Skip to content

Add bounded workspace tools - #2037

Merged
Aaronontheweb merged 2 commits into
goal/pit-of-success-workspace-pathsfrom
goal/pit-of-success-structured-workspace
Aug 20, 2026
Merged

Add bounded workspace tools#2037
Aaronontheweb merged 2 commits into
goal/pit-of-success-workspace-pathsfrom
goal/pit-of-success-structured-workspace

Conversation

@Aaronontheweb

@Aaronontheweb Aaronontheweb commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Add bounded file_search with literal name and content modes.
  • Add atomic file_read_many with complete path authorization and output ceilings.
  • Add bounded RFC 6901 projection through json_read.
  • Add PNG, JPEG, GIF, and WebP dimensions to file_read metadata.
  • Register the three small workspace schemas as Core tools.

Deterministic evidence

The structured workspace corpus passed 18 of 18 cases. It covers:

  • result, entry, byte, file-count, pointer-count, and output ceilings;
  • access denial and atomic batch behavior;
  • directory symlink exclusion;
  • strict UTF-8 rejection;
  • malformed JSON and JSON Pointer rejection;
  • PNG, JPEG, GIF, and WebP dimension extraction;
  • malformed image-header rejection;
  • caller cancellation.

No hosted model eval ran for this PR.

Validation

  • Release build: passed with zero warnings.
  • Full solution tests: 7,712 passed with expected platform and integration skips.
  • Actor tests: 3,517 passed with two expected platform skips.
  • Daemon tests: 1,039 passed.
  • Configuration tests: 602 passed.
  • Security tests: 1,052 passed.
  • Strict OpenSpec validation: passed.
  • Header verification: passed.
  • Changed-file Slopwatch: zero issues.
  • Diff check: passed.

Stack

This PR is layer 5 of GitHub stack #2023. Its base is PR #2033.

var tokens = new List<string>();
foreach (var encodedToken in source[1..].Split('/'))
{
var token = new StringBuilder(encodedToken.Length);
@Aaronontheweb
Aaronontheweb force-pushed the goal/pit-of-success-structured-workspace branch from fc755be to 9c731cf Compare August 20, 2026 05:33
Comment on lines +384 to +387
var missingPath = Path.Combine(
Path.GetTempPath(),
"netclaw-missing-" + Guid.NewGuid().ToString("N"),
"file.txt");
var publicContext = CreateContext(TrustAudience.Public);

var allowed = policy.TryResolveWritePath("/some/path", publicContext, out _, out var error);
var path = Path.Combine(Path.GetTempPath(), "netclaw-public-denied.txt");
@Aaronontheweb

Copy link
Copy Markdown
Collaborator Author

Sanitized hosted follow-up from the completed top-of-stack rollout proof (#2039): five trials each for recursive search, known batch read, JSON selection, and image metadata passed 20/20. Every trial used the intended structured workspace tool, and none used a shell fallback. Raw transcripts and environment details are not published.

@Aaronontheweb
Aaronontheweb force-pushed the goal/pit-of-success-structured-workspace branch from 9c731cf to 1e900ec Compare August 20, 2026 07:14
@Aaronontheweb
Aaronontheweb merged commit cfd528d into dev Aug 20, 2026
23 checks passed
@Aaronontheweb
Aaronontheweb deleted the goal/pit-of-success-structured-workspace branch August 20, 2026 08:29
@Aaronontheweb Aaronontheweb added enhancement New feature or request tools Issues related to agent tools: file_read, web_search, shell_execute, image processing, etc. labels Aug 20, 2026
This was referenced Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request tools Issues related to agent tools: file_read, web_search, shell_execute, image processing, etc.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant