Restrict querying of external projects to read-only tools

CHANGELOG.md

@@ -8,6 +8,7 @@ Status of the `main` branch. Changes prior to the next official version change w
   - `GetSymbolsOverviewTool`: ignored paths were not respected in LSP variant (fix in `SolidLanguageServer`)
   - Fix: Duplicate comments in re-saved YAML configuration files #1285
   - Security: Forbid `".."` in memory names to disallow accessing files outside dedicated memory directories
+  - Security: Restrict querying of external projects to read-only tools
 
 * JetBrains:
   - `Move` and `SafeDelete` tools: transform empty string to None (counteracts client errors)

src/serena/project_server.py

@@ -89,6 +89,8 @@ class ProjectServer:
         project = self._get_project(req.project_name)
         with self._agent.active_project_context(project):
             tool = self._agent.get_tool_by_name(req.tool_name)
+            if not tool.is_readonly():
+                raise ValueError(f"Tool '{req.tool_name}' is not read-only and cannot be executed via the query_project route")
             params = json.loads(req.tool_params_json)
             return tool.apply_ex(**params)