@robota-sdk/agent-tool-defaults 3.0.0-beta.96 → 3.0.0-beta.99

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @robota-sdk/agent-tool-defaults
 
+## 3.0.0-beta.99
+### Patch Changes
+
+  - @robota-sdk/agent-core@3.0.0-beta.99
+  - @robota-sdk/agent-tools@3.0.0-beta.99
+
+## 3.0.0-beta.98
+### Patch Changes
+
+  - @robota-sdk/agent-core@3.0.0-beta.98
+  - @robota-sdk/agent-tools@3.0.0-beta.98
+
+## 3.0.0-beta.97
+### Minor Changes
+
+- e5a4254: **An editor that offers its file system carries the file tools' reads and writes.**
+
+  `Read`, `Write` and `Edit` take an optional `editorFiles` port (`IEditorFileAccess`), asked at each
+  call. On the host, after the tool's containment check (the permission gate has already decided),
+  `Read` returns the editor's text, unsaved changes included, and `Write` hands the content to the
+  editor; `Edit` reads where `Read` reads and writes where `Write` writes. The editor's text keeps
+  `Read`'s byte budget, binary refusal, formatting and cancellation, and an editor failure becomes the
+  tool's error result. `Glob` and `Grep` still search the disk and end their result with a note saying
+  so while an editor is attached. A sandbox with its own filesystem still carries every file tool, and
+  commands never use the editor. `createDefaultTools` and `createCodingPack` pass `editorFiles` through
+  to those tools only.
+
+  The ACP agent transport records the editor's `clientCapabilities.fs` and, once `session/new` binds the
+  session, hands the host an access through the new `onEditorFileAccess` option that sends
+  `fs/read_text_file` and `fs/write_text_file` for that session, for what the editor offered; stopping
+  the transport withdraws it. `robota acp` connects the two, so Read, Write and Edit go through the
+  editor in an editor that offers `fs`; `terminal/*` is not used.
+
+### Patch Changes
+
+- Updated dependencies [e5a4254]
+- Updated dependencies [c207a31]
+- Updated dependencies [9b4f63b]
+- Updated dependencies [43df9c0]
+- Updated dependencies [23a30cd]
+  - @robota-sdk/agent-tools@3.0.0-beta.97
+  - @robota-sdk/agent-core@3.0.0-beta.97
+
 ## 3.0.0-beta.96
 ### Patch Changes
 

package/dist/node/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@robota-sdk/agent-tools");function t(t){let n=(0,e.routesFilesThroughSandbox)(t.sandboxClient),{sandboxClient:r,...i}=t,a=n?t:i;return[(0,e.createShellTool)(t),(0,e.createBashTool)(t),(0,e.createReadTool)(a),(0,e.createWriteTool)(a),(0,e.createEditTool)(a),...n?[]:[(0,e.createGlobTool)(t),(0,e.createGrepTool)(t)],(0,e.createWebFetchTool)({userAgent:t.httpUserAgent}),(0,e.createWebSearchTool)(),(0,e.createAskUserQuestionTool)(),...t.retrievalAdapter?[(0,e.createRetrievalTool)({adapter:t.retrievalAdapter})]:[],...t.computerDriver?(0,e.createComputerTool)({driver:t.computerDriver}):[]]}exports.createDefaultTools=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@robota-sdk/agent-tools");function t(t){let n=(0,e.routesFilesThroughSandbox)(t.sandboxClient),{editorFiles:r,...i}=t,{sandboxClient:a,...o}=t,s=n?i:o;return[(0,e.createShellTool)(i),(0,e.createBashTool)(i),(0,e.createReadTool)(s),(0,e.createWriteTool)(s),(0,e.createEditTool)(s),...n?[]:[(0,e.createGlobTool)(o),(0,e.createGrepTool)(o)],(0,e.createWebFetchTool)({userAgent:t.httpUserAgent}),(0,e.createWebSearchTool)(),(0,e.createAskUserQuestionTool)(),...t.retrievalAdapter?[(0,e.createRetrievalTool)({adapter:t.retrievalAdapter})]:[],...t.computerDriver?(0,e.createComputerTool)({driver:t.computerDriver}):[]]}exports.createDefaultTools=t;

