steerable-agent-runtime 0.6.51__tar.gz → 0.6.52__tar.gz

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steerable-agent-runtime
-Version: 0.6.51
+Version: 0.6.52
 Summary: Steerable agent runtime: LLM, tool, storage, and transport adapters.
 License: Apache-2.0
 Requires-Python: >=3.10

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "steerable-agent-runtime"
-version = "0.6.51"
+version = "0.6.52"
 description = "Steerable agent runtime: LLM, tool, storage, and transport adapters."
 license = { text = "Apache-2.0" }
 readme = "README.md"

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime/approval.py

@@ -53,6 +53,7 @@ __all__ = [
     "ApprovalStore",
     "Approver",
     "AutoApprover",
+    "WorkspaceAutoApprover",
     "InMemoryApprovalStore",
     "JsonApprovalStore",
     "SessionApprovalCache",
@@ -130,6 +131,91 @@ class Approver(Protocol):
     async def approve(self, request: ApprovalRequest) -> ApprovalDecision: ...
 
 
+_PATH_ARG_TOOLS = {
+    "local_read_file": "path",
+    "local_write_file": "path",
+    "local_edit_file": "path",
+    "view_image": "path",
+}
+
+
+def declared_target_paths(request: ApprovalRequest) -> list[str] | None:
+    """Filesystem targets of a path-scoped tool, or None when the call is not one.
+
+    ``None`` means the approver cannot prove the call stays inside the
+    project, so the interactive prompt still runs. Shell commands stay in
+    that bucket: the command text can name paths the cwd does not.
+    """
+    if request.tool_name == "present_files":
+        files = request.arguments.get("files")
+        if not isinstance(files, list) or not files:
+            return None
+        paths: list[str] = []
+        for item in files:
+            if not isinstance(item, dict):
+                return None
+            raw = item.get("path")
+            if not isinstance(raw, str) or not raw.strip():
+                return None
+            paths.append(raw.strip())
+        return paths
+    key = _PATH_ARG_TOOLS.get(request.tool_name)
+    if key is None:
+        return None
+    raw = request.arguments.get(key)
+    if not isinstance(raw, str) or not raw.strip():
+        return None
+    return [raw.strip()]
+
+
+def path_inside_writable_roots(raw: str, roots: list[str]) -> bool:
+    """True when ``raw`` is the configured directory or one of its subdirectories.
+
+    Relative paths are project-relative. A ``..`` segment can leave the
+    project, so those still go to the prompt. Absolute paths must sit under
+    one of ``roots``.
+    """
+    expanded = os.path.expanduser(raw.strip())
+    if not os.path.isabs(expanded):
+        normalized = os.path.normpath(expanded)
+        return normalized != ".." and not normalized.startswith(".." + os.sep)
+    target = os.path.abspath(expanded)
+    for root in roots:
+        if not isinstance(root, str) or not root.strip():
+            continue
+        root_abs = os.path.abspath(os.path.expanduser(root.strip()))
+        try:
+            if os.path.commonpath([target, root_abs]) == root_abs:
+                return True
+        except ValueError:
+            continue
+    return False
+
+
+class WorkspaceAutoApprover:
+    """Skip the host prompt when every declared path is already inside a writable root.
+
+    The allow is request-scoped. The next call is judged again, so an
+    in-project ``present_files`` does not grant the same tool outside the
+    project. Calls with no path we can check, or any path outside the roots,
+    fall through to the inner approver.
+    """
+
+    def __init__(self, inner: Approver, writable_roots: list[str]) -> None:
+        self._inner = inner
+        self._roots = [root for root in writable_roots if isinstance(root, str) and root.strip()]
+
+    async def approve(self, request: ApprovalRequest) -> ApprovalDecision:
+        paths = declared_target_paths(request)
+        if (
+            self._roots
+            and paths is not None
+            and all(path_inside_writable_roots(path, self._roots) for path in paths)
+        ):
+            return ApprovalDecision("allow_once", "path is inside a writable project root")
+        return await self._inner.approve(request)
+
+
 class AutoApprover:
     """Headless approver: never blocks, decides by tool mode.
 

