAAC,EAAe,CAAO,EAAG,EAAe,CAAO,CAAC,EACrE,EACA,EACA,EAA0B,EAE1B,GAAI,EAAQ,iBACR,CAAC,EAAoB,CAAE,QAAS,EAAQ,gBAAiB,CAAC,CAAC,EAC3D,CAAC,EAGL,GAAI,EAAQ,eAAiB,EAAmB,CAAE,OAAQ,EAAQ,cAAe,CAAC,EAAI,CAAC,CACzF,CACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/create-default-tools.ts"],"sourcesContent":["/**\n * The DEFAULT TOOL SET — a composition leaf.\n *\n * ARCH-035 moved this out of `@robota-sdk/agent-framework`. It is a defaults aggregator, and\n * `.agents/project-structure.md` classifies that family as a composition leaf \"imported only at\n * composition roots (entry-point-only)\" — not something a mid-layer assembly library owns, publishes\n * and self-consumes.\n *\n * The move is what carries the guarantee. `agent-subagent-runner` may depend on `agent-framework`\n * (it needs `createSubagentSession` and friends) but has no manifest edge to THIS package, so\n * `import { createDefaultTools } from '@robota-sdk/agent-tool-defaults'` does not resolve there at\n * all. A neutral runner composing the product's tool surface is now a compile error rather than a\n * scan finding — the same shape ARCH-021 achieved on the provider axis with\n * `@robota-sdk/agent-builtin-providers`.\n *\n * `DEFAULT_TOOL_DESCRIPTIONS` deliberately did NOT come along: its only consumer builds the system\n * prompt synchronously, and dragging it here would force either a static edge back into this leaf or\n * a second async hop through prompt building. It stays beside its consumer in `agent-framework`.\n */\nimport {\n  createAskUserQuestionTool,\n  createShellTool,\n  createBashTool,\n  createReadTool,\n  createWriteTool,\n  createEditTool,\n  createRetrievalTool,\n  createComputerTool,\n  createGlobTool,\n  createGrepTool,\n  createWebFetchTool,\n  createWebSearchTool,\n  routesFilesThroughSandbox,\n} from '@robota-sdk/agent-tools';\n\nimport type { FunctionTool } from '@robota-sdk/agent-core';\nimport type { ISandboxClient, IRetrievalAdapter, IComputerDriver } from '@robota-sdk/agent-tools';\n\n/**\n * Create the default set of CLI tools.\n * Returns the standard tools.\n */\nexport interface ICreateDefaultToolsOptions {\n  sandboxClient?: ISandboxClient;\n  /** Host-selected executable for Shell and Bash. */\n  shellExecutable?: string;\n  /**\n   * The execution root every file tool is contained by. REQUIRED — ARCH-010.\n   *\n   * It was optional, and `child-process-subagent-worker.ts` called this factory with no argument at\n   * all: `cwd` was `undefined`, the path guard was fail-open, and the subagent's `Read` returned\n   * `/etc/hostname`. Requiring it means a construction site that forgets does not compile, which is\n   * the only way a containment root stays a contract rather than a convention.\n   */\n  cwd: string;\n  /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */\n  retrievalAdapter?: IRetrievalAdapter;\n  /**\n   * SELFHOST-010: when present, adds the adapter-gated `ComputerView` + `Computer` tools. Unlike the\n   * shell tool's host `spawn` fallback, computer-use has NO host fallback — with no driver the tools are\n   * simply ABSENT (there is no safe library-side \"local\" screen to fall back to).\n   */\n  computerDriver?: IComputerDriver;\n}\n\n/**\n * ARCH-035: returns `FunctionTool[]`, which is what every factory below actually returns.\n *\n * An earlier revision cast each one to `IToolWithEventService` because session assembly consumes that\n * interface. The cast was lossy in the direction that mattered: `ICapabilityPack.tools` is\n * `readonly FunctionTool[]`, so a pack CONSUMING this set could not assign it without a second cast\n * back — one erasure creating the need for another. `FunctionTool` satisfies `IToolWithEventService`,\n * so session assembly is unaffected and no cast is needed at either end.\n */\nexport function createDefaultTools(options: ICreateDefaultToolsOptions): FunctionTool[] {\n  // Issue #3081: the sandbox's filesystem relation decides where file tools read and write. On a\n  // SEPARATE filesystem every file tool goes through the sandbox — and `Glob`/`Grep`, which have no\n  // sandbox path, are withheld, so a search can never read the host while an edit writes the\n  // sandbox. On a SHARED filesystem (commands confined over the host's) file tools stay on the host\n  // under the path guard, and only commands run through the sandbox.\n  const separate = routesFilesThroughSandbox(options.sandboxClient);\n  const { sandboxClient: _commandsOnly, ...hostFileOptions } = options;\n  const fileOptions = separate ? options : hostFileOptions;\n  return [\n    createShellTool(options),\n    createBashTool(options),\n    createReadTool(fileOptions),\n    createWriteTool(fileOptions),\n    createEditTool(fileOptions),\n    // SEC-007: built per call, NOT the module-level singletons. A singleton is context-free by\n    // construction, so registering one meant `Glob`/`Grep` could enumerate outside the session's\n    // working directory while `Read`/`Write`/`Edit` were contained.\n    ...(separate ? [] : [createGlobTool(options), createGrepTool(options)]),\n    // MUST 4: also built per call, for the same reason — `webFetchTool`/`webSearchTool` are\n    // module-level singletons in `agent-tools`, so two concurrently open sessions built from this\n    // set (e.g. two `sessionParticipant`s) shared them and tripped `resource-reused` even though\n    // nothing about a WebFetch/WebSearch tool actually needs to be shared across sessions.\n    createWebFetchTool(),\n    createWebSearchTool(),\n    createAskUserQuestionTool(),\n    // Retrieval is adapter-gated: absent when no adapter is supplied (there is no host fallback).\n    ...(options.retrievalAdapter\n      ? [createRetrievalTool({ adapter: options.retrievalAdapter })]\n      : []),\n    // Computer-use is adapter-gated on the driver: absent when no driver is supplied. There is NO host\n    // fallback (unlike the shell tool's host spawn) — no library-side \"local\" screen exists.\n    ...(options.computerDriver ? createComputerTool({ driver: options.computerDriver }) : []),\n  ];\n}\n"],"mappings":"mVA0EA,SAAgB,EAAmB,EAAqD,CAMtF,IAAM,EAAW,EAA0B,EAAQ,aAAa,EAC1D,CAAE,cAAe,EAAe,GAAG,GAAoB,EACvD,EAAc,EAAW,EAAU,EACzC,MAAO,CACL,EAAgB,CAAO,EACvB,EAAe,CAAO,EACtB,EAAe,CAAW,EAC1B,EAAgB,CAAW,EAC3B,EAAe,CAAW,EAI1B,GAAI,EAAW,CAAC,EAAI,CAAC,EAAe,CAAO,EAAG,EAAe,CAAO,CAAC,EAKrE,EAAmB,EACnB,EAAoB,EACpB,EAA0B,EAE1B,GAAI,EAAQ,iBACR,CAAC,EAAoB,CAAE,QAAS,EAAQ,gBAAiB,CAAC,CAAC,EAC3D,CAAC,EAGL,GAAI,EAAQ,eAAiB,EAAmB,CAAE,OAAQ,EAAQ,cAAe,CAAC,EAAI,CAAC,CACzF,CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robota-sdk/agent-tool-defaults",
-  "version": "3.0.0-beta.83",
+  "version": "3.0.0-beta.84",
   "description": "The SDK's built-in default tool set (createDefaultTools) as a composition leaf over agent-tools",
   "type": "module",
   "publishConfig": {
@@ -54,9 +54,10 @@
     "url": "https://github.com/woojubb/robota.git",
     "directory": "packages/agent-tool-defaults"
   },
+  "homepage": "https://docs.robota.io/en/packages/agent-tool-defaults/",
   "dependencies": {
-    "@robota-sdk/agent-core": "3.0.0-beta.83",
-    "@robota-sdk/agent-tools": "3.0.0-beta.83"
+    "@robota-sdk/agent-tools": "3.0.0-beta.84",
+    "@robota-sdk/agent-core": "3.0.0-beta.84"
   },
   "volta": {
     "extends": "../../package.json"

