cluxion-agentplugin-supercoder 0.2.7__tar.gz → 0.2.8__tar.gz

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cluxion-agentplugin-supercoder
-Version: 0.2.7
+Version: 0.2.8
 Summary: Universal agent coding harness plugin: cursor logic, safe patch, line budget, Rust index, test gates.
 Project-URL: Homepage, https://github.com/cluxion/cluxion-Agentplugin-supercoder
 Project-URL: Repository, https://github.com/cluxion/cluxion-Agentplugin-supercoder

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/__init__.py

@@ -9,4 +9,4 @@ if str(_SRC) not in sys.path:
 
 from cluxion_agentplugin_supercoder.plugin import register
 
-__all__ = ["register"]
+__all__ = ["register"]

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cluxion-agentplugin-supercoder"
-version = "0.2.7"
+version = "0.2.8"
 description = "Universal agent coding harness plugin: cursor logic, safe patch, line budget, Rust index, test gates."
 readme = "README.md"
 requires-python = ">=3.11"

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/scripts/repack_native_wheel.py

@@ -44,11 +44,7 @@ def _dist_info(tree: Path) -> Path:
 
 def _native_tags(native_tree: Path) -> list[str]:
     wheel_meta = (_dist_info(native_tree) / "WHEEL").read_text(encoding="utf-8")
-    tags = [
-        line.split(":", 1)[1].strip()
-        for line in wheel_meta.splitlines()
-        if line.startswith("Tag:")
-    ]
+    tags = [line.split(":", 1)[1].strip() for line in wheel_meta.splitlines() if line.startswith("Tag:")]
     if not tags:
         raise SystemExit("native wheel has no Tag entries")
     return tags

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/src/cluxion_agentplugin_supercoder/cli.py

@@ -52,6 +52,7 @@ def main(argv: Sequence[str] | None = None) -> int:
 def load_catalog_for_text(catalog_path):
     # helper to avoid circular, but since framework has load_catalog
     from cluxion_agentplugin_supercoder.doctor.framework import load_catalog
+
     return load_catalog(Path(str(catalog_path)))
 
 

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/src/cluxion_agentplugin_supercoder/core/cursor.py

@@ -6,6 +6,7 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from cluxion_agentplugin_supercoder.core.hash_patch import file_hash
+from cluxion_agentplugin_supercoder.core.safety import pre_tool_gate
 
 
 @dataclass(frozen=True)
@@ -27,11 +28,14 @@ def read_window(
     max_lines: int = 120,
     purpose: str = "read",
 ) -> LineWindow:
+    gate = pre_tool_gate("read_window", {"path": rel_path}, workspace=root)
+    if gate.decision == "block":
+        raise PermissionError(gate.reason)
     path = (root / rel_path).resolve()
     if not path.exists():
         raise FileNotFoundError(rel_path)
-    if not str(path).startswith(str(root.resolve())):
-        raise PermissionError("path escapes workspace root")
+    if not path.is_relative_to(root.resolve()):
+        raise PermissionError("workspace escape blocked")
     text = path.read_text(encoding="utf-8")
     lines = text.splitlines()
     start = max(1, start_line)

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/src/cluxion_agentplugin_supercoder/core/hash_patch.py

@@ -77,7 +77,9 @@ def apply_patch(
         exact = _exact_spans(text, old_text)
         if exact:
             start, end = exact[0]
-            return _commit(path, text, start, end, new_text, "exact", expected_file_hash or current_hash, current_hash, 1.0)
+            return _commit(
+                path, text, start, end, new_text, "exact", expected_file_hash or current_hash, current_hash, 1.0
+            )
         fuzzy = _best_fuzzy_span(text, old_text)
         if fuzzy and fuzzy[3] >= fuzzy_threshold and not fuzzy[4]:
             return _commit(
@@ -172,9 +174,7 @@ def _best_fuzzy_span(text: str, reference: str) -> tuple[int, int, str, float, b
 def _atomic_write(path: Path, content: str) -> None:
     """Atomic replace via temp in same dir + fsync to prevent corruption on crash."""
     dir_ = path.parent
-    with tempfile.NamedTemporaryFile(
-        mode="w", encoding="utf-8", dir=dir_, delete=False, suffix=".tmp"
-    ) as tmp:
+    with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=dir_, delete=False, suffix=".tmp") as tmp:
         tmp.write(content)
         tmp.flush()
         os.fsync(tmp.fileno())