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime/default.harness.json

@@ -23,8 +23,6 @@
   "memory": "stateless",
   "orchestration": "single",
   "loop": {
-    "max_rounds": 80,
-    "max_tool_errors": 16,
     "tool_dedup": false
   }
 }

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime/default.harness.yaml

@@ -22,7 +22,9 @@ memory: stateless
 orchestration: single
 # Loop limits the harness pins (W3.4.2.4): entrypoints read these instead of
 # hardcoding knobs. Absent fields fall back to the entrypoint's baseline.
+# max_rounds and max_tool_errors are absent on purpose — a cap here ends a
+# long task at budget_exhausted / consecutive tool errors. The baseline is
+# no cap. A caller that wants a wall passes maxRounds / maxToolErrors, and
+# Harbor passes --max-rounds 250.
 loop:
-  max_rounds: 80
-  max_tool_errors: 16
   tool_dedup: false

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime/orchestration.py

@@ -38,6 +38,7 @@ from typing import Any
 
 from steerable_agent_protocol.generated import ToolCall, ToolResult
 
+from .hooks import ChainHooks, CompletionAction, CompletionDraft, NoopHooks
 from .llm import LLMProvider
 from .loop import CoreLoop, LoopConfig, LoopContext, LoopHooks, ToolExecutor
 from .pool import (
@@ -51,12 +52,61 @@ from .subagent import FilteredToolsExecutor, _schema_name
 __all__ = [
     "AgentPool",
     "ChildOutcome",
+    "ChildBudgetWrapUp",
     "OrchestrationBudgetExceeded",
     "OrchestrationConfig",
     "OrchestrationExecutor",
     "orchestration_tool_descriptors",
 ]
 
+#: Terminal status of a run stopped by ``max_rounds`` or the token budget.
+_BUDGET_WALL_STATUS = "budget_exhausted"
+
+_BUDGET_WRAP_UP_REQUEST = (
+    "[system notice] This run has used its round budget and tools are now "
+    "withheld. Answer the original task now from what you have already "
+    "gathered: give your concrete findings first, then list what you could "
+    "not finish or verify. Do not describe the steps you took."
+)
+
+_RESUME_HINT = (
+    "The child stopped at its round budget; `answer` is its interim report. "
+    "To continue, agent_send this childId a message naming what is still "
+    "missing — it resumes with its prior context and a fresh budget. Do not "
+    "spawn a new child for the same task."
+)
+
+
+class ChildBudgetWrapUp(NoopHooks):
+    """``before_completion``: one no-tools answer round at a child's budget wall.
+
+    Without it a child stopped by ``max_rounds`` or the token budget returns
+    whatever text its last working round produced — usually a progress note,
+    not an answer. The parent then gets ``budget_exhausted`` with nothing
+    usable. The ``narrate`` action runs one round without tools and keeps the
+    ``budget_exhausted`` status, so the parent can still tell the answer is
+    interim and resume the child with ``agent_send``.
+
+    One instance per child loop. A resumed child runs the same loop with a new
+    ``LoopContext``, so the one-round limit applies per run.
+    """
+
+    def __init__(self) -> None:
+        self._wrapped_run: LoopContext | None = None
+
+    async def before_completion(
+        self, draft: CompletionDraft, ctx: LoopContext
+    ) -> CompletionAction:
+        """Narrate once per run when the draft stops at the budget wall."""
+        if draft.status != _BUDGET_WALL_STATUS or self._wrapped_run is ctx:
+            return CompletionAction(kind="accept")
+        self._wrapped_run = ctx
+        return CompletionAction(
+            kind="narrate",
+            message=_BUDGET_WRAP_UP_REQUEST,
+            reason="child_budget_wrap_up",
+        )
+
 
 def orchestration_tool_descriptors(
     config: OrchestrationConfig | None = None,
@@ -119,7 +169,10 @@ def orchestration_tool_descriptors(
         fn(
             config.wait_tool,
             "Wait for a sub-agent to finish and return its outcome. A child "
-            "still running at the timeout returns status 'running'.",
+            "still running at the timeout returns status 'running'. A child "
+            "that hit its round budget returns status 'budget_exhausted' with "
+            "an interim answer and resumable: true — continue it with "
+            "agent_send instead of spawning a new child.",
             {
                 "childId": {"type": "string"},
                 "timeoutMs": {"type": "integer"},
@@ -228,11 +281,15 @@ class OrchestrationExecutor:
                 _lineage=child_id,
             )
             schemas = [*schemas, *orchestration_tool_descriptors(self._config)]
+        wrap_up = ChildBudgetWrapUp()
         loop = CoreLoop(
             self._provider,
             base,
-            LoopConfig(max_rounds=self._config.child_max_rounds),
-            hooks=self._hooks,
+            LoopConfig(
+                max_rounds=self._config.child_max_rounds,
+                max_tool_errors=self._config.child_max_tool_errors,
+            ),
+            hooks=wrap_up if self._hooks is None else ChainHooks(self._hooks, wrap_up),
         )
         return loop, schemas or None
 
