Vakyartha documentation

9031/// declaration view: no session yet, so nothing session-specific is bound.
9032#[derive(Debug, Clone, Default)]
9033struct ToolScope {
9034 session_id: String,
9035 agent_id: Option<String>,
9036 audience_id: Option<String>,
9037}
9038
9039/// The MCP section of the prompt, rendered from the admitted capability
9040/// packet alone — one source, so the prompt can never describe servers the
9041/// turn did not admit.
9042///
9043/// Each server is named with the tool *names* the on-demand pool last
9044/// observed (none before its first use; `configuration.tools`) and, when its
9045/// last attempt failed, that reason. No descriptions or schemas: `mcp` `list`
9046/// with a server returns those right before the call that needs them
9047/// (docs/design/68-context-engine.md §5).
9048fn mcp_config_section(servers: &[&CapabilityDescriptor]) -> String {
9049 if servers.is_empty() {
9050 return String::new();
9051 }
9052 let mut section = String::from(
9053 "\nMCP servers (call through the `mcp` tool: action \"list\" with a `server` returns its tools' schemas; action \"call\" with `server`, `tool`, and `arguments` runs one; never invent a tool name or argument):\n",
9054 );
9055 for capability in servers {
9056 let tools: Vec<&str> = capability
9057 .configuration
9058 .get("tools")
9059 .and_then(|t| t.as_array())
9060 .map(|tools| {
9061 tools
9062 .iter()
9063 .filter_map(|tool| tool.get("name").and_then(|n| n.as_str()))
9064 .collect()
9065 })
9066 .unwrap_or_default();
9067 if tools.is_empty() {
9068 section.push_str(&format!("- {}\n", capability.name));
9069 } else {
9070 section.push_str(&format!("- {}: {}\n", capability.name, tools.join(", ")));
9071 }
9072 // Still callable — the pool retries on the next demand after its
9073 // backoff — so the model is told, not denied.
9074 if let Some(failure) = capability
9075 .configuration
9076 .get("last_failure")
9077 .and_then(|f| f.as_str())
9078 {
9079 section.push_str(&format!(
9080 " last attempt failed: {failure}. If the request needs it, try once more and otherwise tell the user it is unavailable and how to fix it: {}.\n",
9081 capability::report::mcp_remedy(&capability.name)
9082 ));
9083 }
9084 }
9085 section
9086}
9087
9088/// Phase H MEA provider: diff the run-start checkpoint against disk.
9089struct CheckpointDelta {
9090 home: PathBuf,
9091 sid: String,
9092 seq: u32,
9093 cwd: PathBuf,
9094}
9095
9096impl vak_agent::WorkspaceDelta for CheckpointDelta {
9097 fn summary(&self) -> Result<String, String> {
9098 checkpoints::delta_summary(
9099 &self.cwd.clone(),
9100 &self.home.clone(),
9101 self.sid.as_str(),
9102 self.seq,
9103 8192,
9104 )
9105 .map_err(|e| e.to_string())
9106 }
9107}
9108
9109#[cfg(test)]
9110#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9111mod mcp_section_tests {
9112 use super::mcp_config_section;
9113 use vak_session::types::{CapabilityDescriptor, CapabilityInvocation, CapabilityKind};
9114
9115 fn server(name: &str, configuration: serde_json::Value) -> CapabilityDescriptor {
9116 CapabilityDescriptor {
9117 name: name.into(),
9118 kind: CapabilityKind::McpServer,
9119 invocation: CapabilityInvocation::ModelTool,
9120 description: String::new(),
9121 source: None,
9122 digest: None,
9123 provenance: None,
9124 configuration,
9125 }
9126 }
9127
9128 #[test]
9129 fn configured_servers_remain_visible_without_a_catalog() {
9130 let caps = [server("tavily", serde_json::Value::Null)];
9131 let refs: Vec<_> = caps.iter().collect();
9132 let section = mcp_config_section(&refs);
9133 assert!(section.contains("tavily"));
9134 assert!(section.contains("`mcp`"));
9135 assert!(section.contains("action \"list\""));
9136 assert!(
9137 !section.contains("Discovered MCP catalog"),
9138 "an empty catalog must not be announced as one"
9139 );
9140 }
9141
9142 /// The catalog is read from the admitted packet, not a second cache.
9143 ///
9144 /// This is the defect that reached a user: the packet admitted `tavily`
9145 /// and the prompt named it, but the catalog lived in `Core::mcp_cache`
9146 /// and had not landed when the session froze. The model saw a server
9147 /// name with no tools behind it and answered "I do not have a tool that
9148 /// can provide real-time weather information" — with a connected,
9149 /// admitted search server attached. One source means the two can no
9150 /// longer disagree.
9151 #[test]
9152 fn the_catalog_comes_from_the_packet_with_exact_names() {
9153 let caps = [server(
9154 "tavily",
9155 serde_json::json!({
9156 "tools": [{
9157 "name": "tavily_search",
9158 "description": "Search the web",
9159 "inputSchema": {
9160 "type": "object",
9161 "properties": {"query": {"type": "string"}},
9162 "required": ["query"]
9163 }
9164 }]
9165 }),
9166 )];
9167 let refs: Vec<_> = caps.iter().collect();
9168 let section = mcp_config_section(&refs);
9169 assert!(section.contains("\n- tavily: tavily_search\n"));
9170 assert!(
9171 !section.contains("Search the web"),
9172 "descriptions come with the schema from `mcp list`, not in every prompt"
9173 );
9174 }
9175
9176 /// Schemas stay out of the prompt (docs/design/68 §5): a model reaches
9177 /// one input schema at a time via `mcp list`, never a full inline dump.
9178 #[test]
9179 fn the_catalog_never_inlines_input_schemas() {
9180 let caps = [server(
9181 "tavily",
9182 serde_json::json!({
9183 "tools": [{
9184 "name": "tavily_search",
9185 "description": "Search the web",
9186 "inputSchema": {
9187 "type": "object",
9188 "properties": {"query": {"type": "string"}},
9189 "required": ["query"]
9190 }
9191 }]
9192 }),
9193 )];
9194 let refs: Vec<_> = caps.iter().collect();
9195 let section = mcp_config_section(&refs);
9196 assert!(!section.contains("inputSchema"));
9197 assert!(!section.contains('{'));
9198 }
9199}
9200
9201#[cfg(test)]
9202mod plugin_runtime_tests {
9203 #![allow(clippy::unwrap_used)]
9204
9205 use super::*;
9206
9207 #[test]
9208 fn enabled_plugin_mcp_is_namespaced_and_disabled_plugin_is_invisible() {
9209 let dir = tempfile::tempdir().unwrap();
9210 let package = dir.path().join("plugin");
9211 std::fs::create_dir_all(&package).unwrap();
9212 std::fs::write(
9213 package.join("vak-plugin.json"),
9214 r#"{"schema":1,"name":"tools-pack","version":"1.0.0","description":"Tools","license":"MIT","components":{"mcp":["mcp.json"]}}"#,
9215 )
9216 .unwrap();
9217 std::fs::write(
9218 package.join("mcp.json"),
9219 r#"{"mcpServers":{"lookup":{"command":"lookup-bin","args":["--safe"]}}}"#,
9220 )
9221 .unwrap();
9222 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9223 core.set_sessions_home(dir.path().join("home"));
9224 let store = vak_plugin::PluginStore::new(dir.path().join(".vak"));
9225 store
9226 .install_local(package.as_path(), vak_plugin::InstallOptions::default())
9227 .unwrap();
9228 assert!(
9229 !core
9230 .effective_mcp()
9231 .servers
9232 .contains_key("plugin.tools-pack.lookup")
9233 );
9234 store.enable("tools-pack").unwrap();
9235 let servers = core.effective_mcp().servers;
9236 let server = servers.get("plugin.tools-pack.lookup").unwrap();
9237 assert_eq!(server.command, "lookup-bin");
9238 assert_eq!(server.args, ["--safe"]);
9239 assert!(!server.network);
9240 }
9241
9242 /// The whole point of caching `McpManager` on `Core` (see
9243 /// `mcp_manager()`): a hot plugin enable/disable — the same kind of
9244 /// on-the-fly change `set_mcp_servers` makes at runtime — must be
9245 /// picked up on the very next call, not require a restart, while an
9246 /// unrelated repeat call in between reuses the same manager instance
9247 /// rather than respawning server connections for no reason.
