langchain-agentx-python 1.3.0__py3-none-any.whl → 1.3.2__py3-none-any.whl

langchain_agentx/__init__.py

@@ -11,7 +11,7 @@ from langchain_agentx import create_loop_agent
 ```
 """
 
-__version__ = "1.3.0"
+__version__ = "1.3.2"
 
 from .loop import (  # noqa: F401
     create_loop_agent,

langchain_agentx/loop/graph/factory.py

@@ -502,19 +502,26 @@ class LoopGraphBuilder:
             from ...memory.session import make_session_memory_section
 
             self._dynamic_sections.append(make_session_memory_section(session_summary_path))
+        instruction_bootstrap = InstructionMemoryBootstrap(
+            workspace_root=Path(self._workspace_root),
+            agent_home_segment=self._agent_home_segment,
+            managed_rules=self._config.managed_rules,
+            claude_md_excludes=self._config.claude_md_excludes,
+            active_files_provider=(
+                CallbackActiveFilesProvider(self._services.active_files_getter)
+                if self._services.active_files_getter is not None
+                else None
+            ),
+        )
+        loaded_instruction_rules = instruction_bootstrap.load_rule_set()
         self._dynamic_sections.extend(
-            InstructionMemoryBootstrap(
-                workspace_root=Path(self._workspace_root),
-                agent_home_segment=self._agent_home_segment,
-                managed_rules=self._config.managed_rules,
-                claude_md_excludes=self._config.claude_md_excludes,
-                active_files_provider=(
-                    CallbackActiveFilesProvider(self._services.active_files_getter)
-                    if self._services.active_files_getter is not None
-                    else None
-                ),
-            ).build_sections()
+            instruction_bootstrap.build_sections(loaded_instruction_rules)
         )
+        if session_store is not None:
+            instruction_bootstrap.seed_injected_read_state(
+                session_store,
+                loaded_instruction_rules,
+            )
         self._dynamic_sections.extend(
             MemoryPromptBootstrap(
                 workspace_root=Path(self._workspace_root),
@@ -772,6 +779,8 @@ class LoopGraphBuilder:
             session_store=session_store,
             schema_cache_namespace=schema_cache_namespace,
         )
+        if self._loop_loader is not None:
+            self._loop_loader.refresh_search_ignore_patterns(session_store=session_store)
         if self._runtime_tools and self._loop_loader is not None:
             self._tool_prompt_ctx = self._build_tool_prompt_context(
                 session_store=session_store,

langchain_agentx/memory/instruction/read_state_seeder.py

@@ -0,0 +1,78 @@
+"""
+memory/instruction/read_state_seeder.py — 指令注入 read-state 播种
+
+职责：
+    将 Layer 1 规则文件注入 prompt 时同步写入 ``AgentSessionStore.file_read_state``；
+    注入内容与磁盘不一致时标记 ``is_partial_view``（对齐 CC attachments memoryFilesToAttachments）。
+
+链路位置：
+    LoopGraphBuilder 初始化 → InstructionMemoryBootstrap.seed_injected_read_state()。
+
+当前裁剪范围：
+    仅 Layer 1 ``LoadedRuleSet`` 文件路径；不含 memdir prefetch / session memory。
+"""
+
+from __future__ import annotations
+
+import time
+from pathlib import Path
+from typing import Iterable
+
+from langchain_agentx.tool_runtime.session_store import AgentSessionStore
+from langchain_agentx.utils.file_mtime import FileModificationTimeReader
+
+from .loader import strip_html_comments
+from .types import LoadedRuleSet, RuleFile
+
+
+class InstructionReadStateSeeder:
+    """指令规则注入时播种 last_read（partial view 语义）。"""
+
+    def __init__(self, *, mtime_reader: FileModificationTimeReader | None = None) -> None:
+        self._mtime_reader = mtime_reader or FileModificationTimeReader()
+
+    def seed(self, session_store: AgentSessionStore, loaded: LoadedRuleSet) -> None:
+        for path, injected_content in self._iter_path_content_pairs(loaded):
+            self._seed_path(session_store, path, injected_content)
+
+    def _iter_path_content_pairs(self, loaded: LoadedRuleSet) -> Iterable[tuple[Path, str]]:
+        if loaded.user is not None and loaded.user.path is not None:
+            yield loaded.user.path, loaded.user.content
