test(exec): cover director allowlist bypass through tool_search and promote

Author: TheGreatAxios

src/agent/fleet-verbs-mount.test.ts

@@ -55,6 +55,48 @@ describe("primary fleet verb mount", () => {
     await toolset.dispose();
   });
 
+  test("createAgentToolset mounts tool_search by default", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "corbits-fleet-mount-"));
+    const { createAgentToolset } = await import("./tools.js");
+    const permissionGate = {
+      check: async () => ({ allowed: true }),
+      getSkipPermissions: () => false,
+    } as never;
+
+    const toolset = await createAgentToolset({ cwd, permissionGate });
+    try {
+      const names = toolset.dynamicRunner
+        .currentDefinitions()
+        .map((d) => d.name);
+      expect(names).toContain("tool_search");
+    } finally {
+      await toolset.dispose();
+    }
+  });
+
+  test("createAgentToolset omits tool_search when the allow list excludes it", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "corbits-fleet-mount-"));
+    const { createAgentToolset } = await import("./tools.js");
+    const permissionGate = {
+      check: async () => ({ allowed: true }),
+      getSkipPermissions: () => false,
+    } as never;
+
+    const toolset = await createAgentToolset({
+      cwd,
+      permissionGate,
+      toolSearchAllow: ["read_file"],
+    });
+    try {
+      const names = toolset.dynamicRunner
+        .currentDefinitions()
+        .map((d) => d.name);
+      expect(names).not.toContain("tool_search");
+    } finally {
+      await toolset.dispose();
+    }
+  });
+
   test("createAgentToolset mounts wait_agents when mountWaitAgents is true (exec primary)", async () => {
     const cwd = mkdtempSync(join(tmpdir(), "corbits-fleet-mount-"));
     const { createAgentToolset } = await import("./tools.js");

src/agent/tool-search.test.ts

@@ -227,6 +227,12 @@ describe("createToolIndex", () => {
   test("returns nothing for an empty query", () => {
     expect(index.search("   ")).toEqual([]);
   });
+
+  test("with an allow list, never returns tools outside the allow list", () => {
+    const allowed = createToolIndex(() => defs, [], ["present"]);
+    expect(allowed.search("pages")).toContain("present");
+    expect(allowed.search("linear")).not.toContain("mcp__linear__create_issue");
+  });
 });
 
 function call(

src/exec/runner.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, test } from "bun:test";
+import { DIRECTOR_REGISTRY } from "../agent/directors/registry.js";
+import { createAdvertisedToolset } from "../session/assemble-runtime.js";
+import {
+  createExecToolCallGate,
+  createExecToolPromoter,
+  isExecOverlayToolAllowed,
+  resolveExecDirectorOverlay,
+  resolveExecDirectorOverlayForPackage,
+} from "./runner.js";
+
+const OUTSIDE_ALLOW = "mcp__linear__create_issue";
+
+describe("exec director allowlist", () => {
+  test("explorer overlay narrows advertised tools to the package allow list", () => {
+    const overlay = resolveExecDirectorOverlay("explorer");
+    expect(overlay.advertisedAllow).toBeDefined();
+    expect(overlay.advertisedAllow).toContain("read_file");
+    expect(overlay.advertisedAllow).toContain("run_shell");
+    expect(overlay.advertisedAllow).not.toContain("tool_search");
+    expect(overlay.advertisedAllow).not.toContain(OUTSIDE_ALLOW);
+  });
+
+  test("critic overlay narrows advertised tools to the package allow list", () => {
+    const overlay = resolveExecDirectorOverlay("critic");
+    expect(overlay.advertisedAllow).toBeDefined();
+    expect(overlay.advertisedAllow).not.toContain("tool_search");
+    expect(overlay.advertisedAllow).not.toContain(OUTSIDE_ALLOW);
+  });
+
+  test("skywalker keeps the product default — no allow list", () => {
+    const overlay = resolveExecDirectorOverlay("skywalker");
+    expect(overlay.advertisedAllow).toBeUndefined();
+    expect(overlay.mountFleet).toBe(true);
+  });
+
+  test("deny entries are subtracted from the allow list", () => {
+    const pkg = {
+      ...DIRECTOR_REGISTRY.explorer,
+      tools: { allow: ["read_file", "run_shell"], deny: ["run_shell"] },
+    };
+    expect(resolveExecDirectorOverlayForPackage(pkg).advertisedAllow).toEqual([
+      "read_file",
+    ]);
+  });
+
+  test("a deny-only package config is rejected loudly", () => {
+    const pkg = {
+      ...DIRECTOR_REGISTRY.explorer,
+      tools: { deny: ["run_shell"] },
+    };
+    expect(() => resolveExecDirectorOverlayForPackage(pkg)).toThrow(/deny/);
+  });
+
+  test("promote cannot make an outside-allow tool callable under explorer", () => {
+    const overlay = resolveExecDirectorOverlay("explorer");
+    expect(isExecOverlayToolAllowed(overlay, OUTSIDE_ALLOW)).toBe(false);
+    const { activated, computeAdvertised, isAdvertised } =
+      createAdvertisedToolset({
+        sessionMode: "orchestrator",
+        toolAvailability: { languageServerAvailable: true },
+        getProvider: () => ({ providerName: "test", model: "test-model" }),
+        builtInPrefix: overlay.advertisedAllow,
+      });
+    const promote = createExecToolPromoter({
+      activate: (names) =>
+        activated.activate(
+          names.filter((name) => isExecOverlayToolAllowed(overlay, name)),
+        ),
+      currentDefinitions: () => [],
+      computeAdvertised,
+      updateDirectorTools: () => undefined,
+    });
+    promote([OUTSIDE_ALLOW]);
+    expect(activated.has(OUTSIDE_ALLOW)).toBe(false);
+    expect(isAdvertised(OUTSIDE_ALLOW)).toBe(false);
+    expect(
+      createExecToolCallGate(isAdvertised, { isCodex: false })(OUTSIDE_ALLOW),
+    ).toBe(false);
+  });
+
+  test("skywalker overlay leaves every tool allowed", () => {
+    const overlay = resolveExecDirectorOverlay("skywalker");
+    expect(isExecOverlayToolAllowed(overlay, OUTSIDE_ALLOW)).toBe(true);
+  });
+});