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/src/cluxion_agentplugin_supercoder/doctor/framework.py

@@ -45,14 +45,23 @@ class DoctorResult:
     version: str
     checks: tuple[CheckResult, ...]
 
+    @property
+    def summary(self) -> str:
+        if any(c.status == "fail" for c in self.checks):
+            return "fail"
+        if any(c.severity == "critical" and c.status == "skip" for c in self.checks):
+            return "degraded"
+        return "ok"
+
     @property
     def ok(self) -> bool:
-        return not any(c.status == "fail" for c in self.checks)
+        return self.summary == "ok"
 
     def to_json_object(self) -> dict[str, Any]:
         return {
             "plugin": self.plugin,
             "version": self.version,
+            "summary": self.summary,
             "checks": [
                 {
                     "check_id": c.check_id,
@@ -68,9 +77,7 @@ class DoctorResult:
 
 
 class DoctorContext:
-    def __init__(
-        self, cwd: Path, hermes_bin: str, run: Callable[[list[str]], subprocess.CompletedProcess]
-    ) -> None:
+    def __init__(self, cwd: Path, hermes_bin: str, run: Callable[[list[str]], subprocess.CompletedProcess]) -> None:
         self.cwd = cwd
         self.hermes_bin = hermes_bin
         self.run = run
@@ -151,14 +158,10 @@ def run_doctor(
 
 
 def render_json(result: DoctorResult) -> str:
-    return json.dumps(
-        result.to_json_object(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
-    )
+    return json.dumps(result.to_json_object(), ensure_ascii=False, sort_keys=True, separators=(",", ":"))
 
 
-def render_text(
-    result: DoctorResult, catalog: tuple[CatalogEntry, ...], *, verbose: bool = False
-) -> str:
+def render_text(result: DoctorResult, catalog: tuple[CatalogEntry, ...], *, verbose: bool = False) -> str:
     entry_map = {e.check_id: e for e in catalog}
     lines: list[str] = []
     for c in result.checks:

cluxion_agentplugin_supercoder-0.2.8/src/cluxion_agentplugin_supercoder/doctor/probes.py

