Merge pull request #67 from open-coder-ai/claude/agent-memory-governance-gu5n6z

fix(adapters): tool_input is not always an object, and the string form blinded the guard

Author: jothimani-rajendran

CHANGELOG.md

@@ -6,6 +6,35 @@ versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Fixed
+- **`tool_input` is not always an object, and the string form blinded every guard.** Live
+  capture on VS Code Copilot (2026-08-29), the first real payloads this adapter has ever
+  had: the same `Edit` tool sent `tool_input` as an **object** in one run and as a
+  **129-character JSON string** in another, the two runs routed to different models. Against
+  the object the parser reported the file and its content; against the string it reported
+  neither, so a policy denying on secret content saw an empty write and allowed it. The
+  `isinstance` guard added when `parse()` was made total stopped the crash -- and a crash is
+  an allow -- but resolved the string to `{}`, which is the same blindness without the
+  traceback. `contract.tool_input_of` now decodes it, and every adapter reads through it.
+  Pinned by an invariant stated as an equivalence -- the string form must parse to what the
+  object form parses to -- so an adapter whose vendor does not use `tool_input` is not
+  accused of a bug, and only reading one shape and not the other is forbidden.
+
+### Changed
+- **VS Code Copilot's row moves from `vendor-source` to `live-partial`.** The capture
+  corrected the write-tool vocabulary the adapter had explicitly deferred to a live round:
+  the tools are `Edit`, `Read` and `Glob`, sending `path`/`old_str`/`new_str` -- not the
+  `create_file`/`edit_file`/`apply_patch` a filed finding had assumed. Those keys were
+  already in the generic parse chain, so the guessed *names* never mattered; the wire
+  *shape* did. Five events observed; `initial_prompt` (SessionStart) and `stop_reason`
+  (Stop) appear in no vendor doc read here.
+- **The redactor lost structure inside JSON-encoded strings.** It recorded the `Edit`
+  payload as `<str:129>`, which reads like an id, so a capture run specifically to learn
+  which keys the write tool carries came back saying nothing. A string that parses to a dict
+  or list is now unwrapped and redacted as the structure it is, marked `<json-string>` so a
+  reader can tell the vendor sent a string. Nothing is loosened: a test puts a secret inside
+  an embedded field and asserts it does not survive.
+
 ### Changed
 - **Cursor's "silence blocks" question is settled live, and the answer is a mechanism, not a
   rule.** Two trials on Cursor 3.17.8 (Windows, 2026-08-28) of one `beforeShellExecution`

examples/generated/README.md

@@ -26,6 +26,7 @@
     TOOL_FAILURE,
     UNKNOWN,
     Event,
+    tool_input_of,
 )
 
 AGENT = "claude_code"
@@ -116,7 +117,7 @@ def parse(raw):
     # an exception here kills the hook with exit 1, which most vendors treat as a
     # non-blocking error and let the call through. tool_input is whatever the agent chose
     # to serialise, so it is not ours to assume the shape of.
-    ti = ti if isinstance(ti, dict) else {}
+    ti = tool_input_of(ti)
     tool = raw.get("tool_name")
     # new_source is NotebookEdit's cell body -- the tool is in WRITE_TOOLS, so claiming to
     # handle it while dropping its content is an internal contradiction, not a vendor guess.

examples/generated/vscode_copilot.md

@@ -44,6 +44,7 @@
     SUBAGENT_STOP,
     UNKNOWN,
     Event,
+    tool_input_of,
 )
 
 # Re-exported: callers and tests address this through the adapter that needs it, and the
@@ -124,9 +125,7 @@ def parse(raw):
     imply a coverage this adapter does not have. `content`/`file_path`/`path` are kept only
     as a generic fallback for MCP tools, whose tool_input this capture did not exercise.
     """
-    ti = raw.get("tool_input") or {}
-    if not isinstance(ti, dict):
-        ti = {}
+    ti = tool_input_of(raw.get("tool_input"))
     content = ti.get("content")
     return Event(
         AGENT,

src/agentseam/adapters/claude_code.py

@@ -46,6 +46,7 @@
     UNKNOWN,
     Event,
     degraded_from,
+    tool_input_of,
 )
 
 AGENT = "cursor"
@@ -158,7 +159,7 @@ def parse(raw):
         # unknown event gets reported as the gate.
         name = "afterFileEdit" if isinstance(raw.get("edits"), list) else "beforeShellExecution"
     ti = raw.get("tool_input")
-    ti = ti if isinstance(ti, dict) else {}
+    ti = tool_input_of(ti)
     command = raw.get("command") or ti.get("command")
     # preToolUse nests the target inside tool_input; the file-scoped hooks put it at the
     # top level. Reading only one of the two leaves a guardrail asking "which file?" with
@@ -167,8 +168,7 @@ def parse(raw):
     return Event(
         AGENT,
         # An event this adapter has no mapping for resolves to UNKNOWN, never to the
-        # nearest canonical one: relabelling it invites a guardrail to evaluate the
-        # wrong policy against it.
+        # nearest canonical one: relabelling it invites a guardrail to evaluate the wrong policy against it.
         EVENT_MAP.get(name, UNKNOWN),
         tool=raw.get("tool_name") or name,
         command=command,

src/agentseam/adapters/codex_cli.py

@@ -46,6 +46,7 @@
     UNKNOWN,
     Event,
     degraded_from,
+    tool_input_of,
 )
 from .claude_code import looks_like_claude_code
 
@@ -110,7 +111,7 @@ def parse(raw):
     # an exception here kills the hook with exit 1, which most vendors treat as a
     # non-blocking error and let the call through. tool_input is whatever the agent chose
     # to serialise, so it is not ours to assume the shape of.
-    ti = ti if isinstance(ti, dict) else {}
+    ti = tool_input_of(ti)
     content = ti.get("content") or ti.get("new_string") or None
     out = raw.get("tool_output")
     if isinstance(out, (dict, list)):

src/agentseam/adapters/cursor.py

@@ -27,6 +27,7 @@
     STOP,
     UNKNOWN,
     Event,
+    tool_input_of,
 )
 from .claude_code import looks_like_claude_code
 
@@ -95,7 +96,7 @@ def parse(raw):
     # an exception here kills the hook with exit 1, which most vendors treat as a
     # non-blocking error and let the call through. tool_input is whatever the agent chose
     # to serialise, so it is not ours to assume the shape of.
-    ti = ti if isinstance(ti, dict) else {}
+    ti = tool_input_of(ti)
     tool = raw.get("tool_name")
     content = None
     if tool in WRITE_TOOLS:

src/agentseam/adapters/devin.py

@@ -44,6 +44,7 @@
     UNKNOWN,
     Event,
     degraded_from,
+    tool_input_of,
 )
 
 AGENT = "grok"
@@ -94,7 +95,7 @@ def claims(raw):
 
 def parse(raw):
     ti = raw.get("toolInput")
-    ti = ti if isinstance(ti, dict) else {}
+    ti = tool_input_of(ti)
     content = ti.get("content") or ti.get("new_string") or None
     out = raw.get("toolOutput")
     if isinstance(out, (dict, list)):

src/agentseam/adapters/gemini_cli.py

@@ -50,6 +50,7 @@
     STOP,
     UNKNOWN,
     Event,
+    tool_input_of,
 )
 
 AGENT = "junie"
@@ -89,7 +90,7 @@ def claims(raw):
 
 def parse(raw):
     ti = raw.get("tool_input")
-    ti = ti if isinstance(ti, dict) else {}
+    ti = tool_input_of(ti)
     # The docstring stakes everything on Junie's field names following Claude Code's wire
     # protocol exactly, so MultiEdit's edits[].new_string and NotebookEdit's new_source get
     # the same fallback chain claude_code.parse uses -- not a guess, a claim we already made.