package/dist/node/index.d.cts

@@ -1,5 +1,5 @@
 import { FunctionTool } from "@robota-sdk/agent-core";
-import { IComputerDriver, IRetrievalAdapter, ISandboxClient } from "@robota-sdk/agent-tools";
+import { IComputerDriver, IEditorFileAccess, IRetrievalAdapter, ISandboxClient } from "@robota-sdk/agent-tools";
 //#region src/create-default-tools.d.ts
 /**
  * Create the default set of CLI tools.
@@ -19,6 +19,12 @@ interface ICreateDefaultToolsOptions {
    * the only way a containment root stays a contract rather than a convention.
    */
   cwd: string;
+  /**
+   * An editor that has the workspace open, asked at each call. The host file tools read and write
+   * through what it offers and the searches say they read the disk; commands never use it, and a
+   * sandbox with its own filesystem keeps every file tool, since its files are not the editor's.
+   */
+  editorFiles?: () => IEditorFileAccess | undefined;
   /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */
   retrievalAdapter?: IRetrievalAdapter;
   /**

package/dist/node/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/create-default-tools.ts"],"mappings":";;;;;;;UA0CiB;EACf,gBAAgB;;EAEhB;EACA;;;;;;;;;EASA;;EAEA,mBAAmB;;;;;;EAMnB,iBAAiB;;;;;;;;;;;iBAYH,mBAAmB,SAAS,6BAA6B"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/create-default-tools.ts"],"mappings":";;;;;;;UA+CiB;EACf,gBAAgB;;EAEhB;EACA;;;;;;;;;EASA;;;;;;EAMA,oBAAoB;;EAEpB,mBAAmB;;;;;;EAMnB,iBAAiB;;;;;;;;;;;iBAYH,mBAAmB,SAAS,6BAA6B"}

package/dist/node/index.d.ts

@@ -1,4 +1,4 @@
-import { IComputerDriver, IRetrievalAdapter, ISandboxClient } from "@robota-sdk/agent-tools";
+import { IComputerDriver, IEditorFileAccess, IRetrievalAdapter, ISandboxClient } from "@robota-sdk/agent-tools";
 import { FunctionTool } from "@robota-sdk/agent-core";
 //#region src/create-default-tools.d.ts
 /**
@@ -19,6 +19,12 @@ interface ICreateDefaultToolsOptions {
    * the only way a containment root stays a contract rather than a convention.
    */
   cwd: string;
+  /**
+   * An editor that has the workspace open, asked at each call. The host file tools read and write
+   * through what it offers and the searches say they read the disk; commands never use it, and a
+   * sandbox with its own filesystem keeps every file tool, since its files are not the editor's.
+   */
+  editorFiles?: () => IEditorFileAccess | undefined;
   /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */
   retrievalAdapter?: IRetrievalAdapter;
   /**

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/create-default-tools.ts"],"mappings":";;;;;;;UA0CiB;EACf,gBAAgB;;EAEhB;EACA;;;;;;;;;EASA;;EAEA,mBAAmB;;;;;;EAMnB,iBAAiB;;;;;;;;;;;iBAYH,mBAAmB,SAAS,6BAA6B"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/create-default-tools.ts"],"mappings":";;;;;;;UA+CiB;EACf,gBAAgB;;EAEhB;EACA;;;;;;;;;EASA;;;;;;EAMA,oBAAoB;;EAEpB,mBAAmB;;;;;;EAMnB,iBAAiB;;;;;;;;;;;iBAYH,mBAAmB,SAAS,6BAA6B"}

