[M3gA-Mind]

Summary

is_read_only_command lets a host skip the LLM summary for shell commands that only print files. It treated any sed without -i/--in-place as a plain read. A sed script can still write or run things without -i: sed -n '1 w out.txt' f and sed -n 's/a/b/w out.txt' f write a file, and sed -n '1e touch x' f and s/x/y/e run a shell command. All of these were classified as read-only. sed without -n was also accepted, although it prints the whole stream rather than a chosen slice.

Now sed counts as a read only when its only flag is -n and its script has no w, W, e or r command. The script is the first non-flag argument, and quoted scripts with spaces are handled. The check is deliberately conservative: it refuses those letters anywhere in the script, so a regex such as /error/p is refused as well. That costs only the summary skip for that call, so the conservative choice is the safe one.

Related issue

None.

API or behavior changes

is_read_only_command / is_read_only_call now return false for sed calls that lack -n, use any other flag (-E, -e, …), or have a script containing w, W, e or r. The host then summarizes those calls as it does for any other command. sed -n '<range>p' file, the form agents actually use, is still read-only.

Validation

Commands actually run, with their outcome:

• cargo fmt --all -- --check: rustfmt --edition 2024 on the touched files only.
• N/A: cargo clippy --all-targets --all-features -- -D warnings was left to CI.
• N/A: cargo build --all-targets --all-features was left to CI.
• N/A: cargo test --all-features was left to CI. Only the filesystem::read_only tests ran locally:
  • sed_counts_only_with_n_and_a_script_that_cannot_write_or_run before the fix failed (sed -n '1 w out.txt' notes.md was read-only); after the fix it passed, along with the 3 existing read_only tests.

Tests

filesystem/read_only_tests.rs::sed_counts_only_with_n_and_a_script_that_cannot_write_or_run covers w, s///w, W, e, s///e, r, missing -n, -E and -e, which must all be refused. It also checks that a quoted script with spaces (sed -n '/fn main/p') is still a read.

Documentation

The module doc and the READERS doc now describe the narrower sed rule.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[tinysweeper]

Tiny Sweeper review

Reviewed head: 781094dd232b74c2b935603e49dad78e3b7ad7df

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 2 files.
Pull request purpose (title): fix(read_only): sed…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(read_only): sed is a read only with -n and a script that cannot write or run. This pull request narrows the `sed` allowance in `is_read_only_command` so that `sed` counts as a plain file read only when its sole flag is `-n` and its script contains none of `w`, `W`, `e` or `r`. Previously any `sed` without `-i`/`--in-place` was treated as read-only, which admitted scripts that write files or execute shell commands. A new table-driven test pins both the accepted `-n` quoted-script form and the rejected write/execute, missing `-n`, and `-E`/`-e` forms. No trusted push-delta comparison is available, so this describes the whole pull request rather than a push delta.

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

`sed` classification is tightened from "no `-i`/`--in-place" to "plain `-n` read with a script free of `w`/`W`/`e`/`r`". Callers of `is_read_only_command` / `is_read_only_call` will now get `false` for `sed` invocations lacking `-n`, using any other flag (`-E`, `-e`, …), or whose script contains those letters, so the host summarizes those calls instead of skipping the summary. The quoted-script case is handled and the module/`READERS` docs are updated to match. The check is deliberately conservative: a regex such as `/error/p` is refused too, costing only the summary skip.

Features

• Modified — Stricter `sed` read-only classification: `sed` is treated as a plain read only with `-n` and a script that cannot write or execute, so write/execute forms are no longer skippable as reads and the classification only gets stricter. (crates/tinytools-std/src/filesystem/read_only.rs pub fn is_read_only_command(command: &str) -> bool {, crates/tinytools-std/src/filesystem/read_only.rs const FILE_READ_TOOLS: &[&str] = &["file_read", "read_file", "read", "view_file")

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: No reportable critique findings after dropping one disproved finding; retained findings were capped at Likely confidence because retrieval was degraded.
• Lane summary: Critique findings were capped at Likely confidence because retrieval was degraded: Reject scripts whose regex merely contains w/e/r. (1 finding dropped as disproved by the diff; 1 model finding retained at no more than Likely confidence because retrieval was degraded) _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The change only tightens the `sed` allowance so it cannot newly admit a command that writes; no defect found.
• Lane summary: The change tightens the `sed` allowance: previously only `-i`/`--in-place` was rejected, now anything but a plain `-n` read with a script free of `w`/`W`/`e`/`r` disqualifies the segment, so the classification only gets stricter and cannot newly admit a command that writes. The argument scanner handles the quoted and unquoted cases it is given and the new test covers the writing/executing forms; I found no defect to report. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: New test pins both the still-accepted `-n` read and nine refused command shapes, covering each new branch in the `sed` check. No reportable defect found.
• Lane summary: The change tightens the sed read-only check and ships a table-driven test that pins both halves: commands that must still count as reads (`sed -n '/fn main/p'`, already covered at line 10) and nine command shapes that must be refused, including the previously-allowed `sed '1,5p'` and the `-e`/`-E` flag paths. Every new branch in `is_plain_sed_read` (unterminated quote, non-`-n` flag, missing script, quiet flag) is exercised by those cases, and the existing negative cases for `-i`/`--in-place` still cover the old behaviour. The one invariant the doc comment asserts that the test does not pin is quoted-word escaping (`\'` inside a script), which is admitted waiving of precision, not a reachable misbehaviour. No reportable defect found. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: No sensitive content reported in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: No description defect found.
• Lane summary: The description matches the diff: it correctly states the narrower sed rule (only `-n`, script without `w`/`W`/`e`/`r`), the conservative letter-based check and its cost, the quoted-script handling, the behaviour change for callers, and the new test's coverage and red-then-green result. No description defect found. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000498
• Tokens: 183716 input · 4790 output · 47616 cached · 236 embedding
• Updated: 2026-10-22T23:07:17Z

Head	State	Pass summary
781094dd232b	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-22T23:07:17Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b5f9dec-225a-471a-9eac-798f7a14abe7

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0005