From 581241cdc713b7f5d2ce822560aa6f920a535ee3 Mon Sep 17 00:00:00 2001
From: root <root@ABB.localdomain>
Date: Tue, 28 Jul 2026 19:29:01 +0800
Subject: [PATCH] fix(s03,s04,s20): remove dead safe_path, sync READMEs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Delete safe_path entirely (following PR #483 approach) — no dead code
- Update all 3 READMEs per module to reflect read_file in Gate 2
- s04: also update permission_hook snippet in READMEs
- s20: remove safe_path (already replaced with inline resolution)

Closes #482
---
 s03_permission/README.en.md |  2 +-
 s03_permission/README.ja.md |  2 +-
 s03_permission/README.md    |  2 +-
 s04_hooks/README.en.md      |  2 +-
 s04_hooks/README.ja.md      |  2 +-
 s04_hooks/README.md         |  2 +-
 s04_hooks/code.py           | 10 +---------
 s20_comprehensive/code.py   | 10 ----------
 8 files changed, 7 insertions(+), 25 deletions(-)

diff --git a/s03_permission/README.en.md b/s03_permission/README.en.md
index 6e558148..60451679 100644
--- a/s03_permission/README.en.md
+++ b/s03_permission/README.en.md
@@ -61,7 +61,7 @@ PERMISSION_RULES = [
     {
         "tools": ["read_file", "write_file", "edit_file"],
         "check": lambda args: not (WORKDIR / args.get("path", "")).resolve().is_relative_to(WORKDIR),
-        "message": "Writing outside workspace",
+        "message": "Access outside workspace",
     },
     {
         "tools": ["bash"],
diff --git a/s03_permission/README.ja.md b/s03_permission/README.ja.md
index da3cf248..9dc02034 100644
--- a/s03_permission/README.ja.md
+++ b/s03_permission/README.ja.md
@@ -61,7 +61,7 @@ PERMISSION_RULES = [
     {
         "tools": ["read_file", "write_file", "edit_file"],
         "check": lambda args: not (WORKDIR / args.get("path", "")).resolve().is_relative_to(WORKDIR),
-        "message": "Writing outside workspace",
+        "message": "Access outside workspace",
     },
     {
         "tools": ["bash"],
diff --git a/s03_permission/README.md b/s03_permission/README.md
index d86f7db0..0e924f1b 100644
--- a/s03_permission/README.md
+++ b/s03_permission/README.md
@@ -61,7 +61,7 @@ PERMISSION_RULES = [
     {
         "tools": ["read_file", "write_file", "edit_file"],
         "check": lambda args: not (WORKDIR / args.get("path", "")).resolve().is_relative_to(WORKDIR),
-        "message": "Writing outside workspace",
+        "message": "Access outside workspace",
     },
     {
         "tools": ["bash"],
diff --git a/s04_hooks/README.en.md b/s04_hooks/README.en.md
index 1a910309..eab401d4 100644
--- a/s04_hooks/README.en.md
+++ b/s04_hooks/README.en.md
@@ -108,7 +108,7 @@ def permission_hook(block):
         for pattern in DENY_LIST:
             if pattern in block.input.get("command", ""):
                 return "Permission denied by deny list"
-    if block.name in ("write_file", "edit_file"):
+    if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):
             choice = input("   Allow? [y/N] ").strip().lower()
diff --git a/s04_hooks/README.ja.md b/s04_hooks/README.ja.md
index 71c659fa..3185f70a 100644
--- a/s04_hooks/README.ja.md
+++ b/s04_hooks/README.ja.md
@@ -108,7 +108,7 @@ def permission_hook(block):
         for pattern in DENY_LIST:
             if pattern in block.input.get("command", ""):
                 return "Permission denied by deny list"
-    if block.name in ("write_file", "edit_file"):
+    if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):
             choice = input("   Allow? [y/N] ").strip().lower()
diff --git a/s04_hooks/README.md b/s04_hooks/README.md
index fc0e2e4f..3b87c4c3 100644
--- a/s04_hooks/README.md
+++ b/s04_hooks/README.md
@@ -108,7 +108,7 @@ def permission_hook(block):
         for pattern in DENY_LIST:
             if pattern in block.input.get("command", ""):
                 return "Permission denied by deny list"
-    if block.name in ("write_file", "edit_file"):
+    if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):
             choice = input("   Allow? [y/N] ").strip().lower()
diff --git a/s04_hooks/code.py b/s04_hooks/code.py
index 9c6b6f95..b676c31e 100644
--- a/s04_hooks/code.py
+++ b/s04_hooks/code.py
@@ -75,17 +75,9 @@ SYSTEM = f"You are a coding agent at {WORKDIR}. Use tools to solve tasks. Act, d
 
 
 # ═══════════════════════════════════════════════════════════
-#  FROM s02-s03 (unchanged): Tool Implementations
+#  FROM s02-s03 : Tool Implementations
 # ═══════════════════════════════════════════════════════════
 
-def safe_path(p: str) -> Path:
-    """Convert a string path to a resolved Path relative to WORKDIR.
-    
-    NOTE: Path escape checking is now handled by permission_hook,
-    which asks the user for approval. safe_path only does str→Path conversion.
-    """
-    return (WORKDIR / p).resolve()
-
 def run_bash(command: str) -> str:
     try:
         r = subprocess.run(command, shell=True, cwd=WORKDIR,
diff --git a/s20_comprehensive/code.py b/s20_comprehensive/code.py
index 1ba0943f..417d6065 100644
--- a/s20_comprehensive/code.py
+++ b/s20_comprehensive/code.py
@@ -376,16 +376,6 @@ def assemble_system_prompt(context: dict) -> str:
 
 # ── Basic Tools ──
 
-def safe_path(p: str, cwd: Path = None) -> Path:
-    """Convert a string path to a resolved Path relative to base.
-    
-    NOTE: Path escape checking is now handled by permission_hook,
-    which asks the user for approval. safe_path only does str→Path conversion.
-    """
-    base = cwd or WORKDIR
-    return (base / p).resolve()
-
-
 def run_bash(command: str, cwd: Path = None,
              run_in_background: bool = False) -> str:
     # run_in_background is consumed by the dispatcher; direct execution ignores it.