mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-10-07 03:00:29 +00:00
a925275778
`ReadBeforeWriteSandbox` blocked writes to any existing file the agent had not read, tracked by a session read set populated only by `read_file`, `grep`, `read_many_files`, and the Kimi `Read`. The gpt56 profile has none of those. It mirrors Codex's tool contract -- `shell_command`, `apply_patch`/`edit_file`, `update_plan`, `web_search` -- and reads through the shell, so its read set stayed permanently empty and every edit to an existing file failed. In run 01KYD4360GN6SED4BYEVGYP4XT all 28 `edit_file` calls failed, 25 of them on the guard. The agent read `package.json` with `sed` and `cat`, hex-dumped it trying to diagnose the rejections, then routed around the guard with `sed -i`, which the guard never covered. It prevented no blind write; it converted content-anchored edits into an unreviewed in-place shell rewrite. Neither Codex nor Kimi Code enforces read-before-write at runtime. Codex's `apply_patch` `Add File` overwrites an existing path silently; Kimi Code's `Write` has no check at all. Both rely on the exact-match requirement in their edit tools, which is stronger proof of inspection than a read set, plus per-write approval. Tool descriptions and the Kimi prompt keep telling the model to read before editing -- that guidance matches Kimi Code's own `edit.md` and still prevents `old_string not found` -- but no longer claim the workspace refuses unread writes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| tests | ||
| Cargo.toml | ||