langchain-agentx-python 1.3.0__tar.gz → 1.3.1__tar.gz

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: langchain-agentx-python
-Version: 1.3.0
+Version: 1.3.1
 Summary: LangChain/LangGraph-based agent utilities for CodeBaseX.
 Author-email: GoodMood2008 <GoodMood2008@users.noreply.github.com>
 License:                                  Apache License

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/__init__.py

@@ -11,7 +11,7 @@ from langchain_agentx import create_loop_agent
 ```
 """
 
-__version__ = "1.3.0"
+__version__ = "1.3.1"
 
 from .loop import (  # noqa: F401
     create_loop_agent,

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/loop/graph/factory.py

@@ -772,6 +772,8 @@ class LoopGraphBuilder:
             session_store=session_store,
             schema_cache_namespace=schema_cache_namespace,
         )
+        if self._loop_loader is not None:
+            self._loop_loader.refresh_search_ignore_patterns(session_store=session_store)
         if self._runtime_tools and self._loop_loader is not None:
             self._tool_prompt_ctx = self._build_tool_prompt_context(
                 session_store=session_store,

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/plugin/loader.py

@@ -245,8 +245,9 @@ class PluginLoader:
 
     async def _register_skills(self, plugins: list[LoadedPlugin]) -> list[PluginError]:
         errors: list[PluginError] = []
+        cwd = self._cfg.workspace_root
         for plugin in plugins:
-            errors.extend(self._skill_registry.register(plugin))
+            errors.extend(self._skill_registry.register(plugin, cwd=cwd))
         return errors
 
     async def _register_commands(self, plugins: list[LoadedPlugin]) -> list[PluginError]:

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/plugin/registries.py

@@ -13,11 +13,16 @@ plugin/registries.py — Plugin 能力注册表（Skill/Command/Agent）。
 
 from __future__ import annotations
 
+import logging
 from dataclasses import dataclass
 from pathlib import Path
 
+from langchain_agentx.tools.skill.guards import SkillsGitignoreGuard
+
 from .types import ComponentLoadFailedError, LoadedPlugin, PluginError
 
+logger = logging.getLogger(__name__)
+
 
 @dataclass(frozen=True)
 class SkillEntry:
@@ -43,15 +48,37 @@ class AgentDefinitionEntry:
 
 
 class SkillRegistry:
-    def __init__(self) -> None:
+    def __init__(
+        self,
+        *,
+        workspace_root: str | Path | None = None,
+        gitignore_guard: SkillsGitignoreGuard | None = None,
+    ) -> None:
         self._skills: dict[str, SkillEntry] = {}
         self._by_plugin: dict[str, list[str]] = {}
-
-    def register(self, plugin: LoadedPlugin) -> list[PluginError]:
+        self._workspace_root = (
+            Path(workspace_root).resolve() if workspace_root is not None else None
+        )
+        self._gitignore_guard = gitignore_guard or SkillsGitignoreGuard()
+
+    def register(
+        self,
+        plugin: LoadedPlugin,
+        *,
+        cwd: str | Path | None = None,
+    ) -> list[PluginError]:
         if plugin.skills_dir is None or not plugin.skills_dir.exists():
             self._by_plugin[plugin.source] = []
             return []
 
+        work_cwd = cwd if cwd is not None else self._workspace_root
+        if work_cwd is not None and self._gitignore_guard.should_skip_skills_dir(
+            plugin.skills_dir,
+            cwd=work_cwd,
+        ):
+            self._by_plugin[plugin.source] = []
+            return []
+
         errors: list[PluginError] = []
         registered: list[str] = []
         for skill_dir in sorted(plugin.skills_dir.iterdir()):

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/session/agent_session.py

@@ -97,7 +97,7 @@ class AgentSession:
             resource_root=workspace_cfg.workspace_root,
             agent_home_segment=workspace_cfg.agent_home_segment,
         )
-        self._skill_registry = SkillRegistry()
+        self._skill_registry = SkillRegistry(workspace_root=workspace_cfg.workspace_root)
         self._command_registry = PluginCommandRegistry()