+        for rule_file in loaded.project_files:
+            if rule_file.path is not None:
+                yield rule_file.path, rule_file.content
+        if loaded.local is not None and loaded.local.path is not None:
+            yield loaded.local.path, loaded.local.content
+        for rule in loaded.conditional_rules:
+            yield rule.path, rule.content
+
+    def _seed_path(
+        self,
+        session_store: AgentSessionStore,
+        file_path: Path,
+        injected_content: str,
+    ) -> None:
+        path = str(file_path.resolve())
+        if session_store.has_been_read(path):
+            return
+        try:
+            raw_disk = file_path.read_text(encoding="utf-8")
+        except OSError:
+            return
+
+        injected_view = strip_html_comments(injected_content)
+        content_differs = injected_view != raw_disk
+        mtime_ms = self._mtime_reader.read_ms(path)
+        entry: dict[str, object] = {
+            "tool_call_id": None,
+            "ts": time.time(),
+            "offset": None,
+            "limit": None,
+            "mtime_ms": mtime_ms,
+            "line_start": None,
+            "line_end": None,
+            "content": raw_disk if content_differs else injected_view,
+        }
+        if content_differs:
+            entry["is_partial_view"] = True
+        session_store.upsert_last_read_from_bridge_entry(path, entry)

langchain_agentx/memory/instruction/runtime.py

@@ -15,13 +15,15 @@ from __future__ import annotations
 import logging
 from collections.abc import Callable, Sequence
 from pathlib import Path
+from typing import Any
 
 from langchain_agentx.loop.prompt import SystemPromptSection
 from langchain_agentx.workspace import resolve_agent_state_config
 
 from .loader import load_rule_set
+from .read_state_seeder import InstructionReadStateSeeder
 from .sections import make_instruction_sections
-from .types import InstructionMemoryConfig
+from .types import InstructionMemoryConfig, LoadedRuleSet
 
 logger = logging.getLogger(__name__)
 
@@ -43,31 +45,53 @@ class InstructionMemoryBootstrap:
         self._include_depth_limit = include_depth_limit
         self._claude_md_excludes = tuple(claude_md_excludes)
         self._active_files_provider = active_files_provider or NullActiveFilesProvider()
+        self._read_state_seeder = InstructionReadStateSeeder()
 
-    def build_sections(self) -> list[SystemPromptSection]:
+    def _build_config(self) -> InstructionMemoryConfig:
         workspace_cfg = resolve_agent_state_config(
             workspace_root=self._workspace_root,
             agent_home_segment=self._agent_home_segment,
         )
-        loaded_rules = load_rule_set(
-            InstructionMemoryConfig(
-                workspace_cfg=workspace_cfg,
-                managed_rules=self._managed_rules,
-                load_user_layer=True,
-                include_depth_limit=self._include_depth_limit,
-                claude_md_excludes=self._claude_md_excludes,
-            )
+        return InstructionMemoryConfig(
+            workspace_cfg=workspace_cfg,
+            managed_rules=self._managed_rules,
+            load_user_layer=True,
+            include_depth_limit=self._include_depth_limit,
+            claude_md_excludes=self._claude_md_excludes,
         )
+
+    def load_rule_set(self) -> LoadedRuleSet:
+        loaded_rules = load_rule_set(self._build_config())
         if loaded_rules.external_include_warnings:
             logger.warning(
                 "instruction_memory: external @path includes detected outside workspace: %s",
                 ", ".join(loaded_rules.external_include_warnings),
             )
+        return loaded_rules
+
+    def build_sections(
+        self,
+        loaded_rules: LoadedRuleSet | None = None,
+    ) -> list[SystemPromptSection]:
+        rules = loaded_rules if loaded_rules is not None else self.load_rule_set()
         return make_instruction_sections(
-            loaded_rules,
+            rules,
             active_files_getter=self._active_files_provider.get_active_files,
         )
 
+    def seed_injected_read_state(
+        self,
+        session_store: Any,
