feat(tinytools-std): add the filesystem tools behind an FsGate seam

AGENTS.md

@@ -59,7 +59,8 @@ approval — it belongs to the host, whose threat model and configuration the
 decision depends on.
 
 `crates/tinytools-std` holds host-independent tool building blocks (cross-agent
-file staleness tracking, SSRF-safe URL validation, PATH probing). It is not part of the dependency-light vocabulary crate and may pull
+file staleness tracking, SSRF-safe URL validation, PATH probing, and the
+filesystem tools, which ask a host-implemented `FsGate` before they act). It is not part of the dependency-light vocabulary crate and may pull
 in `tokio`, `parking_lot` and `log`.
 
 Add a crate by creating `crates/<name>/` — `members = ["crates/*"]` picks it up

crates/tinytools-std/Cargo.toml

@@ -13,19 +13,31 @@ publish = false
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
+# Advisory inter-process `flock` around the MEMORY.md read-modify-write.
+fs2 = "0.4"
+# `glob_search` pattern matching.
+glob = "0.3"
+# `O_NOFOLLOW` when opening the workspace lock file (Unix only).
+libc = "0.2"
 # Structured diagnostics for DNS validation and SSRF refusals.
 log = "0.4"
 # Async path locks must remain non-blocking while callers hold them across I/O.
 parking_lot = "0.12"
+# `grep` pattern compilation.
+regex = { workspace = true }
 # Safe effective-credential executable checks for Unix PATH candidates.
 rustix = { version = "1", default-features = false, features = ["fs"] }
 serde_json = { workspace = true }
 tinytools = { path = "../tinytools", version = "0.5.0" }
-# `spawn_blocking` keeps synchronous system DNS resolution off async executor threads.
-tokio = { version = "1", default-features = false, features = ["rt", "sync"] }
+# `spawn_blocking` keeps synchronous system DNS resolution off async executor threads;
+# `fs`/`process`/`time` serve the filesystem tools.
+tokio = { version = "1", default-features = false, features = ["rt", "sync", "fs", "process", "time"] }
 tracing = { workspace = true }
+# `grep` and `glob_search` directory walks.
+walkdir = "2"
 
 [dev-dependencies]
+tempfile = "3"
 tokio = { workspace = true }
 
 [lints]

crates/tinytools-std/README.md

@@ -6,6 +6,7 @@ Host-independent building blocks for agent tools, extracted from OpenHuman.
 | --- | --- |
 | `file_state` | Process-wide read/write stamps so parallel agents detect stale or partial reads before overwriting a file. The host decides whether the guard is on (`init_global(enabled)`); read tools pass `record_read` an `Instant` captured before their I/O. |
 | `url_guard` | URL validation with SSRF checks for outbound network tools. `validate_url_with_dns_check` returns a `ValidatedUrl` whose vetted `addrs` the caller must pin its HTTP client to (e.g. `reqwest`'s `resolve_to_addrs`); re-resolving the hostname reopens DNS rebinding. |
+| `filesystem` | The file and repository tools: `file_read`, `file_write`, `edit_file`, `apply_patch`, `grep`, `glob`, `list_files`, `csv_export`, `read_diff`, `git_operations`, `run_linter`, `run_tests`, `update_memory_md`. Every tool that can touch a path takes an `Arc<dyn FsGate>`: the tool does the I/O, the host's gate (autonomy, workspace boundary, approvals, action budget) decides whether it may. |
 | `detect_tools` | `find_on_path` and the read-only `detect_tools` tool. |
 
-No enforcement of host policy lives here; the crate only supplies mechanisms.
+No enforcement of host policy lives here; the crate only supplies mechanisms. The `filesystem` tools' name, description and JSON Schema are pinned by the fixtures in `src/filesystem/fixtures/`.