fix(copilot): unified MCP file tools (Read/Write/Edit) to prevent truncation data loss

autogpt_platform/backend/backend/copilot/context.py

@@ -116,6 +116,47 @@ def is_within_allowed_dirs(path: str) -> bool:
     return False
 
 
+def is_sdk_tool_path(path: str) -> bool:
+    """Return True if *path* is an SDK-internal tool-results or tool-outputs path.
+
+    These paths exist on the host filesystem (not in the E2B sandbox) and are
+    created by the Claude Agent SDK itself.  In E2B mode, only these paths should
+    be read from the host; all other paths should be read from the sandbox.
+
+    This is a strict subset of ``is_allowed_local_path`` — it intentionally
+    excludes ``sdk_cwd`` paths because those are the agent's working directory,
+    which in E2B mode is the sandbox, not the host.
+    """
+    if not path:
+        return False
+
+    if path.startswith("~"):
+        resolved = os.path.realpath(os.path.expanduser(path))
+    elif not os.path.isabs(path):
+        # Relative paths cannot resolve to an absolute SDK-internal path
+        return False
+    else:
+        resolved = os.path.realpath(path)
+
+    encoded = _current_project_dir.get("")
+    if not encoded:
+        return False
+
+    project_dir = os.path.realpath(os.path.join(SDK_PROJECTS_DIR, encoded))
+    if not project_dir.startswith(SDK_PROJECTS_DIR + os.sep):
+        return False
+    if not resolved.startswith(project_dir + os.sep):
+        return False
+
+    relative = resolved[len(project_dir) + 1 :]
+    parts = relative.split(os.sep)
+    return (
+        len(parts) >= 3
+        and _UUID_RE.match(parts[0]) is not None
+        and parts[1] in ("tool-results", "tool-outputs")
+    )
+
+
 def resolve_sandbox_path(path: str) -> str:
     """Normalise *path* to an absolute sandbox path under an allowed directory.
 

autogpt_platform/backend/backend/copilot/permissions.py

@@ -389,31 +389,36 @@ def apply_tool_permissions(
     all_tools = all_known_tool_names()
     effective = permissions.effective_allowed_tools(all_tools)
 
-    # In E2B mode, SDK built-in file tools (Read, Write, Edit, Glob, Grep)
-    # are replaced by MCP equivalents (read_file, write_file, ...).
-    # Map each SDK built-in name to its E2B MCP name so users can use the
-    # familiar names in their permissions and the E2B tools are included.
-    _SDK_TO_E2B: dict[str, str] = {}
+    # SDK built-in file tools are replaced by MCP equivalents in both modes.
+    # Map each SDK built-in name to its MCP tool name so users can use the
+    # familiar names in their permissions and the correct tools are included.
+    _SDK_TO_MCP: dict[str, str] = {}
     if use_e2b:
         from backend.copilot.sdk.e2b_file_tools import E2B_FILE_TOOL_NAMES
 
-        _SDK_TO_E2B = dict(
+        _SDK_TO_MCP = dict(
             zip(
                 ["Read", "Write", "Edit", "Glob", "Grep"],
                 E2B_FILE_TOOL_NAMES,
                 strict=False,
             )
         )
+    else:
+        from backend.copilot.sdk.e2b_file_tools import EDIT_TOOL_NAME as _EDIT
+        from backend.copilot.sdk.e2b_file_tools import READ_TOOL_NAME as _READ
+        from backend.copilot.sdk.e2b_file_tools import WRITE_TOOL_NAME as _WRITE
+
+        _SDK_TO_MCP = {"Read": _READ, "Write": _WRITE, "Edit": _EDIT}
 