@@ -0,0 +1,355 @@
+"""Plugin-specific probes for supercoder doctor. Cross-cutting + selected specific checks."""
+
+from __future__ import annotations
+
+import importlib.metadata
+import importlib.util
+import json
+import os
+import shutil
+import tempfile
+from collections.abc import Callable
+from pathlib import Path
+
+from .framework import DoctorContext
+
+PROBES: dict[str, Callable[[DoctorContext], tuple[str, str]]] = {}
+
+_HERMES_ABSENT_SKIP = "hermes binary not on PATH — cannot verify"
+
+
+def _hermes_path(ctx: DoctorContext) -> str | None:
+    return shutil.which(ctx.hermes_bin)
+
+
+def _register(name: str):
+    def deco(fn):
+        PROBES[name] = fn
+        return fn
+
+    return deco
+
+
+@_register("hermes_on_path")
+def hermes_on_path(ctx: DoctorContext) -> tuple[str, str]:
+    p = _hermes_path(ctx)
+    if p:
+        return "pass", str(p)
+    return "skip", _HERMES_ABSENT_SKIP
+
+
+@_register("hermes_version")
+def hermes_version(ctx: DoctorContext) -> tuple[str, str]:
+    if _hermes_path(ctx) is None:
+        return "skip", _HERMES_ABSENT_SKIP
+    try:
+        cp = ctx.run([ctx.hermes_bin, "--version"])
+        if cp.returncode == 0 and "Hermes Agent v" in cp.stdout:
+            return "pass", cp.stdout.strip()
+        return "fail", cp.stdout.strip() or cp.stderr.strip()
+    except Exception as e:
+        return "fail", f"run error: {e}"
+
+
+@_register("hermes_oneshot_flag")
+def hermes_oneshot_flag(ctx: DoctorContext) -> tuple[str, str]:
+    if _hermes_path(ctx) is None:
+        return "skip", _HERMES_ABSENT_SKIP
+    try:
+        cp = ctx.run([ctx.hermes_bin, "--help"])
+        out = cp.stdout + cp.stderr
+        if "-z" in out and "--oneshot" in out:
+            return "pass", "present"
+        return "fail", "missing in --help"
+    except Exception as e:
+        return "fail", f"run error: {e}"
+
+
+@_register("entry_point_registered")
+def entry_point_registered(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        eps = importlib.metadata.entry_points(group="hermes_agent.plugins")
+        for ep in eps:
+            if "cluxion-agentplugin-supercoder" in (ep.name or "").lower() or "cluxion_agentplugin_supercoder" in (
+                ep.value or ""
+            ):
+                mod = ep.load()
+                if hasattr(mod, "register") and callable(mod.register):
+                    return "pass", ep.value or str(ep)
+        return "warn", "entry point metadata not present (dev PYTHONPATH ok)"
+    except Exception as e:
+        return "fail", f"metadata error: {e}"
+
+
+@_register("toolset_valid")
+def toolset_valid(ctx: DoctorContext) -> tuple[str, str]:
+    if _hermes_path(ctx) is None:
+        return "skip", _HERMES_ABSENT_SKIP
+    try:
+        cp = ctx.run([ctx.hermes_bin, "tools", "list"])
+        if cp.returncode == 0 and "supercoder" in cp.stdout:
+            return "pass", "supercoder present"
+        return "fail", "supercoder not in tools list"
+    except Exception as e:
+        return "fail", f"run error: {e}"
+
+
+@_register("install_integrity")
+def install_integrity(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder import __version__ as pkg_version
+
+        dist_version = importlib.metadata.version("cluxion-agentplugin-supercoder")
+        if dist_version == pkg_version:
+            return "pass", dist_version
+        return "warn", f"dist={dist_version} pkg={pkg_version}"
+    except Exception as e:
+        return "warn", f"version error: {e}"
+
+
+@_register("native_module_importable")
+def native_module_importable(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        mod = __import__("supercoder_index_native")
+        if hasattr(mod, "run"):
+            return "pass", "imported (native backend available)"
+        return "warn", "imported but expected symbols missing"
+    except Exception:
+        return "warn", "native missing → using fallback (slower)"
+
+
+# plugin-specific probes (deterministic ones only) - for supercoder we can add if symbols found
+# for now, handler_exception_coverage is cross-cutting
+@_register("handler_exception_coverage")
+def handler_exception_coverage(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder import runner
+        from cluxion_agentplugin_supercoder.plugin import _wrap
+
+        def bad_cb(_payload: dict[str, object]) -> runner.ToolResult:
+            raise TypeError("test TypeError for coverage")
+
+        result = _wrap(bad_cb)({})
+        parsed = json.loads(result)
+        if parsed.get("ok") is False and "TypeError" in str(parsed.get("error", "")):
+            return "pass", "degraded to error JSON"
+        return "fail", f"no error json: {result[:100]}"
+    except Exception as e:
+        return "skip", f"cannot invoke guard: {e}"
+
+
+# NEW deterministic probes for previously-skipped catalog checks (import-avail, json-det, abi3/sqlite patterns adapted)
+# hermes_requirements_installed (import availability using find_spec to satisfy linter)
+@_register("hermes_requirements_installed")
+def hermes_requirements_installed(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        if importlib.util.find_spec("psutil") and importlib.util.find_spec("yaml"):
+            return "pass", "psutil+PyYAML importable"
+        return "warn", "missing dep"
+    except Exception as e:
+        return "skip", f"import check error: {e}"
+
+
+# repo_map_deterministic (json determinism + real call)
+@_register("repo_map_deterministic")
+def repo_map_deterministic(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder.core.repo_map import build_repo_map
+
+        m1 = build_repo_map(ctx.cwd, budget_chars=2000)
+        m2 = build_repo_map(ctx.cwd, budget_chars=2000)
+
+        def strip(d):
+            if isinstance(d, dict):
+                return {k: strip(v) for k, v in d.items() if k != "_stats"}
+            if isinstance(d, list):
+                return [strip(x) for x in d]
+            return d
+
+        if strip(m1) == strip(m2):
+            j1 = json.dumps(m1, sort_keys=True)
+            j2 = json.dumps(m2, sort_keys=True)
+            if j1 == j2:
+                return "pass", "deterministic + json roundtrip ok"
+            return "warn", "map match but json not"
+        return "fail", "non-deterministic"
+    except Exception as e:
+        return "skip", f"cannot run: {e}"
+
+
+# ruff_binary_discoverable (real env/path probe)
+@_register("ruff_binary_discoverable")