package/dist/node/index.js

@@ -1,2 +1,2 @@
-import{createAskUserQuestionTool as e,createBashTool as t,createComputerTool as n,createEditTool as r,createGlobTool as i,createGrepTool as a,createReadTool as o,createRetrievalTool as s,createShellTool as c,createWebFetchTool as l,createWebSearchTool as u,createWriteTool as d,routesFilesThroughSandbox as f}from"@robota-sdk/agent-tools";function p(p){let m=f(p.sandboxClient),{sandboxClient:h,...g}=p,_=m?p:g;return[c(p),t(p),o(_),d(_),r(_),...m?[]:[i(p),a(p)],l({userAgent:p.httpUserAgent}),u(),e(),...p.retrievalAdapter?[s({adapter:p.retrievalAdapter})]:[],...p.computerDriver?n({driver:p.computerDriver}):[]]}export{p as createDefaultTools};
+import{createAskUserQuestionTool as e,createBashTool as t,createComputerTool as n,createEditTool as r,createGlobTool as i,createGrepTool as a,createReadTool as o,createRetrievalTool as s,createShellTool as c,createWebFetchTool as l,createWebSearchTool as u,createWriteTool as d,routesFilesThroughSandbox as f}from"@robota-sdk/agent-tools";function p(p){let m=f(p.sandboxClient),{editorFiles:h,...g}=p,{sandboxClient:_,...v}=p,y=m?g:v;return[c(g),t(g),o(y),d(y),r(y),...m?[]:[i(v),a(v)],l({userAgent:p.httpUserAgent}),u(),e(),...p.retrievalAdapter?[s({adapter:p.retrievalAdapter})]:[],...p.computerDriver?n({driver:p.computerDriver}):[]]}export{p as createDefaultTools};
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/create-default-tools.ts"],"sourcesContent":["/**\n * The DEFAULT TOOL SET — a composition leaf.\n *\n * ARCH-035 moved this out of `@robota-sdk/agent-framework`. It is a defaults aggregator, and\n * `.agents/project-structure.md` classifies that family as a composition leaf \"imported only at\n * composition roots (entry-point-only)\" — not something a mid-layer assembly library owns, publishes\n * and self-consumes.\n *\n * The move is what carries the guarantee. `agent-subagent-runner` may depend on `agent-framework`\n * (it needs `createSubagentSession` and friends) but has no manifest edge to THIS package, so\n * `import { createDefaultTools } from '@robota-sdk/agent-tool-defaults'` does not resolve there at\n * all. A neutral runner composing the product's tool surface is now a compile error rather than a\n * scan finding — the same shape ARCH-021 achieved on the provider axis with\n * `@robota-sdk/agent-builtin-providers`.\n *\n * `DEFAULT_TOOL_DESCRIPTIONS` deliberately did NOT come along: its only consumer builds the system\n * prompt synchronously, and dragging it here would force either a static edge back into this leaf or\n * a second async hop through prompt building. It stays beside its consumer in `agent-framework`.\n */\nimport {\n  createAskUserQuestionTool,\n  createShellTool,\n  createBashTool,\n  createReadTool,\n  createWriteTool,\n  createEditTool,\n  createRetrievalTool,\n  createComputerTool,\n  createGlobTool,\n  createGrepTool,\n  createWebFetchTool,\n  createWebSearchTool,\n  routesFilesThroughSandbox,\n} from '@robota-sdk/agent-tools';\n\nimport type { FunctionTool } from '@robota-sdk/agent-core';\nimport type { ISandboxClient, IRetrievalAdapter, IComputerDriver } from '@robota-sdk/agent-tools';\n\n/**\n * Create the default set of CLI tools.\n * Returns the standard tools.\n */\nexport interface ICreateDefaultToolsOptions {\n  sandboxClient?: ISandboxClient;\n  /** Host-selected executable for Shell and Bash. */\n  shellExecutable?: string;\n  httpUserAgent?: string;\n  /**\n   * The execution root every file tool is contained by. REQUIRED — ARCH-010.\n   *\n   * It was optional, and `child-process-subagent-worker.ts` called this factory with no argument at\n   * all: `cwd` was `undefined`, the path guard was fail-open, and the subagent's `Read` returned\n   * `/etc/hostname`. Requiring it means a construction site that forgets does not compile, which is\n   * the only way a containment root stays a contract rather than a convention.