+        loaded_rules: LoadedRuleSet | None = None,
+    ) -> None:
+        """注入 Layer 1 规则后播种 file_read_state（CC readFileState 对齐）。"""
+        from langchain_agentx.tool_runtime.session_store import AgentSessionStore
+
+        if not isinstance(session_store, AgentSessionStore):
+            return
+        rules = loaded_rules if loaded_rules is not None else self.load_rule_set()
+        self._read_state_seeder.seed(session_store, rules)
+
 
 class ActiveFilesProvider:
     """active_files 提供器接口。"""

langchain_agentx/plugin/loader.py

@@ -245,8 +245,9 @@ class PluginLoader:
 
     async def _register_skills(self, plugins: list[LoadedPlugin]) -> list[PluginError]:
         errors: list[PluginError] = []
+        cwd = self._cfg.workspace_root
         for plugin in plugins:
-            errors.extend(self._skill_registry.register(plugin))
+            errors.extend(self._skill_registry.register(plugin, cwd=cwd))
         return errors
 
     async def _register_commands(self, plugins: list[LoadedPlugin]) -> list[PluginError]:

langchain_agentx/plugin/registries.py

@@ -13,11 +13,16 @@ plugin/registries.py — Plugin 能力注册表（Skill/Command/Agent）。
 
 from __future__ import annotations
 
+import logging
 from dataclasses import dataclass
 from pathlib import Path
 
+from langchain_agentx.tools.skill.guards import SkillsGitignoreGuard
+
 from .types import ComponentLoadFailedError, LoadedPlugin, PluginError
 
+logger = logging.getLogger(__name__)
+
 
 @dataclass(frozen=True)
 class SkillEntry:
@@ -43,15 +48,37 @@ class AgentDefinitionEntry:
 
 
 class SkillRegistry:
-    def __init__(self) -> None:
+    def __init__(
+        self,
+        *,
+        workspace_root: str | Path | None = None,
+        gitignore_guard: SkillsGitignoreGuard | None = None,
+    ) -> None:
         self._skills: dict[str, SkillEntry] = {}
         self._by_plugin: dict[str, list[str]] = {}
-
-    def register(self, plugin: LoadedPlugin) -> list[PluginError]:
+        self._workspace_root = (
+            Path(workspace_root).resolve() if workspace_root is not None else None
+        )
+        self._gitignore_guard = gitignore_guard or SkillsGitignoreGuard()
+
+    def register(
+        self,
+        plugin: LoadedPlugin,
+        *,
+        cwd: str | Path | None = None,
+    ) -> list[PluginError]:
         if plugin.skills_dir is None or not plugin.skills_dir.exists():
             self._by_plugin[plugin.source] = []
             return []
 
+        work_cwd = cwd if cwd is not None else self._workspace_root
+        if work_cwd is not None and self._gitignore_guard.should_skip_skills_dir(
+            plugin.skills_dir,
+            cwd=work_cwd,
+        ):
+            self._by_plugin[plugin.source] = []
+            return []
+
         errors: list[PluginError] = []
         registered: list[str] = []
         for skill_dir in sorted(plugin.skills_dir.iterdir()):

langchain_agentx/session/agent_session.py

@@ -97,7 +97,7 @@ class AgentSession:
             resource_root=workspace_cfg.workspace_root,
             agent_home_segment=workspace_cfg.agent_home_segment,
         )
-        self._skill_registry = SkillRegistry()
+        self._skill_registry = SkillRegistry(workspace_root=workspace_cfg.workspace_root)
         self._command_registry = PluginCommandRegistry()
         self._agent_registry = AgentRegistry()
         self._runtime_command_registry = CommandRegistry()

langchain_agentx/session/conversation_session.py

@@ -71,7 +71,7 @@ class ConversationSession:
         self._container_type = "conversation"
         self._session_memory_manager: Any | None = None
         self._capabilities = capabilities
-        self._skill_registry = SkillRegistry()
+        self._skill_registry = SkillRegistry(workspace_root=workspace_cfg.workspace_root)
         self._command_registry = PluginCommandRegistry()
         self._agent_registry = AgentRegistry()
         self._runtime_command_registry = CommandRegistry()

langchain_agentx/tool_runtime/__init__.py

@@ -44,7 +44,11 @@ from .permission_snapshot import (
 )
 from .path_safety import PathSafetyConfig, PathSafetyEvaluator
 from .policy import DefaultPolicyEngine, PolicyEngine, ToolPolicyConfig
