Unify tool-name classification constants - #589
Merged
TheGreatAxios merged 1 commit intoAug 24, 2026
Merged
Conversation
Three READ_TOOLS constants had drifted apart under the same name, one
of them (permission's auto-allow gate) security-relevant. Add
src/agent/tool-classification.ts as the single source of truth:
- AUTO_ALLOW_READ_TOOLS: derived from the director read surface minus
run_shell/web_fetch/web_search (which have their own auto-allow
rules) plus manage_tasks. Replaces classify.ts's inline
READ_ONLY_TOOLS with the identical membership — no auto-allow
behavior change.
- PATH_KEYED_READ_TOOLS: the {read_file} set that was defined
identically in both compactor.ts and thrash.ts, now shared.
- SEARCH_QUERY_TOOLS: the {grep, search_files} base shared by
compaction's QUERY_TOOLS (adds list_dir) and thrash's SEARCH_TOOLS
(deliberately omits it — a repeated list_dir isn't the stuck
read/search loop thrash watches for).
Adds a pinning test so future drift fails CI instead of spreading
silently.
TheGreatAxios
enabled auto-merge
August 24, 2026 00:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes CL-6809.
Before / after
READ_TOOLS(director surface)src/agent/directors/tool-sets.tsREAD_ONLY_TOOLS(auto-allow gate)src/permission/classify.tsAUTO_ALLOW_READ_TOOLSfromsrc/agent/tool-classification.ts(derived from director READ_TOOLS minus run_shell/web_fetch/web_search, plus manage_tasks)READ_TOOLS(compaction re-read dedup)src/session/compactor.tsPATH_KEYED_READ_TOOLS(shared)READ_TOOLS(thrash read tracking)src/subagent/thrash.tsPATH_KEYED_READ_TOOLS(shared, same value)QUERY_TOOLS(compaction)src/session/compactor.tsSEARCH_QUERY_TOOLS(shared base) + list_dir, unchanged membershipSEARCH_TOOLS(thrash)src/subagent/thrash.tsSEARCH_QUERY_TOOLSdirectly, unchanged membershipAuto-allow behavior
No change.
AUTO_ALLOW_READ_TOOLSis derived from the director'sREAD_TOOLS(filtering outrun_shell/web_fetch/web_search, which have their own narrower auto-allow rules) plusmanage_tasks, and that derivation produces exactly the same six tools classify.ts already granted allow-tier to:read_file,search_files,grep,list_dir,lsp,manage_tasks. Verified by inspection and pinned by a new test (src/agent/tool-classification.test.ts) that asserts the exact set.Deliberate vs. drift
compactor.tsandthrash.ts'sREAD_TOOLS({read_file}) were identical — genuine duplication, now unified asPATH_KEYED_READ_TOOLS.compactor.ts'sQUERY_TOOLSincludeslist_dir;thrash.ts'sSEARCH_TOOLSdoes not. This is a real conceptual difference: compaction treats any replayable query result (grep/search_files/list_dir) as supersedable by a later identical call, while thrash's read tracking is specifically about detecting stuck read/search loops, and a repeated directory listing isn't the same loop signal a repeated grep or read is. Kept separate, both built on the sharedSEARCH_QUERY_TOOLSbase, and documented insrc/agent/tool-classification.ts.READ_ONLY_TOOLS(auto-allow) is a strict subset of the director read surface (no shell/web) plusmanage_tasks— a genuinely different concept ("never needs a prompt" vs. "read-capable leaf tool"), now expressed as a derivation instead of a hand-maintained duplicate list.Testing
bun run check(lint, typecheck, build, test) green in the worktree: 5381 pass, 0 fail.