\n   */\n  cwd: string;\n  /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */\n  retrievalAdapter?: IRetrievalAdapter;\n  /**\n   * SELFHOST-010: when present, adds the adapter-gated `ComputerView` + `Computer` tools. Unlike the\n   * shell tool's host `spawn` fallback, computer-use has NO host fallback — with no driver the tools are\n   * simply ABSENT (there is no safe library-side \"local\" screen to fall back to).\n   */\n  computerDriver?: IComputerDriver;\n}\n\n/**\n * ARCH-035: returns `FunctionTool[]`, which is what every factory below actually returns.\n *\n * An earlier revision cast each one to `IToolWithEventService` because session assembly consumes that\n * interface. The cast was lossy in the direction that mattered: `ICapabilityPack.tools` is\n * `readonly FunctionTool[]`, so a pack CONSUMING this set could not assign it without a second cast\n * back — one erasure creating the need for another. `FunctionTool` satisfies `IToolWithEventService`,\n * so session assembly is unaffected and no cast is needed at either end.\n */\nexport function createDefaultTools(options: ICreateDefaultToolsOptions): FunctionTool[] {\n  // Issue #3081: the sandbox's filesystem relation decides where file tools read and write. On a\n  // SEPARATE filesystem every file tool goes through the sandbox — and `Glob`/`Grep`, which have no\n  // sandbox path, are withheld, so a search can never read the host while an edit writes the\n  // sandbox. On a SHARED filesystem (commands confined over the host's) file tools stay on the host\n  // under the path guard, and only commands run through the sandbox.\n  const separate = routesFilesThroughSandbox(options.sandboxClient);\n  const { sandboxClient: _commandsOnly, ...hostFileOptions } = options;\n  const fileOptions = separate ? options : hostFileOptions;\n  return [\n    createShellTool(options),\n    createBashTool(options),\n    createReadTool(fileOptions),\n    createWriteTool(fileOptions),\n    createEditTool(fileOptions),\n    // SEC-007: built per call, NOT the module-level singletons. A singleton is context-free by\n    // construction, so registering one meant `Glob`/`Grep` could enumerate outside the session's\n    // working directory while `Read`/`Write`/`Edit` were contained.\n    ...(separate ? [] : [createGlobTool(options), createGrepTool(options)]),\n    // MUST 4: also built per call, for the same reason — `webFetchTool`/`webSearchTool` are\n    // module-level singletons in `agent-tools`, so two concurrently open sessions built from this\n    // set (e.g. two `sessionParticipant`s) shared them and tripped `resource-reused` even though\n    // nothing about a WebFetch/WebSearch tool actually needs to be shared across sessions.\n    createWebFetchTool({ userAgent: options.httpUserAgent }),\n    createWebSearchTool(),\n    createAskUserQuestionTool(),\n    // Retrieval is adapter-gated: absent when no adapter is supplied (there is no host fallback).\n    ...(options.retrievalAdapter\n      ? [createRetrievalTool({ adapter: options.retrievalAdapter })]\n      : []),\n    // Computer-use is adapter-gated on the driver: absent when no driver is supplied. There is NO host\n    // fallback (unlike the shell tool's host spawn) — no library-side \"local\" screen exists.\n    ...(options.computerDriver ? createComputerTool({ driver: options.computerDriver }) : []),\n  ];\n}\n"],"mappings":"mVA2EA,SAAgB,EAAmB,EAAqD,CAMtF,IAAM,EAAW,EAA0B,EAAQ,aAAa,EAC1D,CAAE,cAAe,EAAe,GAAG,GAAoB,EACvD,EAAc,EAAW,EAAU,EACzC,MAAO,CACL,EAAgB,CAAO,EACvB,EAAe,CAAO,EACtB,EAAe,CAAW,EAC1B,EAAgB,CAAW,EAC3B,EAAe,CAAW,EAI1B,GAAI,EAAW,CAAC,EAAI,CAAC,EAAe,CAAO,EAAG,EAAe,CAAO,CAAC,EAKrE,EAAmB,CAAE,UAAW,EAAQ,aAAc,CAAC,EACvD,EAAoB,EACpB,EAA0B,EAE1B,GAAI,EAAQ,iBACR,CAAC,EAAoB,CAAE,QAAS,EAAQ,gBAAiB,CAAC,CAAC,EAC3D,CAAC,EAGL,GAAI,EAAQ,eAAiB,EAAmB,CAAE,OAAQ,EAAQ,cAAe,CAAC,EAAI,CAAC,CACzF,CACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/create-default-tools.ts"],"sourcesContent":["/**\n * The DEFAULT TOOL SET — a composition leaf.