1.3 KiB
description, memory, tools, disallowed_tools, expect_tools_present, expect_tools_absent, expect_prompt_contains, expect_prompt_absent
| description | memory | tools | disallowed_tools | expect_tools_present | expect_tools_absent | expect_prompt_contains | expect_prompt_absent |
|---|---|---|---|---|---|---|---|
| memory + disallowed_tools — a denied write tool must not count as write capability. | project | read, write | write | read | write, edit, bash, grep | Agent Memory (read-only), Memory scope: project | persistent memory directory |
README: "The disallowed_tools field is respected when determining write
capability — an agent with tools: write + disallowed_tools: write correctly
gets read-only memory."
This is the combination neither memory-readonly.md (no write tool at all) nor
memory-readwrite.md (write tool, nothing denied) exercises: the write tool IS
in the tools: set, so a naive capability check sees it and hands the agent the
read-write memory prompt — which also appends write/edit to the tool names,
widening the set the agent asked for. The denylist still filters the registry, so
the visible symptom is an agent instructed to write memory files with no tool to
do it; the invisible one is the tool-name widening.
Scope project is safe here precisely because the read-only branch creates no
memory directory — if this fixture ever flips to the read-write branch, it would
also start writing into the repo, which is the loudest possible signal.