+def ruff_binary_discoverable(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        envb = os.environ.get("CLUXION_SUPERCODER_RUFF_BIN")
+        if envb and Path(envb).is_file():
+            return "pass", envb
+        cands = [Path(ctx.cwd) / ".venv/bin/ruff", shutil.which("ruff")]
+        for c in cands:
+            if c and Path(c).is_file():
+                return "pass", str(c)
+        return "warn", "no ruff binary (advisory)"
+    except Exception as e:
+        return "skip", f"probe error: {e}"
+
+
+# file_hash_consistency (real check)
+@_register("file_hash_consistency")
+def file_hash_consistency(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder.core.hash_patch import _normalize_newlines, file_hash
+
+        c = "a=1\r\nb=2"
+        if file_hash(c) == file_hash(_normalize_newlines(c)):
+            return "pass", "CRLF safe"
+        return "fail", "hash mismatch"
+    except Exception as e:
+        return "skip", f"hash error: {e}"
+
+
+_SECRET_BLOCKED = "secret file access blocked"
+_ESCAPE_BLOCKED = "workspace escape blocked"
+
+
+def _assert_tool_blocks(
+    tool_fn: Callable[[dict[str, object]], object],
+    *,
+    cwd: str,
+    path: str,
+    expected_error: str,
+    extra: dict[str, object] | None = None,
+) -> str | None:
+    from cluxion_agentplugin_supercoder import runner
+
+    payload: dict[str, object] = {"cwd": cwd, "path": path}
+    if extra:
+        payload.update(extra)
+    result = tool_fn(payload)
+    if not isinstance(result, runner.ToolResult):
+        return f"unexpected result type for {path}"
+    if result.ok or result.payload.get("error") != expected_error:
+        return f"{tool_fn.__name__} on {path}: ok={result.ok} error={result.payload.get('error')}"
+    return None
+
+
+@_register("path_security_secrets_blocked")
+def path_security_secrets_blocked(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder import runner
+
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / ".env").write_text("KEY=secret", encoding="utf-8")
+            cred = root / "config" / "credentials"
+            cred.mkdir(parents=True)
+            (cred / "db.json").write_text("{}", encoding="utf-8")
+            for rel in (".env", "config/credentials/db.json"):
+                for tool_fn, extra in (
+                    (runner.read_window_tool, None),
+                    (runner.patch_tool, {"old_text": "x", "new_text": "y", "syntax_gate": False}),
+                ):
+                    err = _assert_tool_blocks(
+                        tool_fn,
+                        cwd=str(root),
+                        path=rel,
+                        expected_error=_SECRET_BLOCKED,
+                        extra=extra,
+                    )
+                    if err:
+                        return "fail", err
+            return "pass", "read_window_tool + patch_tool block .env and credentials"
+    except Exception as e:
+        return "skip", f"cannot run: {e}"
+
+
+@_register("hermes_context_workspace_root")
+def hermes_context_workspace_root(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder import runner
+
+        with tempfile.TemporaryDirectory() as td:
+            base = Path(td)
+            outside = base / "outside"
+            outside.mkdir()
+            (outside / "secret.txt").write_text("leaked", encoding="utf-8")
+            workspace = base / "work"
+            workspace.mkdir()
+            sibling = base / "work2"
+            sibling.mkdir()
+            (sibling / "x").write_text("leaked", encoding="utf-8")
+            for path in ("../outside/secret.txt", "../work2/x"):
+                err = _assert_tool_blocks(
+                    runner.read_window_tool,
+                    cwd=str(workspace),
+                    path=path,
+                    expected_error=_ESCAPE_BLOCKED,
+                )
+                if err:
+                    return "fail", err
+            return "pass", "traversal + sibling-prefix escape blocked"
+    except Exception as e:
+        return "skip", f"cannot run: {e}"
+
+
+@_register("patch_cursor_validity")
+def patch_cursor_validity(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder import runner
+        from cluxion_agentplugin_supercoder.core.cursor import read_window
+
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            target = root / "t.py"
+            target.write_text("x=1", encoding="utf-8")
+            window = read_window(root, "t.py")
+            target.write_text("x=2", encoding="utf-8")
+            result = runner.patch_tool(
+                {
+                    "cwd": str(root),
+                    "path": "t.py",
+                    "old_text": "x=1",
+                    "new_text": "x=3",
+                    "expected_file_hash": window.file_hash,
+                    "syntax_gate": False,
+                    "lint_gate": False,
+                }
+            )
+            if result.ok:
+                return "fail", "patch applied with stale hash"
+            if result.payload.get("strategy") != "stale_file":
+                return "fail", f"expected stale_file, got {result.payload.get('strategy')}"
+            return "pass", "stale hash blocked"
+    except Exception as e:
+        return "skip", f"cannot run: {e}"
+
+
+@_register("stale_cursor_protection_enforced")
+def stale_cursor_protection_enforced(ctx: DoctorContext) -> tuple[str, str]:
+    try:
+        from cluxion_agentplugin_supercoder import runner
+
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / "t.py").write_text("x=1", encoding="utf-8")
+            result = runner.patch_tool(
+                {
+                    "cwd": str(root),
+                    "path": "t.py",
+                    "old_text": "x",
+                    "new_text": "y",
+                    "stale_cursor": True,
+                    "syntax_gate": False,
+                    "lint_gate": False,
+                }
+            )
+            if result.ok:
+                return "fail", "patch applied with stale_cursor=True"
+            error = str(result.payload.get("error", ""))
+            if "stale cursor" not in error:
+                return "fail", f"unexpected error: {error}"
+            return "pass", "stale_cursor flag blocked"
+    except Exception as e:
+        return "skip", f"cannot run: {e}"
+
+
+# note: other checks in catalog will be reported as skip (no probe)