\n *\n * ARCH-035 moved this out of `@robota-sdk/agent-framework`. It is a defaults aggregator, and\n * `.agents/project-structure.md` classifies that family as a composition leaf \"imported only at\n * composition roots (entry-point-only)\" — not something a mid-layer assembly library owns, publishes\n * and self-consumes.\n *\n * The move is what carries the guarantee. `agent-subagent-runner` may depend on `agent-framework`\n * (it needs `createSubagentSession` and friends) but has no manifest edge to THIS package, so\n * `import { createDefaultTools } from '@robota-sdk/agent-tool-defaults'` does not resolve there at\n * all. A neutral runner composing the product's tool surface is now a compile error rather than a\n * scan finding — the same shape ARCH-021 achieved on the provider axis with\n * `@robota-sdk/agent-builtin-providers`.\n *\n * `DEFAULT_TOOL_DESCRIPTIONS` deliberately did NOT come along: its only consumer builds the system\n * prompt synchronously, and dragging it here would force either a static edge back into this leaf or\n * a second async hop through prompt building. It stays beside its consumer in `agent-framework`.\n */\nimport {\n  createAskUserQuestionTool,\n  createShellTool,\n  createBashTool,\n  createReadTool,\n  createWriteTool,\n  createEditTool,\n  createRetrievalTool,\n  createComputerTool,\n  createGlobTool,\n  createGrepTool,\n  createWebFetchTool,\n  createWebSearchTool,\n  routesFilesThroughSandbox,\n} from '@robota-sdk/agent-tools';\n\nimport type { FunctionTool } from '@robota-sdk/agent-core';\nimport type {\n  IComputerDriver,\n  IEditorFileAccess,\n  IRetrievalAdapter,\n  ISandboxClient,\n} from '@robota-sdk/agent-tools';\n\n/**\n * Create the default set of CLI tools.\n * Returns the standard tools.\n */\nexport interface ICreateDefaultToolsOptions {\n  sandboxClient?: ISandboxClient;\n  /** Host-selected executable for Shell and Bash. */\n  shellExecutable?: string;\n  httpUserAgent?: string;\n  /**\n   * The execution root every file tool is contained by. REQUIRED — ARCH-010.\n   *\n   * It was optional, and `child-process-subagent-worker.ts` called this factory with no argument at\n   * all: `cwd` was `undefined`, the path guard was fail-open, and the subagent's `Read` returned\n   * `/etc/hostname`. Requiring it means a construction site that forgets does not compile, which is\n   * the only way a containment root stays a contract rather than a convention.\n   */\n  cwd: string;\n  /**\n   * An editor that has the workspace open, asked at each call. The host file tools read and write\n   * through what it offers and the searches say they read the disk; commands never use it, and a\n   * sandbox with its own filesystem keeps every file tool, since its files are not the editor's.\n   */\n  editorFiles?: () => IEditorFileAccess | undefined;\n  /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */\n  retrievalAdapter?: IRetrievalAdapter;\n  /**\n   * SELFHOST-010: when present, adds the adapter-gated `ComputerView` + `Computer` tools. Unlike the\n   * shell tool's host `spawn` fallback, computer-use has NO host fallback — with no driver the tools are\n   * simply ABSENT (there is no safe library-side \"local\" screen to fall back to).\n   */\n  computerDriver?: IComputerDriver;\n}\n\n/**\n * ARCH-035: returns `FunctionTool[]`, which is what every factory below actually returns.\n *\n * An earlier revision cast each one to `IToolWithEventService` because session assembly consumes that\n * interface. The cast was lossy in the direction that mattered: `ICapabilityPack.tools` is\n * `readonly FunctionTool[]`, so a pack CONSUMING this set could not assign it without a second cast\n * back — one erasure creating the need for another. `FunctionTool` satisfies `IToolWithEventService`,\n * so session assembly is unaffected and no cast is needed at either end.