9248 #[tokio::test]
9249 async fn mcp_manager_reuses_instance_and_picks_up_hot_plugin_toggle() {
9250 let dir = tempfile::tempdir().unwrap();
9251 let package = dir.path().join("plugin");
9252 std::fs::create_dir_all(&package).unwrap();
9253 std::fs::write(
9254 package.join("vak-plugin.json"),
9255 r#"{"schema":1,"name":"tools-pack","version":"1.0.0","description":"Tools","license":"MIT","components":{"mcp":["mcp.json"]}}"#,
9256 )
9257 .unwrap();
9258 std::fs::write(
9259 package.join("mcp.json"),
9260 r#"{"mcpServers":{"lookup":{"command":"lookup-bin","args":["--safe"]}}}"#,
9261 )
9262 .unwrap();
9263 isolate_global_config();
9264 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9265 core.set_sessions_home(dir.path().join("home"));
9266 let store = vak_plugin::PluginStore::new(dir.path().join(".vak"));
9267 store
9268 .install_local(package.as_path(), vak_plugin::InstallOptions::default())
9269 .unwrap();
9270
9271 // Nothing configured yet: no manager.
9272 assert!(core.mcp_manager().is_none());
9273
9274 // Enable on the fly: next call sees the new server immediately.
9275 store.enable("tools-pack").unwrap();
9276 let first = core.mcp_manager().unwrap();
9277 assert_eq!(first.server_names(), vec!["plugin.tools-pack.lookup"]);
9278
9279 // The contributed server's egress follows the SAME effective-policy
9280 // seam the runner tools read: deny-by-default, and a hot persisted
9281 // grant reaches it next time `effective_mcp` resolves - not after a
9282 // restart. (Regression for a base-config read that left the server
9283 // stale for the whole process once an override landed.)
9284 assert!(
9285 !core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9286 "plugin-contributed MCP server must deny egress by default"
9287 );
9288 core.apply_persisted_plugins(vak_config::PluginResolved {
9289 network_allow: Some(vec!["tools-pack".into()]),
9290 ..core.effective_plugins()
9291 });
9292 assert!(
9293 core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9294 "persisted grant must reach the contributed MCP server live"
9295 );
9296 core.apply_persisted_plugins(vak_config::PluginResolved {
9297 network_allow: None,
9298 ..core.effective_plugins()
9299 });
9300 assert!(
9301 !core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9302 "persisted revoke must take the contributed server's egress away"
9303 );
9304
9305 // Same server set: same manager instance (no respawn/reconnect).
9306 let second = core.mcp_manager().unwrap();
9307 assert!(
9308 Arc::ptr_eq(&first, &second),
9309 "unchanged server set must reuse the cached manager"
9310 );
9311
9312 // Disable on the fly: next call sees it's gone immediately, no
9313 // restart required.
9314 store.disable("tools-pack").unwrap();
9315 assert!(core.mcp_manager().is_none());
9316 }
9317}
9318
9319#[cfg(test)]
9320mod webfetch_classification_tests {
9321 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9322 use super::*;
9323
9324 use vak_config::PermissionMode;
9325 use vak_permission::{Decision, Mode, PermissionEngine};
9326
9327 fn decide(
9328 cfg: &vak_config::Config,
9329 extra: &[String],
9330 mode: PermissionMode,
9331 tool: &str,
9332 ) -> Decision {
9333 let dir = tempfile::tempdir().unwrap();
9334 let engine: PermissionEngine = build_engine_with(cfg, extra).expect("engine builds");
9335 engine.evaluate(tool, &serde_json::json!({}), to_mode(mode), dir.path())
9336 }
9337
9338 fn to_mode(mode: PermissionMode) -> Mode {
9339 match mode {
9340 PermissionMode::ReadOnly => Mode::ReadOnly,
9341 PermissionMode::WorkspaceWrite => Mode::WorkspaceWrite,
9342 PermissionMode::FullAccess => Mode::FullAccess,
9343 }
9344 }
9345
9346 #[test]
9347 fn no_rule_outside_fullaccess_asks_fullaccess_allows() {
9348 let cfg = vak_config::Config::default();
9349 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9350 for tool in NETWORK_TOOLS {
9351 let d = decide(&cfg, &[], mode, tool);
9352 assert!(
9353 matches!(d, Decision::Ask { .. }),
9354 "{tool} in {mode:?} must Ask, got {d:?}"
9355 );
9356 }
9357 }
9358 for tool in NETWORK_TOOLS {
9359 let d = decide(&cfg, &[], PermissionMode::FullAccess, tool);
9360 assert!(
9361 matches!(d, Decision::Allow),
9362 "{tool} under FullAccess must Allow, got {d:?}"
9363 );
9364 }
9365 }
9366
9367 #[test]
9368 fn explicit_allow_rule_wins_in_every_restricted_mode() {
9369 for spec in ["webfetch", "+webfetch"] {
9370 let mut cfg = vak_config::Config::default();
9371 cfg.allow.push(spec.into());
9372 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9373 let d = decide(&cfg, &[], mode, "webfetch");
9374 assert!(matches!(d, Decision::Allow), "{spec:?} in {mode:?}: {d:?}");
9375 }
9376 }
9377 // Learned rules ride in via `extra`.
9378 let cfg = vak_config::Config::default();
9379 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9380 let d = decide(&cfg, &["+webfetch".to_string()], mode, "webfetch");
9381 assert!(matches!(d, Decision::Allow), "learned in {mode:?}: {d:?}");
9382 }
9383 }
9384
9385 #[test]
9386 fn explicit_deny_rule_wins_everywhere() {
9387 let mut cfg = vak_config::Config::default();
9388 cfg.deny.push("-webfetch".into());
9389 for mode in [
9390 PermissionMode::ReadOnly,
9391 PermissionMode::WorkspaceWrite,
9392 PermissionMode::FullAccess,
9393 ] {
9394 let d = decide(&cfg, &[], mode, "webfetch");
9395 assert!(matches!(d, Decision::Deny { .. }), "{mode:?}: {d:?}");
9396 }
9397 }
9398
9399 #[test]
9400 fn explicit_ask_rule_is_honored_even_under_fullaccess() {
9401 let mut cfg = vak_config::Config::default();
9402 cfg.ask.push("?webfetch".into());
9403 for mode in [
9404 PermissionMode::ReadOnly,
9405 PermissionMode::WorkspaceWrite,
9406 PermissionMode::FullAccess,
9407 ] {
9408 let d = decide(&cfg, &[], mode, "webfetch");
9409 assert!(matches!(d, Decision::Ask { .. }), "{mode:?}: {d:?}");
9410 }
9411 }
9412
9413 #[test]
9414 fn browse_shares_the_full_webfetch_mode_matrix() {
9415 // Same family, same posture: restricted modes Ask by default,
9416 // FullAccess allows, blanket allow lifts the Ask, blanket deny
9417 // denies even under FullAccess, and an explicit ?ask is honored
9418 // everywhere.