     # Build an updated allowed list by mapping short names → SDK names and
     # keeping only those present in the original base_allowed list.
     def to_sdk_names(short: str) -> list[str]:
         names: list[str] = []
         if short in TOOL_REGISTRY:
             names.append(f"{MCP_TOOL_PREFIX}{short}")
-        elif short in _SDK_TO_E2B:
-            # E2B mode: map SDK built-in file tool to its MCP equivalent.
-            names.append(f"{MCP_TOOL_PREFIX}{_SDK_TO_E2B[short]}")
+        elif short in _SDK_TO_MCP:
+            # Map SDK built-in file tool to its MCP equivalent.
+            names.append(f"{MCP_TOOL_PREFIX}{_SDK_TO_MCP[short]}")
         else:
             names.append(short)  # SDK built-in — used as-is
         return names
@@ -422,7 +427,7 @@ def to_sdk_names(short: str) -> list[str]:
     permitted_sdk: set[str] = set()
     for s in effective:
         permitted_sdk.update(to_sdk_names(s))
-    # Always include the internal Read tool (used by SDK for large/truncated outputs)
+    # Always include the internal read_tool_result tool (used by SDK for large/truncated outputs)
     permitted_sdk.add(f"{MCP_TOOL_PREFIX}{_READ_TOOL_NAME}")
 
     filtered_allowed = [t for t in base_allowed if t in permitted_sdk]

autogpt_platform/backend/backend/copilot/permissions_test.py

@@ -408,12 +408,12 @@ def test_whitelist_keeps_only_listed(self, mocker):
         assert "Task" not in allowed
 
     def test_read_tool_always_included_even_when_blacklisted(self, mocker):
-        """mcp__copilot__Read must stay in allowed even if Read is explicitly blacklisted."""
+        """mcp__copilot__read_tool_result must stay in allowed even if Read is explicitly blacklisted."""
         mocker.patch(
             "backend.copilot.sdk.tool_adapter.get_copilot_tool_names",
             return_value=[
                 "mcp__copilot__run_block",
-                "mcp__copilot__Read",
+                "mcp__copilot__read_tool_result",
                 "Task",
             ],
         )
@@ -432,17 +432,19 @@ def test_read_tool_always_included_even_when_blacklisted(self, mocker):
         # Explicitly blacklist Read
         perms = CopilotPermissions(tools=["Read"], tools_exclude=True)
         allowed, _ = apply_tool_permissions(perms, use_e2b=False)
-        assert "mcp__copilot__Read" in allowed  # always preserved for SDK internals
+        assert (
+            "mcp__copilot__read_tool_result" in allowed
+        )  # always preserved for SDK internals
         assert "mcp__copilot__run_block" in allowed
         assert "Task" in allowed
 
     def test_read_tool_always_included_with_narrow_whitelist(self, mocker):
-        """mcp__copilot__Read must stay in allowed even when not in a whitelist."""
+        """mcp__copilot__read_tool_result must stay in allowed even when not in a whitelist."""
         mocker.patch(
             "backend.copilot.sdk.tool_adapter.get_copilot_tool_names",
             return_value=[
                 "mcp__copilot__run_block",
-                "mcp__copilot__Read",
+                "mcp__copilot__read_tool_result",
                 "Task",
             ],
         )
@@ -461,7 +463,9 @@ def test_read_tool_always_included_with_narrow_whitelist(self, mocker):
         # Whitelist only run_block — Read not listed
         perms = CopilotPermissions(tools=["run_block"], tools_exclude=False)
         allowed, _ = apply_tool_permissions(perms, use_e2b=False)
-        assert "mcp__copilot__Read" in allowed  # always preserved for SDK internals
+        assert (
+            "mcp__copilot__read_tool_result" in allowed
+        )  # always preserved for SDK internals
         assert "mcp__copilot__run_block" in allowed
 
     def test_e2b_file_tools_included_when_sdk_builtin_whitelisted(self, mocker):
@@ -470,7 +474,7 @@ def test_e2b_file_tools_included_when_sdk_builtin_whitelisted(self, mocker):
             "backend.copilot.sdk.tool_adapter.get_copilot_tool_names",
             return_value=[
                 "mcp__copilot__run_block",
-                "mcp__copilot__Read",
+                "mcp__copilot__read_tool_result",
                 "mcp__copilot__read_file",
                 "mcp__copilot__write_file",
                 "Task",
@@ -500,13 +504,48 @@ def test_e2b_file_tools_included_when_sdk_builtin_whitelisted(self, mocker):
         # Write not whitelisted — write_file should NOT be included
         assert "mcp__copilot__write_file" not in allowed
 