         self._agent_registry = AgentRegistry()
         self._runtime_command_registry = CommandRegistry()

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/session/conversation_session.py

@@ -71,7 +71,7 @@ class ConversationSession:
         self._container_type = "conversation"
         self._session_memory_manager: Any | None = None
         self._capabilities = capabilities
-        self._skill_registry = SkillRegistry()
+        self._skill_registry = SkillRegistry(workspace_root=workspace_cfg.workspace_root)
         self._command_registry = PluginCommandRegistry()
         self._agent_registry = AgentRegistry()
         self._runtime_command_registry = CommandRegistry()

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/tool_runtime/__init__.py

@@ -44,7 +44,11 @@ from .permission_snapshot import (
 )
 from .path_safety import PathSafetyConfig, PathSafetyEvaluator
 from .policy import DefaultPolicyEngine, PolicyEngine, ToolPolicyConfig
-from .read_ignore_patterns import ReadDenyPatternCollector, normalize_read_deny_pattern
+from .read_ignore_patterns import (
+    ReadDenyPatternCollector,
+    SearchIgnorePatternCollector,
+    normalize_read_deny_pattern,
+)
 from .policy_decorator import PolicyEngineDecorator
 from .prompt import (
     CliInteractivePolicyEngine,
@@ -124,6 +128,7 @@ __all__ = [
     "PathSafetyConfig",
     "PathSafetyEvaluator",
     "ReadDenyPatternCollector",
+    "SearchIgnorePatternCollector",
     "normalize_read_deny_pattern",
     # prompt (L3)
     "PermissionPromptHandler",

langchain-agentx-python-1.3.1/langchain_agentx/tool_runtime/agent_home_bypass.py

@@ -0,0 +1,231 @@
+"""
+agent_home_bypass.py — session 级 agent_home 写 bypass（CC filesystem step 1.6）
+
+职责：
+    仅 session 源 Edit allow 规则可绕过 path_safety 对 ``{segment}/`` 的 dangerous ask；
+    对齐 CC ``checkWritePermissionForTool`` 1.6 与 ``CLAUDE_FOLDER_PERMISSION_PATTERN``。
+
+链路位置：
+    ``DefaultPolicyEngine.evaluate_write_path_policy`` — L2/internal 之后、scratchpad allow、
+    ``PathSafetyEvaluator`` 之前。
+
+当前裁剪范围：
+    仅 ``Edit`` 工具；模式 ``/{segment}/**``、``~/{segment}/**``、
+    ``/{segment}/skills/{name}/**``；不含 ``getClaudeSkillScope`` 建议生成（UI 层）。
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from langchain_agentx.tool_runtime.models import AuthorizationDecision
+from langchain_agentx.tool_runtime.permission_decision import (
+    attach_decision_reason,
+    make_rule_decision_reason,
+)
+from langchain_agentx.tool_runtime.permission_rules import (
+    PermissionRule,
+    PermissionRuleBehavior,
+    PermissionRuleSource,
+    PermissionRuleValue,
+    build_permission_rule_registry,
+    permission_rule_value_from_string,
+)
+from langchain_agentx.tool_runtime.tool_name_constants import Edit
+
+if TYPE_CHECKING:
+    from .policy import ToolPolicyConfig
+
+_SKILL_GLOB_META = re.compile(r"[*?[\]]")
+_POLICY_ID = "agent_home_session_bypass"
+
+
+def normalize_agent_home_segment(agent_home_segment: str | None) -> str:
+    seg = (agent_home_segment or ".langchain_agentx").strip()
+    if not seg.startswith("."):
+        seg = f".{seg}"
+    return seg
+
+
+def project_agent_home_folder_pattern(segment: str) -> str:
+    """对齐 CC ``CLAUDE_FOLDER_PERMISSION_PATTERN``（参数化 segment）。"""
+    return f"/{segment}/**"
+
+
+def global_agent_home_folder_pattern(segment: str) -> str:
+    """对齐 CC ``GLOBAL_CLAUDE_FOLDER_PERMISSION_PATTERN``。"""
+    return f"~/{segment}/**"
+
+
+def is_valid_agent_home_session_allow_pattern(
+    rule_content: str,
+    *,
+    agent_home_segment: str,
+) -> bool:
+    """
+    CC step 1.6 scope check：拒绝 ``..`` / 非 ``/**`` 结尾；窄化 skills 子路径。
+    """
+    content = str(rule_content).strip()
+    if not content or ".." in content or not content.endswith("/**"):
+        return False
+
+    segment = normalize_agent_home_segment(agent_home_segment)
+    folder_base = project_agent_home_folder_pattern(segment)[:-2]  # ``/.segment/``
+    global_base = global_agent_home_folder_pattern(segment)[:-2]  # ``~/.segment/``
+