9419 let base = vak_config::Config::default();
9420 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9421 let d = decide(&base, &[], mode, "browse");
9422 assert!(matches!(d, Decision::Ask { .. }), "{mode:?}: {d:?}");
9423 }
9424 let d = decide(&base, &[], PermissionMode::FullAccess, "browse");
9425 assert!(matches!(d, Decision::Allow), "FullAccess: {d:?}");
9426
9427 let mut allowed = vak_config::Config::default();
9428 allowed.allow.push("browse".into());
9429 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9430 let d = decide(&allowed, &[], mode, "browse");
9431 assert!(
9432 matches!(d, Decision::Allow),
9433 "allow rule in {mode:?}: {d:?}"
9434 );
9435 }
9436
9437 let mut denied = vak_config::Config::default();
9438 denied.deny.push("-browse".into());
9439 for mode in [
9440 PermissionMode::ReadOnly,
9441 PermissionMode::WorkspaceWrite,
9442 PermissionMode::FullAccess,
9443 ] {
9444 let d = decide(&denied, &[], mode, "browse");
9445 assert!(
9446 matches!(d, Decision::Deny { .. }),
9447 "-browse in {mode:?}: {d:?}"
9448 );
9449 }
9450
9451 let mut asked = vak_config::Config::default();
9452 asked.ask.push("?browse".into());
9453 let d = decide(&asked, &[], PermissionMode::FullAccess, "browse");
9454 assert!(
9455 matches!(d, Decision::Ask { .. }),
9456 "?browse under FullAccess: {d:?}"
9457 );
9458 }
9459
9460 #[test]
9461 fn deny_outranks_allow_regardless_of_layer_order() {
9462 let mut cfg = vak_config::Config::default();
9463 cfg.allow.push("webfetch".into());
9464 cfg.deny.push("-webfetch".into());
9465 let dir = tempfile::tempdir().unwrap();
9466 let e = build_engine_with(&cfg, &[]).unwrap();
9467 let d = e.evaluate(
9468 "webfetch",
9469 &serde_json::json!({}),
9470 Mode::WorkspaceWrite,
9471 dir.path(),
9472 );
9473 assert!(matches!(d, Decision::Deny { .. }));
9474 }
9475
9476 #[test]
9477 fn patterned_allow_cannot_lift_the_ask_default() {
9478 // Patterned rules cannot see webfetch args today, so a patterned
9479 // allow must NOT suppress the injected Ask: matching URLs still ask
9480 // (severity Ask > Allow) and non-matching ones fall through to the
9481 // same Ask. Failing toward asking is the safe direction.
9482 let mut cfg = vak_config::Config::default();
9483 cfg.allow.push("webfetch(example.com/*)".into());
9484 let dir = tempfile::tempdir().unwrap();
9485 let e = build_engine_with(&cfg, &[]).unwrap();
9486 for url in ["other.org/x", "example.com/x"] {
9487 let d = e.evaluate(
9488 "webfetch",
9489 &serde_json::json!({"url": url}),
9490 Mode::WorkspaceWrite,
9491 dir.path(),
9492 );
9493 assert!(matches!(d, Decision::Ask { .. }), "{url}: {d:?}");
9494 }
9495 }
9496
9497 #[test]
9498 fn other_tools_keep_their_existing_defaults() {
9499 // The seam must not widen: bash still asks under workspace-write,
9500 // session_search stays a read tool, remember stays sanctioned.
9501 let dir = tempfile::tempdir().unwrap();
9502 let e = build_engine_with(&vak_config::Config::default(), &[]).unwrap();
9503 let bash = e.evaluate(
9504 "bash",
9505 &serde_json::json!({"command": "ls"}),
9506 Mode::WorkspaceWrite,
9507 dir.path(),
9508 );
9509 assert!(matches!(bash, Decision::Ask { .. }));
9510 for tool in ["session_search", "remember", "propose_skill"] {
9511 let d = e.evaluate(
9512 tool,
9513 &serde_json::json!({}),
9514 Mode::WorkspaceWrite,
9515 dir.path(),
9516 );
9517 assert!(matches!(d, Decision::Allow), "{tool}: {d:?}");
9518 }
9519 }
9520
9521 /// The regression the synthetic `?webfetch` injection caused: a network
9522 /// tool's restricted-mode gate must be a MODE default, so that
9523 /// `approval_mode = "auto-approve"` reaches it exactly as it reaches
9524 /// bash and every other mode-gated tool. When the gate was an injected
9525 /// rule, `auto_approve` refused it — the desktop kept prompting for
9526 /// webfetch with auto-approve on, and only for webfetch.
9527 #[test]
9528 fn network_tools_gate_as_a_mode_default_so_auto_approve_reaches_them() {
9529 let dir = tempfile::tempdir().unwrap();
9530 let cfg = vak_config::Config::default();
9531 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9532 let engine = build_engine_with(&cfg, &[]).unwrap();
9533 for tool in NETWORK_TOOLS {
9534 let decision =
9535 engine.evaluate(tool, &serde_json::json!({}), to_mode(mode), dir.path());
9536 let Decision::Ask { source, .. } = decision else {
9537 panic!("{tool} in {mode:?} must Ask, got {decision:?}");
9538 };
9539 assert_eq!(
9540 source,
9541 vak_permission::AskSource::ModeDefault,
9542 "{tool} in {mode:?} must ask as a mode default, not as a rule"
9543 );
9544 assert!(
9545 vak_agent::auto_approve(
9546 vak_agent::ApprovalMode::AutoApprove,
9547 source,
9548 tool,
9549 &serde_json::json!({}),
9550 to_mode(mode),
9551 false,
9552 dir.path(),
9553 ),
9554 "{tool} in {mode:?} must be reachable under auto-approve"
9555 );
9556 }
9557 }
9558 }
9559
9560 /// An operator's own `?webfetch` is still a rule, and still outranks
9561 /// auto-approve. Removing the injection must not remove that.
9562 #[test]
9563 fn a_deliberate_ask_rule_still_outranks_auto_approve() {
9564 let dir = tempfile::tempdir().unwrap();
9565 let mut cfg = vak_config::Config::default();
9566 cfg.ask.push("?webfetch".into());
9567 let engine = build_engine_with(&cfg, &[]).unwrap();
9568 let decision = engine.evaluate(
9569 "webfetch",
9570 &serde_json::json!({}),
9571 Mode::WorkspaceWrite,
9572 dir.path(),
9573 );
9574 let Decision::Ask { source, .. } = decision else {
9575 panic!("expected Ask, got {decision:?}");
9576 };
9577 assert_eq!(source, vak_permission::AskSource::Rule);
9578 assert!(!vak_agent::auto_approve(
9579 vak_agent::ApprovalMode::AutoApprove,
9580 source,
9581 "webfetch",
9582 &serde_json::json!({}),
9583 Mode::WorkspaceWrite,
9584 false,
9585 dir.path(),
9586 ));
9587 }
9588}
9589
9590/// Configured capability reconciled against reachable capability.
9591///
9592/// The scenario every test here is built from is a real one: a Telegram
9593/// turn, `permission_mode = "workspace-write"`, one MCP server (`tavily`)
9594/// configured with a valid key, and `gateway.approvals` left at its `deny`
9595/// default. Discovery worked perfectly — the model listed the catalogue and
9596/// called `tavily_search` with correct arguments on its first attempt — and
9597/// every call was refused by an approver that was never going to say yes.
9598/// It burned four tool calls, then told the user it had no way to search
9599/// the web. Nothing was broken. Nothing was logged. The prompt had promised
9600/// a capability the composed policy would never permit.
9601#[cfg(test)]
9602mod capability_reach_tests {
9603 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9604
9605 use super::*;
9606 use crate::reach::Reach;
9607 use vak_permission::{Decision, Mode};
9608
9609 /// A workspace with one MCP server and an explicit permission mode.
9610 ///
9611 /// The data home is pinned first. `global_path()` resolves to
9612 /// `default_workspace()/.vak/config.toml` — a developer's real
9613 /// `~/vak-home` config — and it merges UNDER this tempdir's project
9614 /// layer. Without the pin, an operator who sets `full-access` on their
9615 /// own install turns every `Gated`/`Blocked` expectation here into
9616 /// `Open`, and the suite fails on their machine only. That is exactly
9617 /// what happened.