-from .read_ignore_patterns import ReadDenyPatternCollector, normalize_read_deny_pattern
+from .read_ignore_patterns import (
+    ReadDenyPatternCollector,
+    SearchIgnorePatternCollector,
+    normalize_read_deny_pattern,
+)
 from .policy_decorator import PolicyEngineDecorator
 from .prompt import (
     CliInteractivePolicyEngine,
@@ -124,6 +128,7 @@ __all__ = [
     "PathSafetyConfig",
     "PathSafetyEvaluator",
     "ReadDenyPatternCollector",
+    "SearchIgnorePatternCollector",
     "normalize_read_deny_pattern",
     # prompt (L3)
     "PermissionPromptHandler",

langchain_agentx/tool_runtime/agent_home_bypass.py

@@ -0,0 +1,231 @@
+"""
+agent_home_bypass.py — session 级 agent_home 写 bypass（CC filesystem step 1.6）
+
+职责：
+    仅 session 源 Edit allow 规则可绕过 path_safety 对 ``{segment}/`` 的 dangerous ask；
+    对齐 CC ``checkWritePermissionForTool`` 1.6 与 ``CLAUDE_FOLDER_PERMISSION_PATTERN``。
+
+链路位置：
+    ``DefaultPolicyEngine.evaluate_write_path_policy`` — L2/internal 之后、scratchpad allow、
+    ``PathSafetyEvaluator`` 之前。
+
+当前裁剪范围：
+    仅 ``Edit`` 工具；模式 ``/{segment}/**``、``~/{segment}/**``、
+    ``/{segment}/skills/{name}/**``；不含 ``getClaudeSkillScope`` 建议生成（UI 层）。
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from langchain_agentx.tool_runtime.models import AuthorizationDecision
+from langchain_agentx.tool_runtime.permission_decision import (
+    attach_decision_reason,
+    make_rule_decision_reason,
+)
+from langchain_agentx.tool_runtime.permission_rules import (
+    PermissionRule,
+    PermissionRuleBehavior,
+    PermissionRuleSource,
+    PermissionRuleValue,
+    build_permission_rule_registry,
+    permission_rule_value_from_string,
+)
+from langchain_agentx.tool_runtime.tool_name_constants import Edit
+
+if TYPE_CHECKING:
+    from .policy import ToolPolicyConfig
+
+_SKILL_GLOB_META = re.compile(r"[*?[\]]")
+_POLICY_ID = "agent_home_session_bypass"
+
+
+def normalize_agent_home_segment(agent_home_segment: str | None) -> str:
+    seg = (agent_home_segment or ".langchain_agentx").strip()
+    if not seg.startswith("."):
+        seg = f".{seg}"
+    return seg
+
+
+def project_agent_home_folder_pattern(segment: str) -> str:
+    """对齐 CC ``CLAUDE_FOLDER_PERMISSION_PATTERN``（参数化 segment）。"""
+    return f"/{segment}/**"
+
+
+def global_agent_home_folder_pattern(segment: str) -> str:
+    """对齐 CC ``GLOBAL_CLAUDE_FOLDER_PERMISSION_PATTERN``。"""
+    return f"~/{segment}/**"
+
+
+def is_valid_agent_home_session_allow_pattern(
+    rule_content: str,
+    *,
+    agent_home_segment: str,
+) -> bool:
+    """
+    CC step 1.6 scope check：拒绝 ``..`` / 非 ``/**`` 结尾；窄化 skills 子路径。
+    """
+    content = str(rule_content).strip()
+    if not content or ".." in content or not content.endswith("/**"):
+        return False
+
+    segment = normalize_agent_home_segment(agent_home_segment)
+    folder_base = project_agent_home_folder_pattern(segment)[:-2]  # ``/.segment/``
+    global_base = global_agent_home_folder_pattern(segment)[:-2]  # ``~/.segment/``
+
+    if not (content.startswith(folder_base) or content.startswith(global_base)):
+        return False
+
+    if content in (project_agent_home_folder_pattern(segment), global_agent_home_folder_pattern(segment)):
+        return True
+
+    for base in (folder_base, global_base):
+        skills_prefix = f"{base}skills/"
+        if content.startswith(skills_prefix):
+            skill_part = content[len(skills_prefix) : -3]
+            if not skill_part or skill_part == "." or ".." in skill_part:
+                return False
+            if _SKILL_GLOB_META.search(skill_part):
+                return False
+            return content == f"{skills_prefix}{skill_part}/**"
+
+    return False
+
+
+def _is_under(path: Path, base: Path) -> bool:
+    try:
+        path.resolve().relative_to(base.resolve())
+        return True
+    except ValueError:
+        return False
+
+
+def path_matches_agent_home_allow_pattern(
+    real_path: str,
+    rule_content: str,
+    *,
+    workspace_root: str | Path | None,
+    agent_home_segment: str,
+) -> bool:
+    """路径是否命中 agent_home allow 规则（目录语义 + fnmatch 补充）。"""
+    content = str(rule_content).strip()