+    if not (content.startswith(folder_base) or content.startswith(global_base)):
+        return False
+
+    if content in (project_agent_home_folder_pattern(segment), global_agent_home_folder_pattern(segment)):
+        return True
+
+    for base in (folder_base, global_base):
+        skills_prefix = f"{base}skills/"
+        if content.startswith(skills_prefix):
+            skill_part = content[len(skills_prefix) : -3]
+            if not skill_part or skill_part == "." or ".." in skill_part:
+                return False
+            if _SKILL_GLOB_META.search(skill_part):
+                return False
+            return content == f"{skills_prefix}{skill_part}/**"
+
+    return False
+
+
+def _is_under(path: Path, base: Path) -> bool:
+    try:
+        path.resolve().relative_to(base.resolve())
+        return True
+    except ValueError:
+        return False
+
+
+def path_matches_agent_home_allow_pattern(
+    real_path: str,
+    rule_content: str,
+    *,
+    workspace_root: str | Path | None,
+    agent_home_segment: str,
+) -> bool:
+    """路径是否命中 agent_home allow 规则（目录语义 + fnmatch 补充）。"""
+    content = str(rule_content).strip()
+    segment = normalize_agent_home_segment(agent_home_segment)
+    path = Path(real_path).resolve()
+
+    if content == project_agent_home_folder_pattern(segment):
+        if workspace_root is not None:
+            project_base = Path(workspace_root).resolve() / segment
+            if _is_under(path, project_base):
+                return True
+        return _is_under(path, Path.home().resolve() / segment)
+
+    if content == global_agent_home_folder_pattern(segment):
+        return _is_under(path, Path.home().resolve() / segment)
+
+    folder_base = f"/{segment}/skills/"
+    global_skills_base = f"~/{segment}/skills/"
+    skill_name: str | None = None
+    if content.startswith(folder_base) and content.endswith("/**"):
+        skill_name = content[len(folder_base) : -3]
+    elif content.startswith(global_skills_base) and content.endswith("/**"):
+        skill_name = content[len(global_skills_base) : -3]
+
+    if skill_name:
+        if workspace_root is not None:
+            skill_dir = Path(workspace_root).resolve() / segment / "skills" / skill_name
+            if _is_under(path, skill_dir):
+                return True
+        skill_dir = Path.home().resolve() / segment / "skills" / skill_name
+        return _is_under(path, skill_dir)
+
+    candidates = [real_path.replace("\\", "/")]
+    if workspace_root is not None:
+        try:
+            rel = os.path.relpath(real_path, str(workspace_root)).replace("\\", "/")
+            if not rel.startswith(".."):
+                candidates.append(f"/{rel}")
+                candidates.append(rel)
+        except ValueError:
+            pass
+    return any(fnmatch.fnmatch(c, content) for c in candidates)
+
+
+@dataclass
+class AgentHomeSessionBypassEvaluator:
+    """session Edit allow → agent_home path_safety bypass（CC step 1.6）。"""
+
+    def evaluate(
+        self,
+        real_path: str,
+        *,
+        tool_name: str,
+        policy_config: ToolPolicyConfig | None,
+        session_store: Any | None = None,
+        workspace_root: str | Path | None = None,
+        agent_home_segment: str | None = None,
+    ) -> AuthorizationDecision | None:
+        if tool_name != Edit:
+            return None
+
+        segment = normalize_agent_home_segment(agent_home_segment)
+        registry = build_permission_rule_registry(
+            policy_config=policy_config,
+            session_store=session_store,
+            workspace_root=workspace_root,
+            agent_home_segment=segment,
+        )
+
+        session_rules = registry.allow.get(PermissionRuleSource.SESSION.value, ())
+        for rule_string in session_rules:
+            try:
+                value = permission_rule_value_from_string(rule_string)
+            except ValueError:
+                continue
+            if value.tool_name != Edit or value.rule_content is None:
+                continue