\n */\nexport function createDefaultTools(options: ICreateDefaultToolsOptions): FunctionTool[] {\n  // Issue #3081: the sandbox's filesystem relation decides where file tools read and write. On a\n  // SEPARATE filesystem every file tool goes through the sandbox — and `Glob`/`Grep`, which have no\n  // sandbox path, are withheld, so a search can never read the host while an edit writes the\n  // sandbox. On a SHARED filesystem (commands confined over the host's) file tools stay on the host\n  // under the path guard, and only commands run through the sandbox.\n  const separate = routesFilesThroughSandbox(options.sandboxClient);\n  // An editor holds the host's files, so it reaches only the tools that work on them; commands keep\n  // the agent's own sandbox.\n  const { editorFiles: _hostFilesOnly, ...commandOptions } = options;\n  const { sandboxClient: _commandsOnly, ...hostFileOptions } = options;\n  const fileOptions = separate ? commandOptions : hostFileOptions;\n  return [\n    createShellTool(commandOptions),\n    createBashTool(commandOptions),\n    createReadTool(fileOptions),\n    createWriteTool(fileOptions),\n    createEditTool(fileOptions),\n    // SEC-007: built per call, NOT the module-level singletons. A singleton is context-free by\n    // construction, so registering one meant `Glob`/`Grep` could enumerate outside the session's\n    // working directory while `Read`/`Write`/`Edit` were contained.\n    ...(separate ? [] : [createGlobTool(hostFileOptions), createGrepTool(hostFileOptions)]),\n    // MUST 4: also built per call, for the same reason — `webFetchTool`/`webSearchTool` are\n    // module-level singletons in `agent-tools`, so two concurrently open sessions built from this\n    // set (e.g. two `sessionParticipant`s) shared them and tripped `resource-reused` even though\n    // nothing about a WebFetch/WebSearch tool actually needs to be shared across sessions.\n    createWebFetchTool({ userAgent: options.httpUserAgent }),\n    createWebSearchTool(),\n    createAskUserQuestionTool(),\n    // Retrieval is adapter-gated: absent when no adapter is supplied (there is no host fallback).\n    ...(options.retrievalAdapter\n      ? [createRetrievalTool({ adapter: options.retrievalAdapter })]\n      : []),\n    // Computer-use is adapter-gated on the driver: absent when no driver is supplied. There is NO host\n    // fallback (unlike the shell tool's host spawn) — no library-side \"local\" screen exists.\n    ...(options.computerDriver ? createComputerTool({ driver: options.computerDriver }) : []),\n  ];\n}\n"],"mappings":"mVAsFA,SAAgB,EAAmB,EAAqD,CAMtF,IAAM,EAAW,EAA0B,EAAQ,aAAa,EAG1D,CAAE,YAAa,EAAgB,GAAG,GAAmB,EACrD,CAAE,cAAe,EAAe,GAAG,GAAoB,EACvD,EAAc,EAAW,EAAiB,EAChD,MAAO,CACL,EAAgB,CAAc,EAC9B,EAAe,CAAc,EAC7B,EAAe,CAAW,EAC1B,EAAgB,CAAW,EAC3B,EAAe,CAAW,EAI1B,GAAI,EAAW,CAAC,EAAI,CAAC,EAAe,CAAe,EAAG,EAAe,CAAe,CAAC,EAKrF,EAAmB,CAAE,UAAW,EAAQ,aAAc,CAAC,EACvD,EAAoB,EACpB,EAA0B,EAE1B,GAAI,EAAQ,iBACR,CAAC,EAAoB,CAAE,QAAS,EAAQ,gBAAiB,CAAC,CAAC,EAC3D,CAAC,EAGL,GAAI,EAAQ,eAAiB,EAAmB,CAAE,OAAQ,EAAQ,cAAe,CAAC,EAAI,CAAC,CACzF,CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robota-sdk/agent-tool-defaults",
-  "version": "3.0.0-beta.96",
+  "version": "3.0.0-beta.99",
   "description": "The SDK's built-in default tool set (createDefaultTools) as a composition leaf over agent-tools",
   "type": "module",
   "publishConfig": {
@@ -50,8 +50,8 @@
   },
   "license": "AGPL-3.0-only OR LicenseRef-Commercial",
   "dependencies": {
-    "@robota-sdk/agent-core": "3.0.0-beta.96",
-    "@robota-sdk/agent-tools": "3.0.0-beta.96"
+    "@robota-sdk/agent-core": "3.0.0-beta.99",
+    "@robota-sdk/agent-tools": "3.0.0-beta.99"
   },
   "volta": {
     "extends": "../../package.json"