9618 fn workspace(extra: &str) -> tempfile::TempDir {
9619 vak_config::paths::isolate_home_for_tests();
9620 let dir = tempfile::tempdir().unwrap();
9621 let vak = dir.path().join(".vak");
9622 std::fs::create_dir_all(&vak).unwrap();
9623 std::fs::write(
9624 vak.join("config.toml"),
9625 format!(
9626 "permission_mode = \"workspace-write\"\n\
9627 {extra}\n\
9628 [mcp.servers.tavily]\n\
9629 command = \"npx\"\n\
9630 args = [\"-y\", \"tavily-mcp@latest\"]\n\
9631 network = true\n"
9632 ),
9633 )
9634 .unwrap();
9635 dir
9636 }
9637
9638 fn core_for(dir: &tempfile::TempDir, answerable: bool) -> Core {
9639 let core = Core::new_with_trust(dir.path().to_path_buf(), true)
9640 .unwrap()
9641 .with_approver_answerable(answerable);
9642 core.set_sessions_home(dir.path().join("home"));
9643 core
9644 }
9645
9646 fn standing_for<'a>(standings: &'a [reach::Standing], label: &str) -> &'a reach::Standing {
9647 standings
9648 .iter()
9649 .find(|standing| standing.label == label)
9650 .unwrap_or_else(|| panic!("no standing for {label} in {standings:?}"))
9651 }
9652
9653 /// The bug, stated as a test: an unattended surface must not be told it
9654 /// has a capability whose every use it will refuse.
9655 #[test]
9656 fn an_unattended_surface_does_not_advertise_a_capability_it_will_refuse() {
9657 let dir = workspace("");
9658 let core = core_for(&dir, false);
9659
9660 let standings = core.capability_standings();
9661 assert_eq!(
9662 standing_for(&standings, "mcp server `tavily`").reach,
9663 Reach::Blocked
9664 );
9665
9666 let prompt = core.system_prompt();
9667 // It is no longer offered as usable...
9668 assert!(
9669 !prompt.contains("\n- tavily\n"),
9670 "unreachable server still advertised as usable:\n{prompt}"
9671 );
9672 // ...but it is not silently erased either: the model is told it
9673 // exists, that it cannot be used, and what would fix it, so it can
9674 // answer the user instead of hunting for a substitute tool.
9675 assert!(prompt.contains("Configured but NOT usable on this turn"));
9676 assert!(prompt.contains("mcp server `tavily`"));
9677 assert!(prompt.contains("no approver to answer it"));
9678 assert!(prompt.contains("approvals = \"forward\""));
9679 }
9680
9681 /// The same workspace on an attended surface is unchanged: a gate
9682 /// somebody can answer is a working capability, and still advertised.
9683 #[test]
9684 fn an_attended_surface_still_advertises_a_gated_capability() {
9685 let dir = workspace("");
9686 let core = core_for(&dir, true);
9687
9688 assert_eq!(
9689 standing_for(&core.capability_standings(), "mcp server `tavily`").reach,
9690 Reach::Gated
9691 );
9692 let prompt = core.system_prompt();
9693 assert!(prompt.contains("\n- tavily\n"));
9694 assert!(!prompt.contains("Configured but NOT usable"));
9695 }
9696
9697 /// And the operator's actual fix works: allowing the tool outright
9698 /// removes the gate, so even the unattended surface can use it.
9699 ///
9700 /// Note what stays blocked. `webfetch` and `browse` still gate on an
9701 /// approval this surface cannot answer, so they are still reported —
9702 /// which is correct, and is the second half of the same transcript:
9703 /// after the MCP denials the model fell back to `webfetch` and was
9704 /// refused there too. Reachability is per capability, not per turn.
9705 #[test]
9706 fn allowing_the_tool_makes_it_reachable_unattended() {
9707 let dir = workspace("allow = [\"mcp\"]");
9708 let core = core_for(&dir, false);
9709
9710 let standings = core.capability_standings();
9711 assert_eq!(
9712 standing_for(&standings, "mcp server `tavily`").reach,
9713 Reach::Open
9714 );
9715 let prompt = core.system_prompt();
9716 assert!(prompt.contains("\n- tavily\n"));
9717 assert!(
9718 !reach::prompt_section(&standings).contains("tavily"),
9719 "a reachable server must not be listed as unusable"
9720 );
9721 // The network tools are a separate capability and still gated.
9722 assert_eq!(standing_for(&standings, "`webfetch`").reach, Reach::Blocked);
9723 }
9724
9725 /// A deny is unreachable on every surface — no approver can answer a
9726 /// `Deny`, so an attended surface must report it exactly as bluntly.
9727 #[test]
9728 fn a_denied_capability_is_unreachable_even_when_attended() {
9729 let dir = workspace("deny = [\"-mcp\"]");
9730 let core = core_for(&dir, true);
9731
9732 let standings = core.capability_standings();
9733 let standing = standing_for(&standings, "mcp server `tavily`");
9734 assert_eq!(standing.reach, Reach::Blocked);
9735 assert!(standing.reason.contains("denied by rule"));
9736 assert!(!core.system_prompt().contains("\n- tavily\n"));
9737 }
9738
9739 /// Uncertainty must degrade to `Gated`, never to `Blocked`. The probe
9740 /// runs before a tool name exists, so a patterned rule cannot be
9741 /// evaluated — and hiding a capability that would in fact have worked
9742 /// is worse than advertising one that gates.
9743 #[test]
9744 fn a_patterned_rule_keeps_the_capability_advertised() {
9745 let dir = workspace("allow = [\"mcp(tavily/tavily_search)\"]");
9746 let core = core_for(&dir, false);
9747
9748 assert_eq!(
9749 standing_for(&core.capability_standings(), "mcp server `tavily`").reach,
9750 Reach::Gated
9751 );
9752 assert!(core.system_prompt().contains("\n- tavily\n"));
9753 }
9754
9755 /// AGENTS.md invariant 20: a channel overlay is restrictive. Both call
9756 /// sites used to compile `tools_allow` into blanket `+` allow rules, so
9757 /// narrowing a chat to one tool handed that chat the tool with its
9758 /// approval gate removed — an escalation performed by adding a
9759 /// restriction.
9760 #[test]
9761 fn a_narrowing_channel_overlay_never_removes_an_approval_gate() {
9762 let dir = workspace("");
9763 let core = core_for(&dir, true);
9764 let cwd = core.cwd().clone();
9765
9766 let baseline = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9767 assert!(matches!(
9768 baseline.evaluate(
9769 "bash",
9770 &serde_json::json!({"command": "ls"}),
9771 Mode::WorkspaceWrite,
9772 &cwd,
9773 ),
9774 Decision::Ask { .. }
9775 ));
9776
9777 core.apply_channel_policy(vak_config::ChannelPolicy {
9778 tools_allow: Some(vec!["bash".into()]),
9779 mcp_allow: Some(vec!["tavily/tavily_search".into()]),
9780 ..Default::default()
9781 });
9782 let narrowed = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9783
9784 for (tool, args) in [
9785 ("bash", serde_json::json!({"command": "ls"})),
9786 (
9787 "mcp",
9788 serde_json::json!({"action": "call", "server": "tavily", "tool": "tavily_search"}),
9789 ),
9790 ] {
9791 let decision = narrowed.evaluate(tool, &args, Mode::WorkspaceWrite, &cwd);
9792 assert!(
9793 !matches!(decision, Decision::Allow),
9794 "narrowing overlay granted {tool} an unattended Allow: {decision:?}"
9795 );
9796 }
9797 }
9798
9799 /// `Some([])` still means "block this category outright".
9800 #[test]
9801 fn an_empty_channel_allowlist_still_denies_the_category() {
9802 let dir = workspace("");
9803 let core = core_for(&dir, true);
9804 let cwd = core.cwd().clone();
9805 core.apply_channel_policy(vak_config::ChannelPolicy {
9806 tools_allow: Some(Vec::new()),
9807 mcp_allow: Some(Vec::new()),
9808 ..Default::default()
9809 });
9810 let engine = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9811 for tool in ["bash", "read", "webfetch", "browse", "mcp"] {
9812 let decision =
9813 engine.evaluate(tool, &serde_json::json!({}), Mode::WorkspaceWrite, &cwd);
9814 assert!(
9815 matches!(decision, Decision::Deny { .. }),
9816 "{tool} survived an empty channel allowlist: {decision:?}"
9817 );
9818 }
9819 }
9820
9821 /// One blocked MCP server must not take the broker down with it, and a
9822 /// tool with no reachable use left must not stay in the registry.