+            content = value.rule_content
+            if not is_valid_agent_home_session_allow_pattern(
+                content,
+                agent_home_segment=segment,
+            ):
+                continue
+            if not path_matches_agent_home_allow_pattern(
+                real_path,
+                content,
+                workspace_root=workspace_root,
+                agent_home_segment=segment,
+            ):
+                continue
+            rule = PermissionRule(
+                source=PermissionRuleSource.SESSION,
+                rule_behavior=PermissionRuleBehavior.ALLOW,
+                rule_value=PermissionRuleValue(
+                    tool_name=Edit,
+                    rule_content=content,
+                ),
+            )
+            decision = AuthorizationDecision(
+                behavior="allow",
+                policy_id=_POLICY_ID,
+                message="Write allowed by session agent_home permission rule.",
+            )
+            return attach_decision_reason(
+                decision,
+                make_rule_decision_reason(rule, rule_kind="always_allow_tool"),
+            )
+        return None
+
+
+__all__ = [
+    "AgentHomeSessionBypassEvaluator",
+    "global_agent_home_folder_pattern",
+    "is_valid_agent_home_session_allow_pattern",
+    "normalize_agent_home_segment",
+    "path_matches_agent_home_allow_pattern",
+    "project_agent_home_folder_pattern",
+]

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/tool_runtime/inner_permission_chain.py

@@ -383,6 +383,7 @@ class InnerPermissionChain:
             wr = ctx.workspace_root
             if wr is None and self._engine._config.project_memory_layout is not None:
                 wr = str(self._engine._config.project_memory_layout.project_root)
+            session_id, session_cwd = self._engine._session_context(ctx)
             decision = self._engine._read_authorizer.authorize(
                 real_path,
                 tool_name=tool_name,
@@ -390,6 +391,8 @@ class InnerPermissionChain:
                 session_store=ctx.session_store,
                 workspace_root=wr,
                 agent_home_segment=ctx.agent_home_segment,
+                session_id=session_id,
+                session_cwd=session_cwd,
             )
             return PathPolicyResult(decision=decision)
 
@@ -401,7 +404,11 @@ class InnerPermissionChain:
                 ),
             )
 
-        return self._engine.evaluate_write_path_policy(real_path)
+        return self._engine.evaluate_write_path_policy(
+            real_path,
+            tool_name=tool_name,
+            ctx=ctx,
+        )
 
     @staticmethod
     def _segment_5_passthrough_promoted_ask(

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/tool_runtime/loop_loader.py

@@ -19,7 +19,7 @@ from typing import Any
 
 from .path_safety import PathSafetyConfig
 from .process_loader import ProcessLoader
-from .read_ignore_patterns import ReadDenyPatternCollector
+from .read_ignore_patterns import SearchIgnorePatternCollector
 from .registry import RuntimeToolRegistry
 from .policy import DefaultPolicyEngine, ToolPolicyConfig
 
@@ -176,12 +176,34 @@ class LoopLoader:
 
         return self
 
-    def _collect_search_ignore_patterns(self) -> list[str]:
+    def _collect_search_ignore_patterns(
+        self,
+        *,
+        session_store: Any | None = None,
+    ) -> list[str]:
         cfg = self._process.policy_config
         policy = self._process.policy
         if cfg is None and isinstance(policy, DefaultPolicyEngine):
             cfg = policy._config
-        return ReadDenyPatternCollector().collect(cfg)
+        return SearchIgnorePatternCollector().collect(
+            cfg,
+            session_store=session_store,
+            workspace_root=self._workspace_root,
+            agent_home_segment=self._agent_home,
+        )
+
+    def refresh_search_ignore_patterns(
+        self,
+        *,
+        session_store: Any | None = None,
+    ) -> list[str]:
+        """热刷新 Grep/Glob 的 ``ignore_patterns``（对齐 CC settings 变更后搜索隐藏）。"""
+        patterns = self._collect_search_ignore_patterns(session_store=session_store)
+        for tool in self._registry.list():
+            setter = getattr(tool, "set_ignore_patterns", None)
+            if callable(setter):
+                setter(patterns)
+        return patterns
 
     def _inject_project_memory_policy(self, workspace_cfg: Any) -> None:
         """Per-loop 注入 CC projects 树读写根与 path_safety layout。"""

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/tool_runtime/path_safety.py

@@ -9,7 +9,8 @@ path_safety.py — 写路径安全评估（对齐 CC filesystem.ts）
     ``DefaultPolicyEngine.authorize`` / ``authorize_path`` 在 ask_globs 之后、roots 之前调用。
 
 当前裁剪范围：
-    不实现 session 级 ``/.claude/**`` allow 绕过、Windows 可疑路径全套、内部 plan/scratchpad 白名单。
+    不实现 Windows 可疑路径全套、内部 plan 白名单。
+    scratchpad 白名单见 ``InternalPathEvaluator``（D7）；session 级 ``/{segment}/**`` allow 绕过见 ``agent_home_bypass.py``（D8）。
 """
 
 from __future__ import annotations
@@ -24,6 +25,7 @@ from langchain_agentx.tool_runtime.permission_decision import (
     attach_decision_reason,
     make_safety_check_decision_reason,
 )
+from langchain_agentx.utils.permissions.filesystem import InternalPathEvaluator
 
 if TYPE_CHECKING:
     from langchain_agentx.workspace.project_memory_layout import ProjectMemoryLayout
@@ -105,8 +107,14 @@ class PathSafetyConfig:
 class PathSafetyEvaluator:
     """评估写操作目标路径是否需人工确认（CC checkPathSafetyForAutoEdit 子集）。"""
 
-    def __init__(self, config: PathSafetyConfig) -> None:
+    def __init__(
+        self,
+        config: PathSafetyConfig,
+        *,
+        internal_paths: InternalPathEvaluator | None = None,
+    ) -> None:
         self._config = config
+        self._internal = internal_paths or InternalPathEvaluator()
         home = config.agent_home_segment.lower()
         self._dangerous_segments = frozenset(
             s.lower() for s in (*config.dangerous_directory_segments, config.agent_home_segment)
@@ -135,7 +143,13 @@ class PathSafetyEvaluator:
             )
         return None
 
-    def evaluate_write_path(self, path: str) -> AuthorizationDecision | None:
+    def evaluate_write_path(
+        self,
+        path: str,
+        *,
+        session_id: str | None = None,
+        session_cwd: str | None = None,
+    ) -> AuthorizationDecision | None:
         """
         若路径需保护则返回 ``ask`` 决策；否则返回 ``None``（继续后续 roots 检查）。
         """
@@ -150,6 +164,11 @@ class PathSafetyEvaluator:
         if self._is_editable_internal_l2_path(real):
             return None
 
+        if self._internal.is_scratchpad_path(
+            real, session_id=session_id, cwd=session_cwd
+        ):
+            return None
+
         if self._is_agent_config_file_path(real):
             return attach_decision_reason(
                 AuthorizationDecision(

{langchain-agentx-python-1.3.0 → langchain-agentx-python-1.3.1}/langchain_agentx/tool_runtime/policy.py

@@ -55,6 +55,8 @@ from .path_safety import PathSafetyConfig, PathSafetyEvaluator
 from .permission_context import get_active_auto_approved_tools
 from .read_permission import ReadPathAuthorizer
 from .tool_name_constants import Read, Write
+from .agent_home_bypass import AgentHomeSessionBypassEvaluator
+from langchain_agentx.utils.permissions.filesystem import InternalPathEvaluator
 from .inner_permission_chain import InnerPermissionChain, PathPolicyResult
 from .permission_decision import (
     PermissionDecisionType,
@@ -315,12 +317,17 @@ class DefaultPolicyEngine(PolicyEngine):
         self._read_roots = [os.path.realpath(r) for r in config.read_roots]
         self._write_roots = [os.path.realpath(r) for r in config.write_roots]
         self._auto_mode_hook = auto_mode_hook
+        self._internal_paths = InternalPathEvaluator()
         self._path_safety: PathSafetyEvaluator | None = None
         if config.enable_path_safety and config.path_safety is not None:
-            self._path_safety = PathSafetyEvaluator(config.path_safety)
+            self._path_safety = PathSafetyEvaluator(
