feat: resolve agent-home-relative file references in get_content#444
Open
andrii-novikov wants to merge 3 commits into
Open
feat: resolve agent-home-relative file references in get_content#444andrii-novikov wants to merge 3 commits into
andrii-novikov wants to merge 3 commits into
Conversation
Classify schemeless, hostless paths (e.g. reports/img.png) as a new UrlScheme.DIAL_APPDIR_RELATIVE — the agent-home-relative convention the internal_file_* tools speak — instead of lumping them into UNSUPPORTED. internal_attachments_get_content now resolves such references under the agent home and delivers the resolved files/ url on the attachment, so the model can hand a file-tool path straight to get_content. To make the resolver injectable outside the file family, _HomePathResolver moves from dial_files_tooling to a public shared/home_path/HomePathResolver bound by a HomePathModule spliced into shared_module; dial_files_tooling drops its inline binding and injects the shared type. MCP dial_url parameters keep rejecting the new scheme explicitly (it is not a shareable DIAL file there), preserving current behavior.
andrii-novikov
requested review from
VinShurik,
korotaav48 and
ypldan
as code owners
July 13, 2026 14:57
Address PR #444 review comments: - add is_appdir_relative to common/url_classification.py as the canonical detection predicate: DIAL UI forbidden chars (:;,={}%&\\" and control chars), no ..//./empty/trailing-dot segments, dir form via trailing '/', extensionless files allowed, UI length limits (255 bytes/segment, 1024 total); classify_url delegates its schemeless branch to it - move validate_relative_path from dial_files_tooling/_utils.py into shared/home_path/home_path_resolver.py (its only caller) so shared/ no longer imports from a feature module - drop leftover binding breadcrumb comment in dial_files_tooling_module - TODO(#445) at the MCP dial_url rejection branch for future appdir-relative resolution - rework classification tests to the new grammar; cover traversal, forbidden chars, and UTF-8 byte-length limits; get_content traversal references now fail at classification, before the resolver
VinShurik
approved these changes
Jul 17, 2026
VinShurik
left a comment
VinShurik
left a comment
Contributor
There was a problem hiding this comment.
Small nit adjustments:
Update documentation files
pass_attachments_to_orchestrator.md
agent.md
dial_files_tools.md
to mention new shared/home_path module and it's functionality
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applicable issues
dial_urlparameters)Description of changes
Agents routinely hold agent-home-relative paths (e.g.
reports/img.png) — that is the convention theinternal_file_*tools speak. Butinternal_attachments_get_contentrejected such references as unsupported, forcing the model to guess the absolutefiles/...form it has never seen.This PR makes the reference round-trip work:
UrlScheme.DIAL_APPDIR_RELATIVE—classify_urlclassifies a schemeless path as the agent-home-relative convention instead ofUNSUPPORTED. Detection is owned by the canonical public predicateis_appdir_relativeso the grammar cannot drift between consumers:file.md,dir1/file.md; extension optional, sowrite_file-created names likenotesround-trip) or dir form with a trailing slash (some_dir/,dir_1/dir2/).././ empty segments, no segment ending with a dot (DIAL Core rule): ; , = { } % & \ "and control chars (ui-kitNOT_ALLOWED_SYMBOLS/NOT_ALLOWED_SPACES)internal_attachments_get_contentresolves such references under the agent home and delivers the resolvedfiles/...url on the attachment, while the payload echoes the reference as passed. Rejection messages enumerate the accepted forms. Traversal attempts (../x.png) now fail at classification, before the resolver.shared/home_path/HomePathResolver— the privatedial_files_tooling/_HomePathResolvermoves to a public shared package with its ownHomePathModule(spliced intoshared_module), so consumers outside the file family can inject it without reaching into another module's privates.validate_relative_pathmoved with it (the resolver was its only caller), soshared/no longer imports from a feature module. Rationale:_GetContentToollives outsidedial_files_tooling; injecting a_-private class across module boundaries would violate the DI conventions. The move is mechanical (class rename + module binding), covered by the relocated resolver tests.dial_urlparameters keep rejecting the new scheme explicitly (a home-relative path is not a shareable DIAL file there) — behavior is unchanged; resolving instead of rejecting is tracked in Support agent-home-relative file references in MCP dial_url parameters #445 (TODO(#445)at the branch).Tests
classify_url/is_appdir_relative: valid file/dir forms (incl. extensionless and names with spaces); invalid traversal, forbidden characters, trailing-dot segments, and UTF-8 byte-length limits (incl. multibyte case).get_content: home-relative success (attachment carries resolved url, payload echoes reference, no promotion), resolution failure surfaces the resolver message, traversal rejected before the resolver, MIME rejection on resolved content.dial_urlparameter still rejected, no permission grant.tests/unit_tests/shared/unchanged in substance.All 1643 unit tests pass;
make lintclean.Checklist
[ ] Design documented is updated/created and approved by the team (if applicable)(no design doc for this change)[ ] Documentation is updated/created (if applicable)(internal change; no docs affected)[ ] App schema changes are backward compatible, or breaking changes are documented with a migration guide(no schema change)By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.