9823 #[test]
9824 fn only_fully_blocked_tools_are_dropped() {
9825 let standing = |kind: CapabilityKind, name: &str, reach: Reach| reach::Standing {
9826 id: capability::CapabilityId::new(kind.clone(), name),
9827 tool: if kind == CapabilityKind::McpServer {
9828 "mcp".into()
9829 } else {
9830 name.into()
9831 },
9832 label: name.into(),
9833 reach,
9834 reason: String::new(),
9835 remedy: String::new(),
9836 };
9837 let server = |name: &str, reach| standing(CapabilityKind::McpServer, name, reach);
9838
9839 let mixed = vec![
9840 server("a", Reach::Blocked),
9841 server("b", Reach::Open),
9842 standing(CapabilityKind::Tool, "webfetch", Reach::Blocked),
9843 ];
9844 assert_eq!(reach::fully_blocked_tools(&mixed), vec!["webfetch"]);
9845 assert_eq!(reach::blocked_mcp_servers(&mixed), vec!["a"]);
9846
9847 let all = vec![server("a", Reach::Blocked), server("b", Reach::Blocked)];
9848 assert_eq!(reach::fully_blocked_tools(&all), vec!["mcp"]);
9849 }
9850
9851 #[test]
9852 fn denied_skill_is_blocked_and_dropped_from_descriptors() {
9853 let dir = workspace("deny = [\"-skill(blocked-skill)\"]");
9854 let skill_dir = dir.path().join(".vak/skills/blocked-skill");
9855 std::fs::create_dir_all(&skill_dir).unwrap();
9856 std::fs::write(
9857 skill_dir.join("SKILL.md"),
9858 "---\nname: blocked-skill\ndescription: test blocked skill\n---\nbody",
9859 )
9860 .unwrap();
9861
9862 let core = core_for(&dir, true);
9863 let standings = core.capability_standings();
9864 let standing = standing_for(&standings, "skill `blocked-skill`");
9865 assert_eq!(standing.reach, Reach::Blocked);
9866
9867 let descriptors = core.capability_descriptors();
9868 assert!(
9869 !descriptors.iter().any(|d| d.name == "blocked-skill"),
9870 "blocked skill must not be in admitted capability descriptors"
9871 );
9872
9873 let prompt = core.system_prompt();
9874 assert!(
9875 prompt.contains("skill `blocked-skill`"),
9876 "prompt should report blocked skill in standing section"
9877 );
9878 }
9879
9880 #[test]
9881 fn capability_diagnostics_reports_parse_failure_and_prompt_includes_it() {
9882 let dir = workspace("");
9883 let bad_skill_dir = dir.path().join(".vak/skills/Bad_Skill");
9884 std::fs::create_dir_all(&bad_skill_dir).unwrap();
9885 std::fs::write(
9886 bad_skill_dir.join("SKILL.md"),
9887 "---\nname: Bad_Skill\ndescription: bad format\n---\nbody",
9888 )
9889 .unwrap();
9890
9891 let core = core_for(&dir, true);
9892 let diags = core.capability_diagnostics();
9893 let bad_diag = diags.iter().find(|d| d.name == "Bad_Skill");
9894 assert!(bad_diag.is_some(), "diagnostic must report Bad_Skill");
9895 assert!(bad_diag.unwrap().reason.contains("lowercase kebab-case"));
9896
9897 let prompt = core.system_prompt();
9898 assert!(prompt.contains("skill `Bad_Skill`"));
9899 assert!(prompt.contains("Fix: fix the SKILL.md frontmatter"));
9900 }
9901
9902 #[test]
9903 fn tools_and_commitment_overrides_are_dynamic() {
9904 let dir = workspace("");
9905 let core = core_for(&dir, true);
9906
9907 // web_fetch and browse default to true
9908 assert!(core.effective_web_fetch());
9909 assert!(core.effective_browse());
9910 assert!(core.tool_names().contains(&"webfetch".to_string()));
9911 assert!(core.tool_names().contains(&"browse".to_string()));
9912
9913 // Apply dynamic tool toggle: disable both
9914 core.apply_persisted_tools(false, false);
9915 assert!(!core.effective_web_fetch());
9916 assert!(!core.effective_browse());
9917 assert!(!core.tool_names().contains(&"webfetch".to_string()));
9918 assert!(!core.tool_names().contains(&"browse".to_string()));
9919
9920 // Toggle back
9921 core.apply_persisted_tools(true, true);
9922 assert!(core.effective_web_fetch());
9923 assert!(core.effective_browse());
9924 assert!(core.tool_names().contains(&"webfetch".to_string()));
9925 assert!(core.tool_names().contains(&"browse".to_string()));
9926
9927 // Toggle commitment
9928 core.apply_persisted_commitment(true);
9929 assert!(core.effective_commitment());
9930 assert!(core.tool_names().contains(&"commitments".to_string()));
9931
9932 core.apply_persisted_commitment(false);
9933 assert!(!core.effective_commitment());
9934 assert!(!core.tool_names().contains(&"commitments".to_string()));
9935 }
9936
9937 #[tokio::test]
9938 async fn permission_mode_change_cancels_existing_permission_lease() {
9939 let dir = tempfile::tempdir().unwrap();
9940 let core = Core::new(dir.path().to_path_buf()).unwrap();
9941 let lease = core.permission_lease();
9942 core.set_permission_mode(vak_config::PermissionMode::ReadOnly);
9943 assert!(lease.is_cancelled());
9944 assert!(!core.permission_lease().is_cancelled());
9945 }
9946}
9947
9948/// Every `Core` accessor must terminate while session-scoped overrides are
9949/// set. `cache_home` once locked `sessions_home_override` and then called
9950/// `sessions_home()`, which locks the same non-reentrant mutex — the
9951/// thread wedged forever. It surfaced only in tests, because production
9952/// leaves the override unset and never entered the branch, and it made
9953/// `cargo test --workspace` hang rather than fail.
9954///
9955/// These run each accessor on a worker thread with a deadline, so a
9956/// reintroduced deadlock fails the suite instead of hanging it. A test
9957/// that hangs reports nothing and blocks every gate behind it.
9958#[cfg(test)]
9959#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9960mod override_deadlock {
9961 use super::*;
9962
9963 /// Run `f` on its own thread, failing if it has not returned in time.
9964 fn within<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Send + 'static) -> T {
9965 let (tx, rx) = std::sync::mpsc::channel();
9966 let handle = std::thread::spawn(move || {
9967 let out = f();
9968 // Send may fail if the receiver already gave up; the timeout
9969 // below is what reports that, so ignore the error here.
9970 let _ = tx.send(());
9971 out
9972 });
9973 match rx.recv_timeout(std::time::Duration::from_secs(10)) {
9974 Ok(()) => handle.join().expect("accessor thread panicked"),
9975 Err(_) => panic!(
9976 "{label} did not return within 10s — an accessor is deadlocked \
9977 (a guard held across a call that re-locks the same mutex)"
9978 ),
9979 }
9980 }
9981
9982 /// One accessor to exercise, boxed so a heterogeneous set can share
9983 /// a list.