@@ -343,15 +400,17 @@ class OrchestrationExecutor:
                 error=f"unknown_child: {child_id!r}",
                 needsFollowup=True,
             )
+        payload: dict[str, Any] = {
+            "childId": outcome.child_id,
+            "status": outcome.status,
+            "answer": outcome.answer,
+        }
+        if self._pool.resumable(outcome.child_id):
+            payload["resumable"] = True
+            payload["hint"] = _RESUME_HINT
         return ToolResult(
             success=True,
-            message=json.dumps(
-                {
-                    "childId": outcome.child_id,
-                    "status": outcome.status,
-                    "answer": outcome.answer,
-                }
-            ),
+            message=json.dumps(payload),
             data={"childId": outcome.child_id, "status": outcome.status},
         )
 

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime/pool.py

@@ -57,7 +57,10 @@ class OrchestrationConfig:
 
     ``max_depth`` counts loop nesting: 1 means the parent spawns children
     that cannot spawn themselves (today's depth-1 delegation). ``max_parallel``
-    caps concurrently running children per pool. ``wait_timeout_s`` bounds a
+    caps concurrently running children per pool. ``child_max_rounds`` and
+    ``child_max_tool_errors`` bound each child run; hosts pass the parent
+    loop's values so a child is not tighter than its parent.
+    ``wait_timeout_s`` bounds an
     ``agent_wait`` without an explicit ``timeoutMs`` — kept under the loop's
     per-tool backstop (default 5 min) so a hung child surfaces as a
     ``running`` outcome, not a tool timeout. The six tool names configure
@@ -67,6 +70,7 @@ class OrchestrationConfig:
     max_depth: int = 1
     max_parallel: int = 4
     child_max_rounds: int = 8
+    child_max_tool_errors: int = 3
     wait_timeout_s: float = 120.0
     spawn_tool: str = "agent_spawn"
     send_tool: str = "agent_send"
@@ -244,7 +248,13 @@ class AgentPool:
     async def _run_child(
         self, handle: _ChildHandle, seed: list[LLMMessage]
     ) -> None:
-        answer_parts: list[str] = []
+        # The answer is the text of the run's last model request, not every
+        # round's text joined: working rounds narrate progress ("let me read
+        # the file") that is not an answer. A last request without text (a
+        # tool round cut by the budget wall) falls back to the most recent
+        # request that produced text.
+        request_text: list[str] = []
+        last_text = ""
         status = "completed"
         try:
             async for event in handle.loop.run(
@@ -255,8 +265,11 @@ class AgentPool:
                     or f"subagent:{self._context_namespace}:{handle.child_id}"
                 ),
             ):
-                if event.kind == "content_delta":
-                    answer_parts.append(str(event.data.get("delta") or ""))
+                if event.kind == "llm_request":
+                    last_text = "".join(request_text).strip() or last_text
+                    request_text = []
+                elif event.kind == "content_delta":
+                    request_text.append(str(event.data.get("delta") or ""))
                 elif event.kind == "completion":
                     status = str(event.data.get("status") or "completed")
         except asyncio.CancelledError:
@@ -276,7 +289,7 @@ class AgentPool:
         # Clean finish (completion or cooperative cancel): the record has no
         # dangling tool_calls, so it is a valid resume seed for follow-ups.
         handle.resume_messages = list(handle.loop.history.projection)
-        answer = "".join(answer_parts).strip()
+        answer = "".join(request_text).strip() or last_text
         handle.outcome = ChildOutcome(handle.child_id, status, answer)
         kind = "child_completed" if status == "completed" else "child_failed"
         self._emit(kind, {"childId": handle.child_id, "status": status})
@@ -370,9 +383,23 @@ class AgentPool:
             }
             if handle.outcome is not None and handle.outcome.answer:
                 entry["answerPreview"] = handle.outcome.answer[:200]
+            if self.resumable(handle.child_id):
+                entry["resumable"] = True
             entries.append(entry)
         return entries
 
