fix(exec): enforce director allowlists through tool_search and promote

Author: TheGreatAxios

src/agent/tool-search.ts

@@ -237,6 +237,9 @@ function tokenize(text: string): string[] {
 export function createToolIndex(
   getDefs: () => readonly ToolDefinition[],
   advertisedNames: readonly string[] = ADVERTISED_TOOL_NAMES,
+  // Closed allow list (exec director overlays): when set, the index only
+  // surfaces allowed tools so search cannot promote outside the allow.
+  allow?: readonly string[] | undefined,
 ): ToolIndex {
   const score = (
     def: ToolDefinition,
@@ -264,6 +267,7 @@ export function createToolIndex(
       if (queryTokens.length === 0) return [];
       return getDefs()
         .filter((def) => !advertisedNames.includes(def.name))
+        .filter((def) => allow === undefined || allow.includes(def.name))
         .map((def) => ({
           name: def.name,
           score: score(def, queryTokens, rawQuery),

src/agent/tools.ts

@@ -103,7 +103,11 @@ import {
 } from "../tools/web-search.js";
 import { createUseSkillTool } from "./use-skill.js";
 import { createSkillSearchTool } from "./skill-search.js";
-import { createToolIndex, createToolSearchTool } from "./tool-search.js";
+import {
+  createToolIndex,
+  createToolSearchTool,
+  toolSearchDefinition,
+} from "./tool-search.js";
 import { createSearchAgentsTool } from "./agent-search.js";
 import { createReadAgentTraceTool } from "../subagent/trace-tool.js";
 import {
@@ -261,6 +265,13 @@ export interface AgentToolsetArgs {
    * and collect worker reports from mailbox mail instead.
    */
   mountWaitAgents?: boolean;
+  /**
+   * Closed allow list (exec director overlays). tool_search is mounted only
+   * when the allow includes it, and the search index only surfaces allowed
+   * tools so search cannot promote outside the allow. Omit for the product
+   * default (tool_search mounted, index over the live registry).
+   */
+  toolSearchAllow?: readonly string[];
 }
 
 // Per-server connection state surfaced to the TUI.
@@ -712,15 +723,26 @@ export async function createAgentToolset(
   const toolIndex = createToolIndex(
     () => runnerHolder.current?.currentDefinitions() ?? [],
     advertisedBuiltIns,
+    args.toolSearchAllow,
   );
-  baseTools.push(
-    createToolSearchTool({
-      search: (query) => toolIndex.search(query),
-      lookup: (name) =>
-        runnerHolder.current?.currentDefinitions().find((d) => d.name === name),
-      promote: (names) => promoter.promote(names),
-    }),
-  );
+  // Closed exec allow lists omit tool_search itself (leaf posture); when the
+  // allow excludes it the tool is never mounted, so there is nothing to
+  // search with and nothing the promoter can activate.
+  if (
+    args.toolSearchAllow === undefined ||
+    args.toolSearchAllow.includes(toolSearchDefinition.name)
+  ) {
+    baseTools.push(
+      createToolSearchTool({
+        search: (query) => toolIndex.search(query),
+        lookup: (name) =>
+          runnerHolder.current
+            ?.currentDefinitions()
+            .find((d) => d.name === name),
+        promote: (names) => promoter.promote(names),
+      }),
+    );
+  }
 
   // Codex apply_patch mounts when isCodex; primary strips it so Corbits DIY
   // stays on write_file/edit_file/delete_file. Leaves keep it via BUILD/DOCS allowlists.

src/exec/runner.ts

@@ -16,7 +16,7 @@ import {
 import { xaiProfileFromProviderName } from "../config/xai-providers.js";
 import { formatDirectorSystemPrompt } from "../agent/directors/identity.js";
 import { DIRECTOR_REGISTRY } from "../agent/directors/registry.js";
-import type { DirectorId } from "../agent/directors/types.js";
+import type { DirectorId, DirectorPackage } from "../agent/directors/types.js";
 import { submitOutputDefinition } from "../agent/director.js";
 import {
   shellDefinition,
@@ -265,19 +265,51 @@ export function resolveExecDirectorOverlay(
   if (director === undefined || director === "skywalker") {
     return { mountFleet: true };
   }
-  const pkg = DIRECTOR_REGISTRY[director];
+  return resolveExecDirectorOverlayForPackage(DIRECTOR_REGISTRY[director]);
+}
+
+/**
+ * Single enforcement point for the exec allowlist. Everything the overlay
+ * permits — tool_search results, promoter activation, the call gate — flows
+ * through here, so a tool outside the allow can never become callable.
+ */
+export function isExecOverlayToolAllowed(
+  overlay: ExecDirectorOverlay,
+  name: string,
+): boolean {
+  return (
+    overlay.advertisedAllow === undefined ||
+    overlay.advertisedAllow.includes(name)
+  );
+}
+
+export function resolveExecDirectorOverlayForPackage(
+  pkg: DirectorPackage,
+): ExecDirectorOverlay {
   const allow = pkg.tools?.allow;
-  const advertisedAllow =
+  const deny = pkg.tools?.deny ?? [];
+  if ((allow === undefined || allow.length === 0) && deny.length > 0) {
+    throw new Error(
+      `Director package "${pkg.id}" sets tools.deny without tools.allow — ` +
+        "exec overlays enforce a closed allow list, so a deny-only package " +
+        "has no list to subtract from. Add tools.allow.",
+    );
+  }
+  const allowed =
     allow !== undefined && allow.length > 0
+      ? allow.filter((name) => !deny.includes(name))
+      : undefined;
+  const advertisedAllow =
+    allowed !== undefined
       ? pkg.spawn.maySpawn
         ? [
-            ...allow,
+            ...allowed,
             // Exec mounts wait_agents beside the fleet verbs (mountWaitAgents),
             // so it stays advertised here even though the package allow omits
             // it for TUI/nested mailbox-mail collection.
-            ...(!allow.includes("wait_agents") ? ["wait_agents"] : []),
+            ...(!allowed.includes("wait_agents") ? ["wait_agents"] : []),
           ]
-        : allow.filter(
+        : allowed.filter(
             (name) =>
               ![
                 "search_agents",
@@ -649,6 +681,11 @@ export async function runExec(config: Config): Promise<ExecResult> {
         : {}),
       sessionMode,
       toolAvailability,
+      // Closed director overlays unmount tool_search (unless allowed) and
+      // filter its index, so search cannot surface outside-allow tools.
+      ...(overlay.advertisedAllow !== undefined
+        ? { toolSearchAllow: overlay.advertisedAllow }
+        : {}),
       // Exec-primary keeps wait_agents mounted (with an advertised allow):
       // headless runs have no mailbox-mail flush, so wait_agents stays the
       // collection path here. TUI primary and nested orchestrators omit it.
@@ -839,10 +876,14 @@ export async function runExec(config: Config): Promise<ExecResult> {
 
     // tool_search starts as a no-op promoter; without this, the call gate
     // refuses MCP/present/plugin names the result just told the model to
-    // invoke.
+    // invoke. Under a closed overlay the promoter only activates allowed
+    // names, so outside-allow tools can never become advertised or callable.
     agentToolset.setToolPromoter(
       createExecToolPromoter({
-        activate: (names) => activatedToolNames.activate(names),
+        activate: (names) =>
+          activatedToolNames.activate(
+            names.filter((name) => isExecOverlayToolAllowed(overlay, name)),
+          ),
         currentDefinitions: () =>
           agentToolset.dynamicRunner.currentDefinitions(),
         computeAdvertised,