Repository navigation
fix(agent): reject nested state mutation in the strict tool-state read view - #334
Merged
yuluo-yx merged 2 commits intoOct 30, 2026
Conversation
…d view StateIsolation.readOnlyView wrapped only the top level of List/Map values, so nested containers (List<Map>, Map<List>, deeper combos) still shared references with the running state and a failed tool could flip nested entries without going through the patch channel. The read view now wraps every reachable List and Map behind an unmodifiable facade over a private backing: mutations are rejected at any depth, later structural changes cannot surface mid-execution, and cyclic or shared containers reuse one wrapper so wrapping terminates. Elements are wrapped, never duplicated; non-container values keep their declared pass-through boundary. Covers the standalone ReAct path and both graph execution paths through the existing strict-mode call sites, with nested mutation, failure and timeout scenarios asserting the original state stays unchanged.
… javadoc Address code-review findings on the nested isolation slice: the two ReAct nested-mutation tests now share one nestedMutator helper (matching the graph test's extraction), and the StateIsolation javadoc states the protection boundary precisely — wrapping follows List/Map nesting edges only, so containers reachable through other value types stay outside.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Confirmed contribution to ARGI: wrap every List/Map reachable from the strict tool-state read view behind an unmodifiable facade (any depth, cycle-safe, elements never duplicated) so failed or timed-out tools cannot mutate nested state bypassing the patch channel — with nested mutation, failure and timeout tests across standalone ReAct and both graph paths. Fixes #140.