{cluxion_agentplugin_supercoder-0.2.7 → cluxion_agentplugin_supercoder-0.2.8}/src/cluxion_agentplugin_supercoder/runner.py

@@ -73,6 +73,14 @@ def plan(payload: Mapping[str, object]) -> ToolResult:
 def read_window_tool(payload: Mapping[str, object]) -> ToolResult:
     root = _workspace(payload)
     rel = str(payload.get("path", "")).strip()
+    gate = pre_tool_gate(
+        "read_window",
+        payload,
+        workspace=root,
+        stale_cursor=bool(payload.get("stale_cursor", False)),
+    )
+    if gate.decision == "block":
+        return ToolResult(False, {"error": gate.reason})
     start = _int(payload.get("start_line", 1), 1)
     max_lines = _int(payload.get("max_lines", 120), 120)
     decision = budget_for("inspect", requested_lines=max_lines)
@@ -182,7 +190,10 @@ def repo_map_tool(payload: Mapping[str, object]) -> ToolResult:
     result = repo_map.build_repo_map(
         _workspace(payload),
         max_files=_int(payload.get("max_files", repo_map.DEFAULT_MAX_FILES), repo_map.DEFAULT_MAX_FILES),
-        max_symbols_per_file=_int(payload.get("max_symbols_per_file", repo_map.DEFAULT_MAX_SYMBOLS_PER_FILE), repo_map.DEFAULT_MAX_SYMBOLS_PER_FILE),
+        max_symbols_per_file=_int(
+            payload.get("max_symbols_per_file", repo_map.DEFAULT_MAX_SYMBOLS_PER_FILE),
+            repo_map.DEFAULT_MAX_SYMBOLS_PER_FILE,
+        ),
         budget_chars=_int(payload.get("budget_chars", repo_map.DEFAULT_BUDGET_CHARS), repo_map.DEFAULT_BUDGET_CHARS),
     )
     return ToolResult(bool(result.get("ok", False)), {key: value for key, value in result.items() if key != "ok"})

