docs_agent exposes builtin filesystem/planning tools and returns fake "Updated file" successes - #678
Draft
langsmith-engine[bot] wants to merge 1 commit into
Draft
Conversation
…cs tools so it can't fake filesystem writes The deepagents harness auto-injects builtin filesystem/planning tools (write_file, write_todos, ls, read_file, edit_file, glob, grep, execute, task) with no author opt-out flag, so the stateless docs agent could call write_file and return fabricated 'Updated file ...' successes. Strip those tools before the model sees them, restrict the MCP export to docs-search tools, and instruct the agent to decline local-project work.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
docs_agentdocumentation assistant is registered with only four docs tools, but thedefine_deep_agentmanaged harness auto-injects builtin Deep Agents scaffolding tools (write_todos,write_file,edit_file,read_file,ls,glob,grep,task) that were never opted out, and the MCP connector inconnectors/mcp.pyexports its tools unfiltered. As a result the agent callswrite_fileand returns fabricated success strings like "Updated file /home/user/..." - falsely telling users it created or edited files on their local machine, which it has no access to - and callswrite_todoson plain docs questions, persisting a todo list a stateless docs assistant cannot honor. A further observed surface: the agent aimsread_file,glob,lsandedit_fileat the user's own absolute repo path (e.g. a WindowsD:/...path), every call fails ('File not found', empty glob, 'Windows absolute paths are not supported'), and the agent then writeswrite_todosentries with statuscompletedfor the edit that never happened before delivering the fix as prose. NEW SYMPTOM:write_todosis now also the source of every raised tool exception in the project - the model passes a plain list of strings (or an invalidstatusenum value) where the builtin'sWriteTodosInputschema requires a list of dicts, producing Pydantic 'validation error' spans on ordinary docs questions, because the injected builtin's schema is never surfaced in the docs-agent prompt. This is a correctness and trust harm that occurs on any request the model interprets as a build/analyze-my-project task, and also a scope/safety gap since these tools should not exist for a docs Q&A agent.