+                config.path_safety,
+                internal_paths=self._internal_paths,
+            )
         self._read_authorizer = ReadPathAuthorizer(
             config,
             path_safety=self._path_safety,
+            internal_paths=self._internal_paths,
             check_builtin_deny=self._check_builtin_deny,
             authorize_destructive_path=self._evaluate_write_allowance_for_implied_read,
             authorize_read_roots=lambda real_path: self._authorize_path_roots(
@@ -331,6 +338,7 @@ class DefaultPolicyEngine(PolicyEngine):
                 self._within_root(real_path, r) for r in self._write_roots
             ),
         )
+        self._agent_home_bypass = AgentHomeSessionBypassEvaluator()
 
     def authorize(
         self,
@@ -346,17 +354,54 @@ class DefaultPolicyEngine(PolicyEngine):
             ctx=ctx,
         )
 
-    def evaluate_write_path_policy(self, real_path: str) -> PathPolicyResult:
-        """写路径段：path_safety → write_roots；roots 内 mutating 返回 passthrough（段 5 升 ask）。"""
-        if self._path_safety is not None:
-            safety = self._path_safety.evaluate_write_path(real_path)
-            if safety is not None:
-                return PathPolicyResult(decision=safety)
-
+    def evaluate_write_path_policy(
+        self,
+        real_path: str,
+        *,
+        tool_name: str | None = None,
+        ctx: ToolExecutionContext | None = None,
+    ) -> PathPolicyResult:
+        """写路径段：internal L2 → scratchpad → session agent_home bypass → path_safety → write_roots."""
         layout = self._config.project_memory_layout
+        session_id, session_cwd = self._session_context(ctx)
+
         if layout is not None and layout.is_l2_memory_path(real_path):
             return PathPolicyResult(decision=AuthorizationDecision(behavior="allow"))
 
+        if self._internal_paths.is_scratchpad_path(
+            real_path, session_id=session_id, cwd=session_cwd
+        ):
+            return PathPolicyResult(
+                decision=AuthorizationDecision(
+                    behavior="allow",
+                    policy_id="editable_internal_scratchpad",
+                ),
+            )
+
+        if tool_name and ctx is not None:
+            wr = ctx.workspace_root
+            if wr is None and layout is not None:
+                wr = str(layout.project_root)
+            bypass = self._agent_home_bypass.evaluate(
+                real_path,
+                tool_name=tool_name,
+                policy_config=self._config,
+                session_store=ctx.session_store,
+                workspace_root=wr,
+                agent_home_segment=ctx.agent_home_segment,
+            )
+            if bypass is not None:
+                return PathPolicyResult(decision=bypass)
+
+        if self._path_safety is not None:
+            safety = self._path_safety.evaluate_write_path(
+                real_path,
+                session_id=session_id,
+                session_cwd=session_cwd,
+            )
+            if safety is not None:
+                return PathPolicyResult(decision=safety)
+
         roots = self._write_roots
         if not roots:
             return PathPolicyResult(decision=AuthorizationDecision(behavior="allow"))
@@ -445,6 +490,17 @@ class DefaultPolicyEngine(PolicyEngine):
 
     # ---- 内部辅助 ----
 
+    def _session_context(
+        self, ctx: ToolExecutionContext | None
+    ) -> tuple[str | None, str | None]:
+        if ctx is None:
+            return None, None
+        session_id = ctx.session_store.session_id if ctx.session_store else None
+        session_cwd = ctx.workspace_root
+        if session_cwd is None and self._config.project_memory_layout is not None:
+            session_cwd = str(self._config.project_memory_layout.project_root)
+        return session_id, session_cwd
+
     def _read_only_mode_active(self, tool_flags: dict[str, Any] | None = None) -> bool:
         """config.read_only_mode 或运行期 permission_mode=plan（IF-G9 / §7.10）。"""
         if self._config.read_only_mode: