Tool-Augmented RAG: Agents Fetch Exact File Ranges Before Answering

// agent/tool-rag.ts
type Hit = { path: string; start: number; end: number; score: number; blobSha?: string };

export async function answer(question: string, retrieve: (q: string) => Promise<Hit[]>) {
 const hits = await retrieve(question);
 // ✅ Pass hits as tool hints, not as final context dump
 const system = `You MUST call read_range for every claim. Never invent lines.`;
 return runAgent({ system, tools: [readRangeTool], hints: hits.slice(0, 8), question });
}

# tools/read_range.py
from pathlib import Path
import hashlib

MAX_BYTES = 24_000

def read_range(path: str, start: int, end: int, expect_sha: str | None = None) -> dict:
 p = Path(path).resolve()
 if not str(p).startswith("/workspace/"): # ✅ allowlist root
 return {"error": "path_denied"}
 text = p.read_text(encoding="utf-8", errors="replace")
 sha = hashlib.sha1(text.encode()).hexdigest()
 if expect_sha and sha != expect_sha:
 return {"error": "stale_blob", "sha": sha}
 lines = text.splitlines()
 start = max(1, start); end = min(len(lines), end)
 if end < start or (end - start) > 400:
 return {"error": "range_invalid"}
 body = "\n".join(lines[start - 1 : end])
 if len(body.encode()) > MAX_BYTES:
 return {"error": "too_large"}
 return {"path": str(p), "start": start, "end": end, "sha": sha, "text": body}

{
 "toolChoice": { "tool": { "name": "read_range" } },
 "comment": "First hop must verify a candidate path from retrieval"
}