9984 type AccessorCheck = Box<dyn FnOnce(Arc<Core>) + Send>;
9985
9986 fn core_with_override() -> (tempfile::TempDir, Core) {
9987 let dir = tempfile::tempdir().unwrap();
9988 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9989 core.set_sessions_home(dir.path().join("home"));
9990 (dir, core)
9991 }
9992
9993 #[test]
9994 fn cache_home_returns_while_the_sessions_home_override_is_set() {
9995 let (dir, core) = core_with_override();
9996 let expected = dir.path().join("home").join("cache");
9997 let got = within("cache_home", move || core.cache_home());
9998 assert_eq!(
9999 got, expected,
10000 "an overridden home is a self-contained sandbox"
10001 );
10002 }
10003
10004 #[test]
10005 fn cache_home_falls_back_to_the_platform_directory_without_an_override() {
10006 let dir = tempfile::tempdir().unwrap();
10007 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
10008 let got = within("cache_home (no override)", move || core.cache_home());
10009 assert_eq!(got, vak_config::paths::cache_home());
10010 }
10011
10012 #[test]
10013 fn every_override_backed_accessor_terminates() {
10014 // Breadth matters more than depth here: the hazard is the
10015 // locking idiom, so each accessor that reads an override is
10016 // exercised with one set.
10017 let (_dir, core) = core_with_override();
10018 let core = Arc::new(core);
10019 core.set_model("m".into());
10020 core.set_provider("p".into());
10021 core.set_permission_mode(vak_config::PermissionMode::FullAccess);
10022 core.set_sandbox_backend(Some("os".into()));
10023
10024 let checks: Vec<(&str, AccessorCheck)> = vec![
10025 (
10026 "sessions_home",
10027 Box::new(|c: Arc<Core>| {
10028 c.sessions_home();
10029 }),
10030 ),

9031/// declaration view: no session yet, so nothing session-specific is bound.
9032#[derive(Debug, Clone, Default)]
9033struct ToolScope {
9034 session_id: String,
9035 agent_id: Option<String>,
9036 audience_id: Option<String>,
9037}
9038
9039/// The MCP section of the prompt, rendered from the admitted capability
9040/// packet alone — one source, so the prompt can never describe servers the
9041/// turn did not admit.
9042///
9043/// Each server is named with the tool *names* the on-demand pool last
9044/// observed (none before its first use; `configuration.tools`) and, when its
9045/// last attempt failed, that reason. No descriptions or schemas: `mcp` `list`
9046/// with a server returns those right before the call that needs them
9047/// (docs/design/68-context-engine.md §5).
9048fn mcp_config_section(servers: &[&CapabilityDescriptor]) -> String {
9049 if servers.is_empty() {
9050 return String::new();
9051 }
9052 let mut section = String::from(
9053 "\nMCP servers (call through the `mcp` tool: action \"list\" with a `server` returns its tools' schemas; action \"call\" with `server`, `tool`, and `arguments` runs one; never invent a tool name or argument):\n",
9054 );
9055 for capability in servers {
9056 let tools: Vec<&str> = capability
9057 .configuration
9058 .get("tools")
9059 .and_then(|t| t.as_array())
9060 .map(|tools| {
9061 tools
9062 .iter()
9063 .filter_map(|tool| tool.get("name").and_then(|n| n.as_str()))
9064 .collect()
9065 })
9066 .unwrap_or_default();
9067 if tools.is_empty() {
9068 section.push_str(&format!("- {}\n", capability.name));
9069 } else {
9070 section.push_str(&format!("- {}: {}\n", capability.name, tools.join(", ")));
9071 }
9072 // Still callable — the pool retries on the next demand after its
9073 // backoff — so the model is told, not denied.
9074 if let Some(failure) = capability
9075 .configuration
9076 .get("last_failure")
9077 .and_then(|f| f.as_str())
9078 {
9079 section.push_str(&format!(
9080 " last attempt failed: {failure}. If the request needs it, try once more and otherwise tell the user it is unavailable and how to fix it: {}.\n",
9081 capability::report::mcp_remedy(&capability.name)
9082 ));
9083 }
9084 }
9085 section
9086}
9087
9088/// Phase H MEA provider: diff the run-start checkpoint against disk.
9089struct CheckpointDelta {
9090 home: PathBuf,
9091 sid: String,
9092 seq: u32,
9093 cwd: PathBuf,
9094}
9095
9096impl vak_agent::WorkspaceDelta for CheckpointDelta {
9097 fn summary(&self) -> Result<String, String> {
9098 checkpoints::delta_summary(
9099 &self.cwd.clone(),
9100 &self.home.clone(),
9101 self.sid.as_str(),
9102 self.seq,
9103 8192,
9104 )
9105 .map_err(|e| e.to_string())
9106 }
9107}
9108
9109#[cfg(test)]
9110#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9111mod mcp_section_tests {
9112 use super::mcp_config_section;
9113 use vak_session::types::{CapabilityDescriptor, CapabilityInvocation, CapabilityKind};
9114
9115 fn server(name: &str, configuration: serde_json::Value) -> CapabilityDescriptor {
9116 CapabilityDescriptor {
9117 name: name.into(),
9118 kind: CapabilityKind::McpServer,
9119 invocation: CapabilityInvocation::ModelTool,
9120 description: String::new(),
9121 source: None,
9122 digest: None,
9123 provenance: None,
9124 configuration,
9125 }
9126 }
9127
9128 #[test]
9129 fn configured_servers_remain_visible_without_a_catalog() {
9130 let caps = [server("tavily", serde_json::Value::Null)];
9131 let refs: Vec<_> = caps.iter().collect();
9132 let section = mcp_config_section(&refs);
9133 assert!(section.contains("tavily"));
9134 assert!(section.contains("`mcp`"));
9135 assert!(section.contains("action \"list\""));
9136 assert!(
9137 !section.contains("Discovered MCP catalog"),
9138 "an empty catalog must not be announced as one"
9139 );
9140 }
9141
9142 /// The catalog is read from the admitted packet, not a second cache.
9143 ///
9144 /// This is the defect that reached a user: the packet admitted `tavily`
9145 /// and the prompt named it, but the catalog lived in `Core::mcp_cache`
9146 /// and had not landed when the session froze. The model saw a server
9147 /// name with no tools behind it and answered "I do not have a tool that
9148 /// can provide real-time weather information" — with a connected,
9149 /// admitted search server attached. One source means the two can no
9150 /// longer disagree.
9151 #[test]
9152 fn the_catalog_comes_from_the_packet_with_exact_names() {
9153 let caps = [server(
9154 "tavily",
9155 serde_json::json!({
9156 "tools": [{
9157 "name": "tavily_search",
9158 "description": "Search the web",
9159 "inputSchema": {
9160 "type": "object",
9161 "properties": {"query": {"type": "string"}},
9162 "required": ["query"]
9163 }
9164 }]
9165 }),
9166 )];
9167 let refs: Vec<_> = caps.iter().collect();
9168 let section = mcp_config_section(&refs);
9169 assert!(section.contains("\n- tavily: tavily_search\n"));
9170 assert!(
9171 !section.contains("Search the web"),
9172 "descriptions come with the schema from `mcp list`, not in every prompt"
9173 );
9174 }
9175
9176 /// Schemas stay out of the prompt (docs/design/68 §5): a model reaches
9177 /// one input schema at a time via `mcp list`, never a full inline dump.
