feat(cli): add a --read-only mode restricting runs to non-mutating tools for safe parallel investigation (#234)#235
Merged
Conversation
…ols for safe parallel investigation (#234) Mutating parallel agents need isolated worktrees (#50) and safety guards (#41), but pure-investigation tasks never mutate and forcing them into isolation is unnecessary overhead, with no guarantee an investigation agent stays read-only. Add an opt-in --read-only mode that restricts an unattended run to read-only tools (list/glob/grep/read) and refuses any mutating tool fail-closed, regardless of approval mode (even yolo) or folder-trust state, so several investigators can share one workspace safely without isolation. The refusal is recorded as a new read_only_denied failure-taxonomy category.
Owner
Author
E2E verification
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in (
--read-only) mode that restricts an unattended run to non-mutating tools, decomposed from roadmap #39 (isolated parallel agents).Mutating parallel agents need isolated worktrees (#50) and safety guards (#41), but pure-investigation tasks never mutate and forcing them into isolation is unnecessary overhead, with no guarantee an investigation agent stays read-only. This mode provides that guarantee.
Design
src/agent.ts: a new read-only gate inexecuteToolCall(placed before folder-trust/approval) refuses any non-readtool fail-closed whenreadOnlyis set — regardless of approval mode (even yolo) or folder-trust state. Threaded viaAgentOptions.readOnly.src/run-failure-taxonomy.ts: a newread_only_deniedfailure-taxonomy category so read-only refusals are categorized in the Run diagnostics: classify an unattended run's failures into a bounded, redacted failure taxonomy #222 report.src/index.ts: opt-in--read-onlywired into both headless-ppaths.This is what lets several investigators share one workspace safely without worktree isolation.
Testing
tests/unit/read-only-mode.test.ts(4 tests, viarunAgentwith a scripted provider): mutating write refused fail-closed in read-only mode, refused even under yolo (hard floor), read-only tool allowed, and mutating tool allowed when read-only is off (control).tests/integration/read-only-mode.test.ts(3 tests): CLI refuses a write fail-closed in read-only mode (no file created), allows a read (returns content), and allows a write when read-only is off (control).Gates: typecheck, build, unit (1658), integration (461 + desktop), smoke (51) all pass.
Closes #234