@spotpatch/agent 1.2.3 → 1.2.4

package/README.md

@@ -11,6 +11,7 @@ Security boundaries:
 - no model-controlled arbitrary shell;
 - no browser-side API keys;
 - bounded paths, reads, writes, Diff sizes, turns, and tool calls;
+- rejected read paths stay unread and unmodified while the bounded Agent loop can recover through allowed discovery results;
 - no implicit stash, reset, commit, push, publish, or deployment;
 - review is the default apply mode.
 
@@ -22,7 +23,7 @@ Requires Node.js `>=20.19.0`.
 
 业务应用应通过 [`@spotpatch/vite`](https://www.npmjs.com/package/@spotpatch/vite) 等框架适配器启用该能力。本包公开发布是为了形成可安装、可版本化的依赖图，不是独立 UI 接入入口。
 
-安全边界包括：不向模型开放任意 Shell、不把 API Key 放入浏览器、限制路径/读写/Diff/轮次/工具调用，并且不隐式执行 stash、reset、commit、push、发包或部署。默认应用模式必须经过审阅。
+安全边界包括：不向模型开放任意 Shell、不把 API Key 放入浏览器、限制路径/读写/Diff/轮次/工具调用；只读路径被拒绝时保持零读取、零修改，并允许 Agent 在既有边界内改用合法发现结果继续执行；不隐式执行 stash、reset、commit、push、发包或部署。默认应用模式必须经过审阅。
 
 要求 Node.js `>=20.19.0`。
 

package/dist/index.cjs

@@ -1872,7 +1872,7 @@ var AGENT_TOOL_DEFINITIONS = Object.freeze([
   }),
   Object.freeze({
     name: AGENT_TOOL_NAMES.readFile,
-    description: "Read a bounded inclusive line range from one allowed UTF-8 text file.",
+    description: "Read a bounded inclusive line range from one allowed UTF-8 text file. Choose paths returned by list_files or search_text. A retryable TOOL_PATH_DENIED result means no file was read or changed: do not retry that path; discover an allowed path instead.",
     parameters: Object.freeze({
       type: "object",
       properties: Object.freeze({
@@ -2018,6 +2018,14 @@ function retryableArgumentsRejection() {
     guidance: "No files changed. Retry once with a new tool call ID and only the declared fields and value types."
   });
 }
+function retryableReadRejection() {
+  return Object.freeze({
+    errorCode: import_shared15.ERROR_CODES.TOOL_PATH_DENIED,
+    retryable: true,
+    reason: "PATH_UNAVAILABLE",
+    guidance: "No file was read or changed. Do not retry the same path. Use list_files or search_text, then read only an allowed path returned by that tool. Protected, external, missing, symlinked, directory, binary, and non-UTF-8 paths are unavailable."
+  });
+}
 function createAgentToolExecutor(options) {
   const cacheByTurn = /* @__PURE__ */ new Map();
   const fileCatalog = createAgentFileCatalog(options.worktreeRoot);
@@ -2117,7 +2125,15 @@ function createAgentToolExecutor(options) {
       }
       case AGENT_TOOL_NAMES.readFile: {
         const input = parseArguments(readFileSchema, call.arguments);
-        const file = await readTextFile(input.path);
+        let file;
+        try {
+          file = await readTextFile(input.path);
+        } catch (error) {
+          if (error instanceof import_shared15.SpotPatchError && error.code === import_shared15.ERROR_CODES.TOOL_PATH_DENIED) {
+            return retryableReadRejection();
+          }
+          throw error;
+        }
         const lines = file.content.split(/\r?\n/u);
         const startLine = input.startLine ?? 1;
         const endLine = input.endLine ?? Math.min(lines.length, startLine + 199);
@@ -2859,6 +2875,7 @@ Follow these rules exactly:
 - Every patch must begin with 'diff --git a/<path> b/<path>', include matching '--- a/<path>' and '+++ b/<path>' headers and valid '@@' hunks. Send only the raw diff: no Markdown fences, prose, shell commands, or '*** Begin Patch' markers.
 - If a write tool returns a retryable PATCH_REJECTED result, no file changed. Follow its guidance, re-read the current file, and retry once with a new tool call ID.
 - If any tool returns a retryable TOOL_ARGUMENTS_INVALID result, no file changed. Retry once with a new tool call ID using only the declared fields and value types.
+- If read_file returns a retryable TOOL_PATH_DENIED result, no file was read or changed. Do not retry that path. Use list_files or search_text and choose an allowed path returned by the tool; never probe protected, external, generated, credential, environment, or lock files.
 - Never modify credentials, environment files, lockfiles, generated output, Git metadata, or dependencies.
 - Run each relevant configured check after the final write so failures can be corrected. Do not rerun an unchanged check, and do not claim a check passed unless run_check returned a passed status.
 - Finish with a concise factual summary after all needed tool calls. Do not include secrets or absolute paths.`;
@@ -3091,7 +3108,7 @@ function isRetryableToolFailure(result) {
     return false;
   }
   const candidate = output;
-  return candidate.retryable === true && (candidate.errorCode === import_shared20.ERROR_CODES.PATCH_REJECTED || candidate.errorCode === import_shared20.ERROR_CODES.TOOL_ARGUMENTS_INVALID);
+  return candidate.retryable === true && (candidate.errorCode === import_shared20.ERROR_CODES.PATCH_REJECTED || candidate.errorCode === import_shared20.ERROR_CODES.TOOL_ARGUMENTS_INVALID || candidate.errorCode === import_shared20.ERROR_CODES.TOOL_PATH_DENIED);
 }
 function throwIfCancelled(signal) {
   if (signal.aborted) {