+    def resumable(self, child_id: str) -> bool:
+        """True when the child stopped at its budget wall and ``send`` can
+        continue it in place (open, finished cleanly with a resume record)."""
+        handle = self._children.get(child_id)
+        return (
+            handle is not None
+            and not handle.closed
+            and handle.outcome is not None
+            and handle.outcome.status == "budget_exhausted"
+            and handle.resume_messages is not None
+        )
+
     async def close(self, child_id: str) -> bool:
         handle = self._children.get(child_id)
         if handle is None:

steerable_agent_runtime-0.6.52/src/steerable_agent_runtime/tool_presentation.py

@@ -0,0 +1,110 @@
+"""Declared presentation for first-party tools.
+
+The card and the argument that becomes the title are named here. Callers
+do not infer a card from the tool-name prefix. Names absent from this table
+stay undeclared; the host renders those as a generic card.
+
+The desktop host keeps the same names in
+``packages/agent-shell/ts/src/tool-presentation.ts`` and stamps the view
+onto ``executed_actions``.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+# card is one of generic | terminal | diff | search | read | web.
+# kind is one of read | edit | delete | move | search | execute | fetch | other.
+# title_from names the argument whose string value is the row title.
+BUILTIN_PRESENTATIONS: dict[str, dict[str, str]] = {
+    "bash": {"card": "terminal", "kind": "execute", "title_from": "command"},
+    "pwsh": {"card": "terminal", "kind": "execute", "title_from": "command"},
+    "bash_session": {"card": "terminal", "kind": "execute", "title_from": "command"},
+    "write_stdin": {"card": "terminal", "kind": "execute", "title_from": "chars"},
+    "local_exec_shell": {"card": "terminal", "kind": "execute", "title_from": "command"},
+    "local_run_snippet": {"card": "terminal", "kind": "execute", "title_from": "code"},
+    "local_run_script": {"card": "terminal", "kind": "execute", "title_from": "scriptId"},
+    "run_code": {"card": "generic", "kind": "execute", "title_from": "description"},
+    "run_js": {"card": "generic", "kind": "execute", "title_from": "description"},
+    "wait_js": {"card": "generic", "kind": "execute", "title_from": "id"},
+    "read_file": {"card": "read", "kind": "read", "title_from": "path"},
+    "local_read_file": {"card": "read", "kind": "read", "title_from": "path"},
+    "view_image": {"card": "read", "kind": "read", "title_from": "path"},
+    "capture_display": {"card": "read", "kind": "read", "title_from": "target"},
+    "local_list_scripts": {"card": "read", "kind": "read", "title_from": ""},
+    "write_file": {"card": "diff", "kind": "edit", "title_from": "path"},
+    "local_write_file": {"card": "diff", "kind": "edit", "title_from": "path"},
+    "edit_file": {"card": "diff", "kind": "edit", "title_from": "path"},
+    "local_edit_file": {"card": "diff", "kind": "edit", "title_from": "path"},
+    "apply_patch": {"card": "diff", "kind": "edit", "title_from": ""},
+    "grep": {"card": "search", "kind": "search", "title_from": "pattern"},
+    "glob": {"card": "search", "kind": "search", "title_from": "pattern"},
+    "tool_search": {"card": "search", "kind": "search", "title_from": "query"},
+    "web_search": {"card": "web", "kind": "search", "title_from": "query"},
+    "web_fetch": {"card": "web", "kind": "fetch", "title_from": "url"},
+    "task_run": {"card": "generic", "kind": "other", "title_from": "task"},
+    "task_send": {"card": "generic", "kind": "other", "title_from": "message"},
+    "task_status": {"card": "generic", "kind": "read", "title_from": "taskId"},
+    "task_result": {"card": "generic", "kind": "read", "title_from": "taskId"},
+    "job_list": {"card": "generic", "kind": "read", "title_from": ""},
+    "job_output": {"card": "generic", "kind": "read", "title_from": "job_id"},
+    "job_kill": {"card": "generic", "kind": "delete", "title_from": "job_id"},
+    "worktree_create": {"card": "generic", "kind": "other", "title_from": "name"},
+    "worktree_list": {"card": "read", "kind": "read", "title_from": ""},
+    "worktree_remove": {"card": "generic", "kind": "delete", "title_from": "name"},
+    "get_goal": {"card": "generic", "kind": "read", "title_from": ""},
+    "create_goal": {"card": "generic", "kind": "other", "title_from": "objective"},
+    "update_goal": {"card": "generic", "kind": "other", "title_from": "action"},
+    "present_files": {"card": "generic", "kind": "other", "title_from": ""},
+    "local_open_path": {"card": "generic", "kind": "other", "title_from": "target"},
+    "todo_write": {"card": "generic", "kind": "other", "title_from": ""},
+    "ask_user": {"card": "generic", "kind": "other", "title_from": "intro"},
+    "skill": {"card": "generic", "kind": "read", "title_from": "name"},
+    "delegate_subagent": {"card": "generic", "kind": "other", "title_from": "task"},
+    "mcp_list_tools": {"card": "generic", "kind": "fetch", "title_from": ""},
+    "mcp_tool_exec": {"card": "generic", "kind": "fetch", "title_from": "toolName"},
+    "plugin_list": {"card": "generic", "kind": "read", "title_from": ""},
+    "plugin_enable": {"card": "generic", "kind": "other", "title_from": "name"},
+    "plugin_disable": {"card": "generic", "kind": "delete", "title_from": "name"},
+    "plugin_reload": {"card": "generic", "kind": "other", "title_from": "name"},
+}
+
+_CARDS = frozenset({"generic", "terminal", "diff", "search", "read", "web"})
+_KINDS = frozenset({"read", "edit", "delete", "move", "search", "execute", "fetch", "other"})
+
+
+def builtin_presentation(name: str) -> dict[str, Any] | None:
+    """Return the declared view spec for ``name``, or None when undeclared."""
+    spec = BUILTIN_PRESENTATIONS.get(name)
+    if spec is None:
+        return None
+    return {**spec, "declared": True}
+
+
+def present_call(
+    name: str,
+    arguments: dict[str, Any] | None,
+    *,
+    metadata: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Build the row view from a declaration. Undeclared names stay generic."""
+    spec = None
+    if metadata is not None:
+        stored = metadata.get("presentation")
+        if isinstance(stored, dict):
+            spec = stored
+    if spec is None:
+        spec = builtin_presentation(name)
+    if not spec:
+        return {"card": "generic", "kind": "other", "title": name, "declared": False}
+    key = spec.get("title_from")
+    raw = arguments.get(key) if isinstance(key, str) and key and isinstance(arguments, dict) else None
+    title = raw.strip() if isinstance(raw, str) and raw.strip() else name
+    if len(title) > 80:
+        title = title[:79] + "…"
+    return {
+        "card": spec["card"],
+        "kind": spec["kind"],
+        "title": title,
+        "declared": True,
+    }