+    segment = normalize_agent_home_segment(agent_home_segment)
+    path = Path(real_path).resolve()
+
+    if content == project_agent_home_folder_pattern(segment):
+        if workspace_root is not None:
+            project_base = Path(workspace_root).resolve() / segment
+            if _is_under(path, project_base):
+                return True
+        return _is_under(path, Path.home().resolve() / segment)
+
+    if content == global_agent_home_folder_pattern(segment):
+        return _is_under(path, Path.home().resolve() / segment)
+
+    folder_base = f"/{segment}/skills/"
+    global_skills_base = f"~/{segment}/skills/"
+    skill_name: str | None = None
+    if content.startswith(folder_base) and content.endswith("/**"):
+        skill_name = content[len(folder_base) : -3]
+    elif content.startswith(global_skills_base) and content.endswith("/**"):
+        skill_name = content[len(global_skills_base) : -3]
+
+    if skill_name:
+        if workspace_root is not None:
+            skill_dir = Path(workspace_root).resolve() / segment / "skills" / skill_name
+            if _is_under(path, skill_dir):
+                return True
+        skill_dir = Path.home().resolve() / segment / "skills" / skill_name
+        return _is_under(path, skill_dir)
+
+    candidates = [real_path.replace("\\", "/")]
+    if workspace_root is not None:
+        try:
+            rel = os.path.relpath(real_path, str(workspace_root)).replace("\\", "/")
+            if not rel.startswith(".."):
+                candidates.append(f"/{rel}")
+                candidates.append(rel)
+        except ValueError:
+            pass
+    return any(fnmatch.fnmatch(c, content) for c in candidates)
+
+
+@dataclass
+class AgentHomeSessionBypassEvaluator:
+    """session Edit allow → agent_home path_safety bypass（CC step 1.6）。"""
+
+    def evaluate(
+        self,
+        real_path: str,
+        *,
+        tool_name: str,
+        policy_config: ToolPolicyConfig | None,
+        session_store: Any | None = None,
+        workspace_root: str | Path | None = None,
+        agent_home_segment: str | None = None,
+    ) -> AuthorizationDecision | None:
+        if tool_name != Edit:
+            return None
+
+        segment = normalize_agent_home_segment(agent_home_segment)
+        registry = build_permission_rule_registry(
+            policy_config=policy_config,
+            session_store=session_store,
+            workspace_root=workspace_root,
+            agent_home_segment=segment,
+        )
+
+        session_rules = registry.allow.get(PermissionRuleSource.SESSION.value, ())
+        for rule_string in session_rules:
+            try:
+                value = permission_rule_value_from_string(rule_string)
+            except ValueError:
+                continue
+            if value.tool_name != Edit or value.rule_content is None:
+                continue
+            content = value.rule_content
+            if not is_valid_agent_home_session_allow_pattern(
+                content,
+                agent_home_segment=segment,
+            ):
+                continue
+            if not path_matches_agent_home_allow_pattern(
+                real_path,
+                content,
+                workspace_root=workspace_root,
+                agent_home_segment=segment,
+            ):
+                continue
+            rule = PermissionRule(
+                source=PermissionRuleSource.SESSION,
+                rule_behavior=PermissionRuleBehavior.ALLOW,
+                rule_value=PermissionRuleValue(
+                    tool_name=Edit,
+                    rule_content=content,
+                ),
+            )
+            decision = AuthorizationDecision(
+                behavior="allow",
+                policy_id=_POLICY_ID,
+                message="Write allowed by session agent_home permission rule.",
+            )
+            return attach_decision_reason(
+                decision,
+                make_rule_decision_reason(rule, rule_kind="always_allow_tool"),
+            )
+        return None
+
+
+__all__ = [
+    "AgentHomeSessionBypassEvaluator",
+    "global_agent_home_folder_pattern",
+    "is_valid_agent_home_session_allow_pattern",