package/src/__tests__/create-default-tools.test.ts

@@ -89,6 +89,23 @@ describe('createDefaultTools', () => {
     }
   });
 
+  // MUST 4: `WebFetch`/`WebSearch` used to be the module-level singletons `webFetchTool` /
+  // `webSearchTool` from `@robota-sdk/agent-tools` — the SAME object on every call. Two
+  // concurrently open sessions each built from `createDefaultTools({cwd})` then shared them and
+  // tripped a resource guard's `resource-reused` even though nothing about either tool needs
+  // sharing across sessions. A fresh instance per call is the fix, mirroring Glob/Grep (SEC-007).
+  it('MUST 4: WebFetch and WebSearch are fresh instances per call, not context-free singletons', () => {
+    const first = createDefaultTools({ cwd: ASSEMBLY_ROOT });
+    const second = createDefaultTools({ cwd: ASSEMBLY_ROOT });
+    for (const name of ['WebFetch', 'WebSearch']) {
+      const a = first.find((tool) => tool.getName() === name);
+      const b = second.find((tool) => tool.getName() === name);
+      expect(a, `${name} must be part of the default set`).toBeDefined();
+      expect(b).toBeDefined();
+      expect(a).not.toBe(b);
+    }
+  });
+
   // SELFHOST-003 TC-03: the retrieval adapter is threaded through assembly and the tool is
   // adapter-gated — absent with no adapter, present (and only then) when an adapter is supplied.
   it('TC-03: CodebaseRetrieval joins the default set only when a retrieval adapter is supplied', () => {

package/src/create-default-tools.ts

@@ -28,8 +28,8 @@ import {
   createComputerTool,
   createGlobTool,
   createGrepTool,
-  webFetchTool,
-  webSearchTool,
+  createWebFetchTool,
+  createWebSearchTool,
   routesFilesThroughSandbox,
 } from '@robota-sdk/agent-tools';
 
@@ -91,8 +91,12 @@ export function createDefaultTools(options: ICreateDefaultToolsOptions): Functio
     // construction, so registering one meant `Glob`/`Grep` could enumerate outside the session's
     // working directory while `Read`/`Write`/`Edit` were contained.
     ...(separate ? [] : [createGlobTool(options), createGrepTool(options)]),
-    webFetchTool,
-    webSearchTool,
+    // MUST 4: also built per call, for the same reason — `webFetchTool`/`webSearchTool` are
+    // module-level singletons in `agent-tools`, so two concurrently open sessions built from this
+    // set (e.g. two `sessionParticipant`s) shared them and tripped `resource-reused` even though
+    // nothing about a WebFetch/WebSearch tool actually needs to be shared across sessions.
+    createWebFetchTool(),
+    createWebSearchTool(),
     createAskUserQuestionTool(),
     // Retrieval is adapter-gated: absent when no adapter is supplied (there is no host fallback).
     ...(options.retrievalAdapter