fix(tools): enforce repository boundary for hosted-repair file tools

src-rust/crates/tools/src/apply_patch.rs

@@ -318,6 +318,10 @@ impl Tool for ApplyPatchTool {
             let path = ctx.resolve_path(&fp.path);
             debug!(path = %path.display(), "ApplyPatch processing file");
 
+            if let Err(e) = ctx.check_hosted_repair_path(self.name(), &path) {
+                return ToolResult::error(e.to_string());
+            }
+
             // Read current content (or empty string for new files).
             let original_content = if path.exists() {
                 match tokio::fs::read_to_string(&path).await {

src-rust/crates/tools/src/batch_edit.rs

@@ -109,6 +109,11 @@ impl Tool for BatchEditTool {
             let path = ctx.resolve_path(&edit.file_path);
             debug!(path = %path.display(), index = i, "BatchEdit pre-check");
 
+            if let Err(e) = ctx.check_hosted_repair_path(self.name(), &path) {
+                pre_check_errors.push(format!("Edit {}: {}", i, e));
+                continue;
+            }
+
             let content = match tokio::fs::read_to_string(&path).await {
                 Ok(c) => c,
                 Err(e) => {

src-rust/crates/tools/src/file_edit.rs

@@ -74,6 +74,10 @@ impl Tool for FileEditTool {
         let path = ctx.resolve_path(&params.file_path);
         debug!(path = %path.display(), "Editing file");
 
+        if let Err(e) = ctx.check_hosted_repair_path(self.name(), &path) {
+            return ToolResult::error(e.to_string());
+        }
+
         // Permission check
         if let Err(e) =
             ctx.check_permission(self.name(), &format!("Edit {}", path.display()), false)

src-rust/crates/tools/src/file_read.rs

@@ -64,6 +64,10 @@ impl Tool for FileReadTool {
         let path = ctx.resolve_path(&params.file_path);
         debug!(path = %path.display(), "Reading file");
 
+        if let Err(e) = ctx.check_hosted_repair_path(self.name(), &path) {
+            return ToolResult::error(e.to_string());
+        }
+
         // Permission check
         if let Err(e) = ctx.check_permission_for_path(
             self.name(),

src-rust/crates/tools/src/file_write.rs

@@ -56,6 +56,10 @@ impl Tool for FileWriteTool {
         let path = ctx.resolve_path(&params.file_path);
         debug!(path = %path.display(), "Writing file");
 
+        if let Err(e) = ctx.check_hosted_repair_path(self.name(), &path) {
+            return ToolResult::error(e.to_string());
+        }
+
         // Permission check
         if let Err(e) =
             ctx.check_permission(self.name(), &format!("Write {}", path.display()), false)

src-rust/crates/tools/src/formatter.rs

@@ -5,6 +5,12 @@ use crate::ToolContext;
 /// Try to format a file using any configured formatter.
 /// Returns silently if no formatter is configured or the formatter fails.
 pub async fn try_format_file(path: &str, ctx: &ToolContext) {
+    // Hosted repair promises a file-only surface under BypassPermissions.
+    // Formatters are executable commands and may come from repository config.
+    if ctx.config.hosted_review_enabled() && ctx.config.hosted_review.allow_file_write_tools {
+        return;
+    }
+
     let formatters = &ctx.config.formatter;
     if formatters.is_empty() {
         return;

src-rust/crates/tools/src/glob_tool.rs

@@ -62,6 +62,10 @@ impl Tool for GlobTool {
             .map(|p| ctx.resolve_path(p))
             .unwrap_or_else(|| ctx.working_dir.clone());
 
+        if let Err(e) = ctx.check_hosted_repair_path(self.name(), &base_dir) {
+            return ToolResult::error(e.to_string());
+        }
+
         if let Err(e) = ctx.check_permission_for_path(
             self.name(),
             &format!("Glob {} in {}", params.pattern, base_dir.display()),
@@ -88,6 +92,9 @@ impl Tool for GlobTool {
             Ok(paths) => {
                 let mut out = Vec::new();
                 for path in paths.filter_map(|p| p.ok()) {
+                    if let Err(e) = ctx.check_hosted_repair_path(self.name(), &path) {
+                        return ToolResult::error(e.to_string());
+                    }
                     if !ctx.path_is_within_workspace(&path) {
                         if let Err(e) = ctx.check_permission_for_path(
                             self.name(),

src-rust/crates/tools/src/grep_tool.rs

@@ -144,6 +144,10 @@ impl Tool for GrepTool {
             .map(|p| ctx.resolve_path(p))
             .unwrap_or_else(|| ctx.working_dir.clone());
 
+        if let Err(e) = ctx.check_hosted_repair_path(self.name(), &search_path) {
+            return ToolResult::error(e.to_string());
+        }
+
         if let Err(e) = ctx.check_permission_for_path(
             self.name(),
             &format!("Grep {} in {}", params.pattern, search_path.display()),
@@ -219,6 +223,10 @@ impl Tool for GrepTool {
 
             let path = entry.path();
 
+            if let Err(e) = ctx.check_hosted_repair_path(self.name(), path) {
+                return ToolResult::error(e.to_string());
+            }
+
             if !ctx.path_is_within_workspace(path) {
                 if let Err(e) = ctx.check_permission_for_path(
                     self.name(),