+    "normalize_agent_home_segment",
+    "path_matches_agent_home_allow_pattern",
+    "project_agent_home_folder_pattern",
+]

langchain_agentx/tool_runtime/inner_permission_chain.py

@@ -383,6 +383,7 @@ class InnerPermissionChain:
             wr = ctx.workspace_root
             if wr is None and self._engine._config.project_memory_layout is not None:
                 wr = str(self._engine._config.project_memory_layout.project_root)
+            session_id, session_cwd = self._engine._session_context(ctx)
             decision = self._engine._read_authorizer.authorize(
                 real_path,
                 tool_name=tool_name,
@@ -390,6 +391,8 @@ class InnerPermissionChain:
                 session_store=ctx.session_store,
                 workspace_root=wr,
                 agent_home_segment=ctx.agent_home_segment,
+                session_id=session_id,
+                session_cwd=session_cwd,
             )
             return PathPolicyResult(decision=decision)
 
@@ -401,7 +404,11 @@ class InnerPermissionChain:
                 ),
             )
 
-        return self._engine.evaluate_write_path_policy(real_path)
+        return self._engine.evaluate_write_path_policy(
+            real_path,
+            tool_name=tool_name,
+            ctx=ctx,
+        )
 
     @staticmethod
     def _segment_5_passthrough_promoted_ask(

langchain_agentx/tool_runtime/loop_loader.py

@@ -19,7 +19,7 @@ from typing import Any
 
 from .path_safety import PathSafetyConfig
 from .process_loader import ProcessLoader
-from .read_ignore_patterns import ReadDenyPatternCollector
+from .read_ignore_patterns import SearchIgnorePatternCollector
 from .registry import RuntimeToolRegistry
 from .policy import DefaultPolicyEngine, ToolPolicyConfig
 
@@ -76,7 +76,7 @@ class LoopLoader:
         from langchain_agentx.tools.bash import BashRuntimeTool
         from langchain_agentx.tools.edit import EditRuntimeTool
         from langchain_agentx.tools.edit.settings_validator import SettingsValidator
-        from langchain_agentx.tools.edit.staleness import StalenessChecker
+        from langchain_agentx.tools.shared.staleness import StalenessChecker
         from langchain_agentx.tools.edit.validator import EditStringValidator
         from langchain_agentx.tools.glob import GlobRuntimeTool
         from langchain_agentx.tools.grep import GrepRuntimeTool
@@ -124,7 +124,12 @@ class LoopLoader:
         )
 
         self.register(ReadRuntimeTool(state_bridge=shared_bridge))
-        self.register(WriteRuntimeTool(state_bridge=shared_bridge))
+        self.register(
+            WriteRuntimeTool(
+                state_bridge=shared_bridge,
+                staleness_checker=edit_staleness,
+            )
+        )
         self.register(
             EditRuntimeTool(
                 state_bridge=shared_bridge,
@@ -176,12 +181,34 @@ class LoopLoader:
 
         return self
 
-    def _collect_search_ignore_patterns(self) -> list[str]:
+    def _collect_search_ignore_patterns(
+        self,
+        *,
+        session_store: Any | None = None,
+    ) -> list[str]:
         cfg = self._process.policy_config
         policy = self._process.policy
         if cfg is None and isinstance(policy, DefaultPolicyEngine):
             cfg = policy._config
-        return ReadDenyPatternCollector().collect(cfg)
+        return SearchIgnorePatternCollector().collect(
+            cfg,
+            session_store=session_store,
+            workspace_root=self._workspace_root,
+            agent_home_segment=self._agent_home,
+        )
+
+    def refresh_search_ignore_patterns(
+        self,
+        *,
+        session_store: Any | None = None,
+    ) -> list[str]:
+        """热刷新 Grep/Glob 的 ``ignore_patterns``（对齐 CC settings 变更后搜索隐藏）。"""
+        patterns = self._collect_search_ignore_patterns(session_store=session_store)
+        for tool in self._registry.list():
+            setter = getattr(tool, "set_ignore_patterns", None)
+            if callable(setter):
+                setter(patterns)
+        return patterns
 
     def _inject_project_memory_policy(self, workspace_cfg: Any) -> None:
         """Per-loop 注入 CC projects 树读写根与 path_safety layout。"""