Exposes file operations for an explicitly selected workspace. provide registers the service and attachments handles captured file resources. The wrapper supplies the original call scope and directory authority to the file engine. File tools and commands share the session sandbox preset: reads may reach outside the workspace; workspace-write permits writes in the workspace and system temporary directories. Other writes require permission approval. The selected directory remains captured, and approvals cannot override workspace metadata or Host-private protections.
readText also pages uploaded attachments and original tool-result resources visible to the calling Session. A selected Read tool uses its current live Invocation; resource addresses and continuations do not grant access to another Session. Each text attachment page loads the complete admitted upload and validates UTF-8 and the absence of NUL bytes before returning a bounded page. Archived results reuse the original model projection without executing the source tool again. Each archive page currently loads the complete original projection before paging, and cancellation waits for that storage operation to settle.
Search calls return complete admitted results; they do not introduce a cursor or replace source authority. Cancellation waits for the original worker, including ignore-file reads. Paged Read and file-resource transfer retain their existing complete continuation and chunk protocols.