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime/tools.py

@@ -29,6 +29,7 @@ from steerable_agent_harness.safety import CommandSafetyConfig, classify_shell_c
 from steerable_agent_protocol.generated import ToolCall, ToolResult
 
 from .errors import PolicyDeniedError, ToolDispatchError
+from .tool_presentation import builtin_presentation
 from .tool_schema import derive_schema
 
 logger = logging.getLogger(__name__)
@@ -111,6 +112,11 @@ class ToolRouter:
         resolved_consent = (
             require_consent if require_consent is not None else resolved_mode == "destructive"
         )
+        merged_metadata = dict(metadata or {})
+        if "presentation" not in merged_metadata:
+            declared = builtin_presentation(resolved_name)
+            if declared is not None:
+                merged_metadata["presentation"] = declared
         tool_meta = RegisteredTool(
             name=resolved_name,
             handler=handler,
@@ -124,7 +130,7 @@ class ToolRouter:
                 concurrency_safe if concurrency_safe is not None else resolved_mode == "read"
             ),
             exposure=exposure,
-            metadata=dict(metadata or {}),
+            metadata=merged_metadata,
         )
         self._tools[resolved_name] = tool_meta
         return tool_meta

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steerable-agent-runtime
-Version: 0.6.51
+Version: 0.6.52
 Summary: Steerable agent runtime: LLM, tool, storage, and transport adapters.
 License: Apache-2.0
 Requires-Python: >=3.10

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/src/steerable_agent_runtime.egg-info/SOURCES.txt

@@ -47,6 +47,7 @@ src/steerable_agent_runtime/spill.py
 src/steerable_agent_runtime/subagent.py
 src/steerable_agent_runtime/todo.py
 src/steerable_agent_runtime/tokens.py
+src/steerable_agent_runtime/tool_presentation.py
 src/steerable_agent_runtime/tool_schema.py
 src/steerable_agent_runtime/tool_search.py
 src/steerable_agent_runtime/tools.py
@@ -148,6 +149,7 @@ tests/test_todo_gate.py
 tests/test_tokens.py
 tests/test_tool_exposure.py
 tests/test_tool_hygiene.py
+tests/test_tool_presentation.py
 tests/test_tool_router.py
 tests/test_tool_schema.py
 tests/test_tool_timeout.py