cluxion_agentplugin_supercoder-0.2.8/tests/test_cursor.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from cluxion_agentplugin_supercoder import runner
+from cluxion_agentplugin_supercoder.core.cursor import read_window
+
+
+def test_read_window_bounds(tmp_path: Path) -> None:
+    path = tmp_path / "sample.py"
+    path.write_text("\n".join(f"line{i}" for i in range(1, 201)), encoding="utf-8")
+    window = read_window(tmp_path, "sample.py", start_line=10, max_lines=5)
+    assert window.start_line == 10
+    assert window.end_line == 14
+    assert "line10" in window.content
+
+
+@pytest.mark.parametrize("rel", [".env", "config/credentials/db.json"])
+def test_read_window_blocks_secret_files(tmp_path: Path, rel: str) -> None:
+    target = tmp_path / rel
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text("AWS_SECRET=leaked", encoding="utf-8")
+    with pytest.raises(PermissionError, match="secret file access blocked"):
+        read_window(tmp_path, rel)
+
+
+def test_read_window_blocks_sibling_directory_prefix_escape(tmp_path: Path) -> None:
+    workspace = tmp_path / "work"
+    workspace.mkdir()
+    sibling = tmp_path / "work2"
+    sibling.mkdir()
+    (sibling / "secret.py").write_text("leaked", encoding="utf-8")
+    with pytest.raises(PermissionError, match="workspace escape blocked"):
+        read_window(workspace, "../work2/secret.py")
+
+
+def test_read_window_blocks_plain_traversal(tmp_path: Path) -> None:
+    workspace = tmp_path / "work"
+    workspace.mkdir()
+    with pytest.raises(PermissionError, match="workspace escape blocked"):
+        read_window(workspace, "../../etc/passwd")
+
+
+@pytest.mark.parametrize("rel", [".env", "config/credentials/db.json"])
+def test_read_window_tool_blocks_secret_files(tmp_path: Path, rel: str) -> None:
+    target = tmp_path / rel
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text("AWS_SECRET=leaked", encoding="utf-8")
+    result = runner.read_window_tool({"cwd": str(tmp_path), "path": rel})
+    assert result.ok is False
+    assert result.payload["error"] == "secret file access blocked"
+
+
+def test_read_window_tool_blocks_sibling_directory_prefix_escape(tmp_path: Path) -> None:
+    workspace = tmp_path / "work"
+    workspace.mkdir()
+    sibling = tmp_path / "work2"
+    sibling.mkdir()
+    (sibling / "secret.py").write_text("leaked", encoding="utf-8")
+    result = runner.read_window_tool({"cwd": str(workspace), "path": "../work2/secret.py"})
+    assert result.ok is False
+    assert result.payload["error"] == "workspace escape blocked"
+
+
+def test_read_window_tool_allows_normal_in_workspace_file(tmp_path: Path) -> None:
+    path = tmp_path / "sample.py"
+    path.write_text("print('ok')\n", encoding="utf-8")
+    result = runner.read_window_tool({"cwd": str(tmp_path), "path": "sample.py"})
+    assert result.ok is True
+    assert "print('ok')" in str(result.payload["content"])