+    def test_non_e2b_file_tools_included_when_sdk_builtin_whitelisted(self, mocker):
+        """In non-E2B mode, whitelisting 'Write' must include mcp__copilot__Write."""
+        mocker.patch(
+            "backend.copilot.sdk.tool_adapter.get_copilot_tool_names",
+            return_value=[
+                "mcp__copilot__run_block",
+                "mcp__copilot__Write",
+                "mcp__copilot__Edit",
+                "mcp__copilot__read_file",
+                "mcp__copilot__read_tool_result",
+                "Task",
+            ],
+        )
+        mocker.patch(
+            "backend.copilot.sdk.tool_adapter.get_sdk_disallowed_tools",
+            return_value=["Bash"],
+        )
+        mocker.patch(
+            "backend.copilot.sdk.tool_adapter.TOOL_REGISTRY",
+            {"run_block": object()},
+        )
+        mocker.patch(
+            "backend.copilot.permissions.all_known_tool_names",
+            return_value=frozenset(["run_block", "Read", "Write", "Edit", "Task"]),
+        )
+        # Whitelist Write and run_block — mcp__copilot__Write should be included
+        perms = CopilotPermissions(tools=["Write", "run_block"], tools_exclude=False)
+        allowed, _ = apply_tool_permissions(perms, use_e2b=False)
+        assert "mcp__copilot__Write" in allowed
+        assert "mcp__copilot__run_block" in allowed
+        # Edit not whitelisted — should NOT be included
+        assert "mcp__copilot__Edit" not in allowed
+        # read_tool_result always preserved for SDK internals
+        assert "mcp__copilot__read_tool_result" in allowed
+
     def test_e2b_file_tools_excluded_when_sdk_builtin_blacklisted(self, mocker):
         """In E2B mode, blacklisting 'Read' must also remove mcp__copilot__read_file."""
         mocker.patch(
             "backend.copilot.sdk.tool_adapter.get_copilot_tool_names",
             return_value=[
                 "mcp__copilot__run_block",
-                "mcp__copilot__Read",
+                "mcp__copilot__read_tool_result",
                 "mcp__copilot__read_file",
                 "Task",
             ],
@@ -532,8 +571,8 @@ def test_e2b_file_tools_excluded_when_sdk_builtin_blacklisted(self, mocker):
         allowed, _ = apply_tool_permissions(perms, use_e2b=True)
         assert "mcp__copilot__read_file" not in allowed
         assert "mcp__copilot__run_block" in allowed
-        # mcp__copilot__Read is always preserved for SDK internals
-        assert "mcp__copilot__Read" in allowed
+        # mcp__copilot__read_tool_result is always preserved for SDK internals
+        assert "mcp__copilot__read_tool_result" in allowed
 
 
 # ---------------------------------------------------------------------------

autogpt_platform/backend/backend/copilot/prompting.py

@@ -75,11 +75,12 @@
 }}
 ```
 
-### Writing large files — CRITICAL
-**Never write an entire large document in a single tool call.**  When the
-content you want to write exceeds ~2000 words the tool call's output token
-limit will silently truncate the arguments, producing an empty `{{}}` input
-that fails repeatedly.
+### Writing large files — CRITICAL (causes production failures)
+**NEVER write an entire large document in a single tool call.**  When the
+content you want to write exceeds ~2000 words the API output-token limit
+will silently truncate the tool call arguments mid-JSON, losing all content
+and producing an opaque error.  This is unrecoverable — the user's work is
+lost and retrying with the same approach fails in an infinite loop.
 
 **Preferred: compose from file references.**  If the data is already in
 files (tool outputs, workspace files), compose the report in one call