{steerable_agent_runtime-0.6.51 → steerable_agent_runtime-0.6.52}/tests/test_approval.py

@@ -468,3 +468,104 @@ async def test_loop_abort_ends_turn_with_full_tool_responses() -> None:
     assert "user cancelled" in aborted
     assert "not executed" in skipped
     assert entries[3]["message"]["tool_call_id"] == "d2"
+
+
+# ---------------------------------------------------------------------------
+# In-project paths skip the prompt
+# ---------------------------------------------------------------------------
+
+
+def _request(name: str, arguments: dict[str, Any]) -> ApprovalRequest:
+    return ApprovalRequest(
+        tool_name=name,
+        arguments=arguments,
+        mode="other",
+        category=name,
+        round_index=0,
+        call_id="c1",
+    )
+
+
+@pytest.mark.asyncio
+async def test_workspace_auto_approver_allows_paths_inside_writable_roots(tmp_path) -> None:
+    from steerable_agent_runtime.approval import WorkspaceAutoApprover
+
+    project = tmp_path / "111-2"
+    project.mkdir()
+    inner = _ScriptedApprover([ApprovalDecision("deny_once", "should not ask")])
+    approver = WorkspaceAutoApprover(inner, [str(project)])
+    pptx = project / "自我介绍.pptx"
+
+    decision = await approver.approve(
+        _request("present_files", {"files": [{"path": str(pptx), "description": "deck"}]})
+    )
+    nested = await approver.approve(
+        _request("local_write_file", {"path": str(project / "notes" / "a.md"), "content": "x"})
+    )
+    relative = await approver.approve(
+        _request("local_read_file", {"path": "notes/a.md"})
+    )
+
+    assert decision.kind == "allow_once"
+    assert nested.kind == "allow_once"
+    assert relative.kind == "allow_once"
+    assert inner.requests == []
+
+
+@pytest.mark.asyncio
+async def test_workspace_auto_approver_asks_when_a_path_leaves_the_project(tmp_path) -> None:
+    from steerable_agent_runtime.approval import WorkspaceAutoApprover
+
+    project = tmp_path / "proj"
+    project.mkdir()
+    inner = _ScriptedApprover([ApprovalDecision("allow_once", "user allowed")] * 5)
+    approver = WorkspaceAutoApprover(inner, [str(project)])
+
+    outside = await approver.approve(
+        _request("present_files", {"files": [{"path": str(tmp_path / "other" / "a.pptx")}]})
+    )
+    sibling = await approver.approve(
+        _request("local_read_file", {"path": str(tmp_path / "proj-evil" / "secret")})
+    )
+    escaped = await approver.approve(
+        _request("local_read_file", {"path": "../outside.txt"})
+    )
+    mixed = await approver.approve(
+        _request(
+            "present_files",
+            {"files": [{"path": str(project / "in.pptx")}, {"path": str(tmp_path / "out.pptx")}]},
+        )
+    )
+    shell = await approver.approve(
+        _request("local_exec_shell", {"command": "ls", "cwd": str(project)})
+    )
+
+    assert [item.kind for item in (outside, sibling, escaped, mixed, shell)] == ["allow_once"] * 5
+    assert [item.tool_name for item in inner.requests] == [
+        "present_files",
+        "local_read_file",
+        "local_read_file",
+        "present_files",
+        "local_exec_shell",
+    ]
+
+
+@pytest.mark.asyncio
+async def test_workspace_auto_approver_does_not_cache_the_tool_name(tmp_path) -> None:
+    from steerable_agent_runtime.approval import WorkspaceAutoApprover
+
+    project = tmp_path / "proj"
+    project.mkdir()
+    inner = _ScriptedApprover([ApprovalDecision("deny_once", "outside")])
+    approver = WorkspaceAutoApprover(inner, [str(project)])
+
+    inside = await approver.approve(
+        _request("present_files", {"files": [{"path": str(project / "a.pptx")}]})
+    )
+    outside = await approver.approve(
+        _request("present_files", {"files": [{"path": str(tmp_path / "b.pptx")}]})
+    )
+
+    assert inside.kind == "allow_once"
+    assert outside.kind == "deny_once"
+    assert len(inner.requests) == 1