package/src/__tests__/create-default-tools.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -210,3 +210,80 @@ describe('file tools follow the sandbox filesystem relation (issue #3081)', () =
     expect(JSON.stringify(result)).not.toContain('inside the sandbox');
   });
 });
+
+/** Issue #3550 item 4 — an editor reaches the host file tools and the searches, never the commands. */
+describe('an editor reaches the host file tools only', () => {
+  function recordingEditor() {
+    const asked: string[] = [];
+    const requests: string[] = [];
+    const access = {
+      readTextFile: async (path: string) => {
+        requests.push(`read ${path}`);
+        return 'EDITOR TEXT\n';
+      },
+      writeTextFile: async (path: string) => {
+        requests.push(`write ${path}`);
+      },
+    };
+    return {
+      requests,
+      asked,
+      editorFiles: () => {
+        asked.push('asked');
+        return access;
+      },
+    };
+  }
+  const parse = (outcome: unknown) =>
+    JSON.parse(String((outcome as { data?: unknown }).data)) as { output: string };
+
+  it('Read and Write go through the editor and the searches say they read the disk', async () => {
+    const root = mkdtempSync(join(PRIVATE_BASE, 'editor-'));
+    writeFileSync(join(root, 'probe.txt'), 'DISK TEXT\n');
+    const editor = recordingEditor();
+    const tools = createDefaultTools({ cwd: root, editorFiles: editor.editorFiles });
+    const byName = (name: string) => tools.find((tool) => tool.getName() === name)!;
+
+    expect(parse(await byName('Read').execute({ filePath: 'probe.txt' })).output).toContain(
+      'EDITOR TEXT',
+    );
+    await byName('Write').execute({ filePath: 'out.txt', content: 'x' });
+    expect(editor.requests).toEqual([`read ${join(root, 'probe.txt')}`, `write ${join(root, 'out.txt')}`]);
+    expect(parse(await byName('Grep').execute({ pattern: 'DISK' })).output).toContain(
+      '[Searched the files on disk.',
+    );
+  });
+
+  it('Shell and Bash never ask for the editor', async () => {
+    const root = mkdtempSync(join(PRIVATE_BASE, 'editor-shell-'));
+    const editor = recordingEditor();
+    const tools = createDefaultTools({ cwd: root, editorFiles: editor.editorFiles });
+    for (const name of ['Shell', 'Bash']) {
+      const outcome = await tools
+        .find((tool) => tool.getName() === name)!
+        .execute({ command: 'echo shell-ok' });
+      expect(JSON.stringify(outcome)).toContain('shell-ok');
+    }
+    expect(editor.asked).toEqual([]);
+  });
+
+  it('a separate sandbox filesystem keeps every file tool, so the editor is not asked', async () => {
+    const sandboxClient = new InMemorySandboxClient();
+    await sandboxClient.writeFile('/sandbox/only.txt', 'inside the sandbox');
+    const editor = recordingEditor();
+    const tools = createDefaultTools({
+      cwd: '/sandbox',
+      sandboxClient,
+      editorFiles: editor.editorFiles,
+    });
+    const read = tools.find((tool) => tool.getName() === 'Read')!;
+    expect(JSON.stringify(await read.execute({ filePath: '/sandbox/only.txt' }))).toContain(
+      'inside the sandbox',
+    );
+    await tools.find((tool) => tool.getName() === 'Write')!.execute({
+      filePath: '/sandbox/out.txt',
+      content: 'x',
+    });
+    expect(editor.asked).toEqual([]);
+  });
+});

package/src/create-default-tools.ts

@@ -34,7 +34,12 @@ import {
 } from '@robota-sdk/agent-tools';
 
 import type { FunctionTool } from '@robota-sdk/agent-core';
-import type { ISandboxClient, IRetrievalAdapter, IComputerDriver } from '@robota-sdk/agent-tools';
+import type {
+  IComputerDriver,
+  IEditorFileAccess,
+  IRetrievalAdapter,
+  ISandboxClient,
+} from '@robota-sdk/agent-tools';
 
 /**
  * Create the default set of CLI tools.
@@ -54,6 +59,12 @@ export interface ICreateDefaultToolsOptions {
    * the only way a containment root stays a contract rather than a convention.
    */
   cwd: string;
+  /**
+   * An editor that has the workspace open, asked at each call. The host file tools read and write
+   * through what it offers and the searches say they read the disk; commands never use it, and a
+   * sandbox with its own filesystem keeps every file tool, since its files are not the editor's.
+   */
+  editorFiles?: () => IEditorFileAccess | undefined;
   /** SELFHOST-003: when present, adds the adapter-gated `CodebaseRetrieval` tool (absent otherwise). */
   retrievalAdapter?: IRetrievalAdapter;
   /**
@@ -80,18 +91,21 @@ export function createDefaultTools(options: ICreateDefaultToolsOptions): Functio
   // sandbox. On a SHARED filesystem (commands confined over the host's) file tools stay on the host
   // under the path guard, and only commands run through the sandbox.
   const separate = routesFilesThroughSandbox(options.sandboxClient);
+  // An editor holds the host's files, so it reaches only the tools that work on them; commands keep
+  // the agent's own sandbox.
+  const { editorFiles: _hostFilesOnly, ...commandOptions } = options;
   const { sandboxClient: _commandsOnly, ...hostFileOptions } = options;
-  const fileOptions = separate ? options : hostFileOptions;
+  const fileOptions = separate ? commandOptions : hostFileOptions;
   return [
-    createShellTool(options),
-    createBashTool(options),
+    createShellTool(commandOptions),
+    createBashTool(commandOptions),
     createReadTool(fileOptions),
     createWriteTool(fileOptions),
     createEditTool(fileOptions),
     // SEC-007: built per call, NOT the module-level singletons. A singleton is context-free by
     // construction, so registering one meant `Glob`/`Grep` could enumerate outside the session's
     // working directory while `Read`/`Write`/`Edit` were contained.
-    ...(separate ? [] : [createGlobTool(options), createGrepTool(options)]),
+    ...(separate ? [] : [createGlobTool(hostFileOptions), createGrepTool(hostFileOptions)]),
     // MUST 4: also built per call, for the same reason — `webFetchTool`/`webSearchTool` are
     // module-level singletons in `agent-tools`, so two concurrently open sessions built from this
     // set (e.g. two `sessionParticipant`s) shared them and tripped `resource-reused` even though