[GH-ISSUE #200] fix(permission): avoid requiring investigation workspace write for cached complete runs #147

New issue

Closed

opened 2026-10-15 18:21:38 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:38 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/200

Summary

investigate-versions (CLI) and the investigation MCP tools always request write access for the workspace-capability pair that is named investigation_workspace_read.

Problem

This means operations that can be satisfied by reading an existing complete investigation workspace still require write authority.

src/cliInvestigationCommands.ts authorizes:
- investigation_workspace_read with access: "write"
- investigation_workspace_write with access: "write"
src/server/registerInvestigationTools.ts does the same via:
- scope.capability === "investigation_input" ? "read" : "write"

runCrossVersionInvestigation can return complete immediately when a cached workspace run is already complete and valid (completeOutcome path), so no snapshot/write checkpoint occurs in that fast path.

Reproduction (CLI)

Create or restore an existing complete workspace at workspacePath.
Configure permission policy with workspace read rights for that path but no workspace write grant.
Run:

rea investigate-versions <left> <right> <workspacePath> --yes

Observed: command rejects on permission preflight before checking that run is complete.
Expected: read-only replay of cached/complete workspace should only require workspace read rights.

Impact

Over-authorization in both CLI and MCP flows.
Breaks strict least-privilege permission setups.
Forces unnecessary write grant where workflow is read-only.

Suggested fix

Request investigation_workspace_read with read access.
Request investigation_workspace_write only when the run path will be written (for new/incomplete runs).
For both CLI and MCP, gate the write authorization decision on cache/run-state discovered from a read of the workspace.

Open files

src/cliInvestigationCommands.ts
src/server/registerInvestigationTools.ts

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/200 ### Summary `investigate-versions` (CLI) and the investigation MCP tools always request `write` access for the workspace-capability pair that is named `investigation_workspace_read`. ### Problem This means operations that can be satisfied by reading an existing complete investigation workspace still require write authority. - `src/cliInvestigationCommands.ts` authorizes: - `investigation_workspace_read` with `access: "write"` - `investigation_workspace_write` with `access: "write"` - `src/server/registerInvestigationTools.ts` does the same via: - `scope.capability === "investigation_input" ? "read" : "write"` `runCrossVersionInvestigation` can return `complete` immediately when a cached workspace run is already complete and valid (`completeOutcome` path), so no snapshot/write checkpoint occurs in that fast path. ### Reproduction (CLI) 1. Create or restore an existing complete workspace at `workspacePath`. 2. Configure permission policy with workspace read rights for that path but no workspace write grant. 3. Run: ```bash rea investigate-versions <left> <right> <workspacePath> --yes ``` Observed: command rejects on permission preflight before checking that run is complete. Expected: read-only replay of cached/complete workspace should only require workspace read rights. ### Impact - Over-authorization in both CLI and MCP flows. - Breaks strict least-privilege permission setups. - Forces unnecessary write grant where workflow is read-only. ### Suggested fix - Request `investigation_workspace_read` with `read` access. - Request `investigation_workspace_write` only when the run path will be written (for new/incomplete runs). - For both CLI and MCP, gate the write authorization decision on cache/run-state discovered from a read of the workspace. ### Open files - `src/cliInvestigationCommands.ts` - `src/server/registerInvestigationTools.ts`

bsakaguchi

2026-10-15 18:21:38 +00:00