9178 #[test]
9179 fn the_catalog_never_inlines_input_schemas() {
9180 let caps = [server(
9181 "tavily",
9182 serde_json::json!({
9183 "tools": [{
9184 "name": "tavily_search",
9185 "description": "Search the web",
9186 "inputSchema": {
9187 "type": "object",
9188 "properties": {"query": {"type": "string"}},
9189 "required": ["query"]
9190 }
9191 }]
9192 }),
9193 )];
9194 let refs: Vec<_> = caps.iter().collect();
9195 let section = mcp_config_section(&refs);
9196 assert!(!section.contains("inputSchema"));
9197 assert!(!section.contains('{'));
9198 }
9199}
9200
9201#[cfg(test)]
9202mod plugin_runtime_tests {
9203 #![allow(clippy::unwrap_used)]
9204
9205 use super::*;
9206
9207 #[test]
9208 fn enabled_plugin_mcp_is_namespaced_and_disabled_plugin_is_invisible() {
9209 let dir = tempfile::tempdir().unwrap();
9210 let package = dir.path().join("plugin");
9211 std::fs::create_dir_all(&package).unwrap();
9212 std::fs::write(
9213 package.join("vak-plugin.json"),
9214 r#"{"schema":1,"name":"tools-pack","version":"1.0.0","description":"Tools","license":"MIT","components":{"mcp":["mcp.json"]}}"#,
9215 )
9216 .unwrap();
9217 std::fs::write(
9218 package.join("mcp.json"),
9219 r#"{"mcpServers":{"lookup":{"command":"lookup-bin","args":["--safe"]}}}"#,
9220 )
9221 .unwrap();
9222 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9223 core.set_sessions_home(dir.path().join("home"));
9224 let store = vak_plugin::PluginStore::new(dir.path().join(".vak"));
9225 store
9226 .install_local(package.as_path(), vak_plugin::InstallOptions::default())
9227 .unwrap();
9228 assert!(
9229 !core
9230 .effective_mcp()
9231 .servers
9232 .contains_key("plugin.tools-pack.lookup")
9233 );
9234 store.enable("tools-pack").unwrap();
9235 let servers = core.effective_mcp().servers;
9236 let server = servers.get("plugin.tools-pack.lookup").unwrap();
9237 assert_eq!(server.command, "lookup-bin");
9238 assert_eq!(server.args, ["--safe"]);
9239 assert!(!server.network);
9240 }
9241
9242 /// The whole point of caching `McpManager` on `Core` (see
9243 /// `mcp_manager()`): a hot plugin enable/disable — the same kind of
9244 /// on-the-fly change `set_mcp_servers` makes at runtime — must be
9245 /// picked up on the very next call, not require a restart, while an
9246 /// unrelated repeat call in between reuses the same manager instance
9247 /// rather than respawning server connections for no reason.
9248 #[tokio::test]
9249 async fn mcp_manager_reuses_instance_and_picks_up_hot_plugin_toggle() {
9250 let dir = tempfile::tempdir().unwrap();
9251 let package = dir.path().join("plugin");
9252 std::fs::create_dir_all(&package).unwrap();
9253 std::fs::write(
9254 package.join("vak-plugin.json"),
9255 r#"{"schema":1,"name":"tools-pack","version":"1.0.0","description":"Tools","license":"MIT","components":{"mcp":["mcp.json"]}}"#,
9256 )
9257 .unwrap();
9258 std::fs::write(
9259 package.join("mcp.json"),
9260 r#"{"mcpServers":{"lookup":{"command":"lookup-bin","args":["--safe"]}}}"#,
9261 )
9262 .unwrap();
9263 isolate_global_config();
9264 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9265 core.set_sessions_home(dir.path().join("home"));
9266 let store = vak_plugin::PluginStore::new(dir.path().join(".vak"));
9267 store
9268 .install_local(package.as_path(), vak_plugin::InstallOptions::default())
9269 .unwrap();
9270
9271 // Nothing configured yet: no manager.
9272 assert!(core.mcp_manager().is_none());
9273
9274 // Enable on the fly: next call sees the new server immediately.
9275 store.enable("tools-pack").unwrap();
9276 let first = core.mcp_manager().unwrap();
9277 assert_eq!(first.server_names(), vec!["plugin.tools-pack.lookup"]);
9278
9279 // The contributed server's egress follows the SAME effective-policy
9280 // seam the runner tools read: deny-by-default, and a hot persisted
9281 // grant reaches it next time `effective_mcp` resolves - not after a
9282 // restart. (Regression for a base-config read that left the server
9283 // stale for the whole process once an override landed.)
9284 assert!(
9285 !core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9286 "plugin-contributed MCP server must deny egress by default"
9287 );
9288 core.apply_persisted_plugins(vak_config::PluginResolved {
9289 network_allow: Some(vec!["tools-pack".into()]),
9290 ..core.effective_plugins()
9291 });
9292 assert!(
9293 core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9294 "persisted grant must reach the contributed MCP server live"
9295 );
9296 core.apply_persisted_plugins(vak_config::PluginResolved {
9297 network_allow: None,
9298 ..core.effective_plugins()
9299 });
9300 assert!(
9301 !core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9302 "persisted revoke must take the contributed server's egress away"
9303 );
9304
9305 // Same server set: same manager instance (no respawn/reconnect).
9306 let second = core.mcp_manager().unwrap();
9307 assert!(
9308 Arc::ptr_eq(&first, &second),
9309 "unchanged server set must reuse the cached manager"
9310 );
9311
9312 // Disable on the fly: next call sees it's gone immediately, no
9313 // restart required.
9314 store.disable("tools-pack").unwrap();
9315 assert!(core.mcp_manager().is_none());
9316 }
9317}
9318
9319#[cfg(test)]
9320mod webfetch_classification_tests {
9321 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9322 use super::*;
9323
9324 use vak_config::PermissionMode;
9325 use vak_permission::{Decision, Mode, PermissionEngine};
9326
9327 fn decide(
9328 cfg: &vak_config::Config,
9329 extra: &[String],
9330 mode: PermissionMode,
9331 tool: &str,
9332 ) -> Decision {
9333 let dir = tempfile::tempdir().unwrap();
9334 let engine: PermissionEngine = build_engine_with(cfg, extra).expect("engine builds");
9335 engine.evaluate(tool, &serde_json::json!({}), to_mode(mode), dir.path())
9336 }
9337
9338 fn to_mode(mode: PermissionMode) -> Mode {
9339 match mode {
9340 PermissionMode::ReadOnly => Mode::ReadOnly,
9341 PermissionMode::WorkspaceWrite => Mode::WorkspaceWrite,
9342 PermissionMode::FullAccess => Mode::FullAccess,
9343 }
9344 }
9345
9346 #[test]
9347 fn no_rule_outside_fullaccess_asks_fullaccess_allows() {
9348 let cfg = vak_config::Config::default();
9349 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9350 for tool in NETWORK_TOOLS {
9351 let d = decide(&cfg, &[], mode, tool);
9352 assert!(
9353 matches!(d, Decision::Ask { .. }),
9354 "{tool} in {mode:?} must Ask, got {d:?}"
9355 );
9356 }
9357 }
9358 for tool in NETWORK_TOOLS {
9359 let d = decide(&cfg, &[], PermissionMode::FullAccess, tool);
9360 assert!(
9361 matches!(d, Decision::Allow),
9362 "{tool} under FullAccess must Allow, got {d:?}"
9363 );
9364 }
9365 }
9366
9367 #[test]
9368 fn explicit_allow_rule_wins_in_every_restricted_mode() {
9369 for spec in ["webfetch", "+webfetch"] {
9370 let mut cfg = vak_config::Config::default();
9371 cfg.allow.push(spec.into());
9372 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9373 let d = decide(&cfg, &[], mode, "webfetch");
9374 assert!(matches!(d, Decision::Allow), "{spec:?} in {mode:?}: {d:?}");
9375 }
9376 }
9377 // Learned rules ride in via `extra`.
9378 let cfg = vak_config::Config::default();
9379 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9380 let d = decide(&cfg, &["+webfetch".to_string()], mode, "webfetch");
9381 assert!(matches!(d, Decision::Allow), "learned in {mode:?}: {d:?}");
9382 }
9383 }
9384
9385 #[test]
9386 fn explicit_deny_rule_wins_everywhere() {
9387 let mut cfg = vak_config::Config::default();
9388 cfg.deny.push("-webfetch".into());
9389 for mode in [
9390 PermissionMode::ReadOnly,
9391 PermissionMode::WorkspaceWrite,
9392 PermissionMode::FullAccess,
9393 ] {
9394 let d = decide(&cfg, &[], mode, "webfetch");
9395 assert!(matches!(d, Decision::Deny { .. }), "{mode:?}: {d:?}");
9396 }
9397 }
9398
9399 #[test]
9400 fn explicit_ask_rule_is_honored_even_under_fullaccess() {
9401 let mut cfg = vak_config::Config::default();
9402 cfg.ask.push("?webfetch".into());
9403 for mode in [
9404 PermissionMode::ReadOnly,
9405 PermissionMode::WorkspaceWrite,
9406 PermissionMode::FullAccess,
9407 ] {
9408 let d = decide(&cfg, &[], mode, "webfetch");
9409 assert!(matches!(d, Decision::Ask { .. }), "{mode:?}: {d:?}");
9410 }
9411 }
9412
9413 #[test]
9414 fn browse_shares_the_full_webfetch_mode_matrix() {
9415 // Same family, same posture: restricted modes Ask by default,
9416 // FullAccess allows, blanket allow lifts the Ask, blanket deny
9417 // denies even under FullAccess, and an explicit ?ask is honored
9418 // everywhere.
9419 let base = vak_config::Config::default();
9420 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9421 let d = decide(&base, &[], mode, "browse");
9422 assert!(matches!(d, Decision::Ask { .. }), "{mode:?}: {d:?}");
9423 }
9424 let d = decide(&base, &[], PermissionMode::FullAccess, "browse");
9425 assert!(matches!(d, Decision::Allow), "FullAccess: {d:?}");
9426
9427 let mut allowed = vak_config::Config::default();
9428 allowed.allow.push("browse".into());
9429 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9430 let d = decide(&allowed, &[], mode, "browse");
9431 assert!(
9432 matches!(d, Decision::Allow),
9433 "allow rule in {mode:?}: {d:?}"
9434 );
9435 }
9436
9437 let mut denied = vak_config::Config::default();
9438 denied.deny.push("-browse".into());
9439 for mode in [
9440 PermissionMode::ReadOnly,
9441 PermissionMode::WorkspaceWrite,
9442 PermissionMode::FullAccess,
9443 ] {
9444 let d = decide(&denied, &[], mode, "browse");
9445 assert!(
9446 matches!(d, Decision::Deny { .. }),
9447 "-browse in {mode:?}: {d:?}"
9448 );
9449 }
9450
9451 let mut asked = vak_config::Config::default();
9452 asked.ask.push("?browse".into());
9453 let d = decide(&asked, &[], PermissionMode::FullAccess, "browse");
9454 assert!(
9455 matches!(d, Decision::Ask { .. }),
9456 "?browse under FullAccess: {d:?}"
9457 );
9458 }
9459
9460 #[test]
9461 fn deny_outranks_allow_regardless_of_layer_order() {
9462 let mut cfg = vak_config::Config::default();
9463 cfg.allow.push("webfetch".into());
9464 cfg.deny.push("-webfetch".into());
9465 let dir = tempfile::tempdir().unwrap();
9466 let e = build_engine_with(&cfg, &[]).unwrap();
9467 let d = e.evaluate(
9468 "webfetch",
9469 &serde_json::json!({}),
9470 Mode::WorkspaceWrite,
9471 dir.path(),
9472 );
9473 assert!(matches!(d, Decision::Deny { .. }));
9474 }
9475
9476 #[test]
9477 fn patterned_allow_cannot_lift_the_ask_default() {
9478 // Patterned rules cannot see webfetch args today, so a patterned
9479 // allow must NOT suppress the injected Ask: matching URLs still ask
9480 // (severity Ask > Allow) and non-matching ones fall through to the
9481 // same Ask. Failing toward asking is the safe direction.
9482 let mut cfg = vak_config::Config::default();
9483 cfg.allow.push("webfetch(example.com/*)".into());
9484 let dir = tempfile::tempdir().unwrap();
9485 let e = build_engine_with(&cfg, &[]).unwrap();
9486 for url in ["other.org/x", "example.com/x"] {
9487 let d = e.evaluate(
9488 "webfetch",
9489 &serde_json::json!({"url": url}),
9490 Mode::WorkspaceWrite,
9491 dir.path(),
9492 );
9493 assert!(matches!(d, Decision::Ask { .. }), "{url}: {d:?}");
9494 }
9495 }
9496
9497 #[test]
9498 fn other_tools_keep_their_existing_defaults() {
9499 // The seam must not widen: bash still asks under workspace-write,
9500 // session_search stays a read tool, remember stays sanctioned.
9501 let dir = tempfile::tempdir().unwrap();
9502 let e = build_engine_with(&vak_config::Config::default(), &[]).unwrap();
9503 let bash = e.evaluate(
9504 "bash",
9505 &serde_json::json!({"command": "ls"}),
9506 Mode::WorkspaceWrite,
9507 dir.path(),
9508 );
9509 assert!(matches!(bash, Decision::Ask { .. }));
9510 for tool in ["session_search", "remember", "propose_skill"] {
9511 let d = e.evaluate(
9512 tool,
9513 &serde_json::json!({}),
9514 Mode::WorkspaceWrite,
9515 dir.path(),
9516 );
9517 assert!(matches!(d, Decision::Allow), "{tool}: {d:?}");
9518 }
9519 }
9520
9521 /// The regression the synthetic `?webfetch` injection caused: a network
9522 /// tool's restricted-mode gate must be a MODE default, so that
9523 /// `approval_mode = "auto-approve"` reaches it exactly as it reaches
9524 /// bash and every other mode-gated tool. When the gate was an injected
9525 /// rule, `auto_approve` refused it — the desktop kept prompting for
9526 /// webfetch with auto-approve on, and only for webfetch.
9527 #[test]
9528 fn network_tools_gate_as_a_mode_default_so_auto_approve_reaches_them() {
9529 let dir = tempfile::tempdir().unwrap();
9530 let cfg = vak_config::Config::default();
9531 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9532 let engine = build_engine_with(&cfg, &[]).unwrap();
9533 for tool in NETWORK_TOOLS {
9534 let decision =
9535 engine.evaluate(tool, &serde_json::json!({}), to_mode(mode), dir.path());
9536 let Decision::Ask { source, .. } = decision else {
9537 panic!("{tool} in {mode:?} must Ask, got {decision:?}");
9538 };
9539 assert_eq!(
9540 source,
9541 vak_permission::AskSource::ModeDefault,
9542 "{tool} in {mode:?} must ask as a mode default, not as a rule"
9543 );
9544 assert!(
9545 vak_agent::auto_approve(
9546 vak_agent::ApprovalMode::AutoApprove,
9547 source,
9548 tool,
9549 &serde_json::json!({}),
9550 to_mode(mode),
9551 false,
9552 dir.path(),
9553 ),
9554 "{tool} in {mode:?} must be reachable under auto-approve"
9555 );
9556 }
9557 }
9558 }
9559
9560 /// An operator's own `?webfetch` is still a rule, and still outranks
9561 /// auto-approve. Removing the injection must not remove that.
9562 #[test]
9563 fn a_deliberate_ask_rule_still_outranks_auto_approve() {
9564 let dir = tempfile::tempdir().unwrap();
9565 let mut cfg = vak_config::Config::default();
9566 cfg.ask.push("?webfetch".into());
9567 let engine = build_engine_with(&cfg, &[]).unwrap();
9568 let decision = engine.evaluate(
9569 "webfetch",
9570 &serde_json::json!({}),
9571 Mode::WorkspaceWrite,
9572 dir.path(),
9573 );
9574 let Decision::Ask { source, .. } = decision else {
9575 panic!("expected Ask, got {decision:?}");
9576 };
9577 assert_eq!(source, vak_permission::AskSource::Rule);
9578 assert!(!vak_agent::auto_approve(
9579 vak_agent::ApprovalMode::AutoApprove,
9580 source,
9581 "webfetch",
9582 &serde_json::json!({}),
9583 Mode::WorkspaceWrite,
9584 false,
9585 dir.path(),
9586 ));
9587 }
9588}
9589
9590/// Configured capability reconciled against reachable capability.
9591///
9592/// The scenario every test here is built from is a real one: a Telegram
9593/// turn, `permission_mode = "workspace-write"`, one MCP server (`tavily`)
9594/// configured with a valid key, and `gateway.approvals` left at its `deny`
9595/// default. Discovery worked perfectly — the model listed the catalogue and
9596/// called `tavily_search` with correct arguments on its first attempt — and
9597/// every call was refused by an approver that was never going to say yes.
9598/// It burned four tool calls, then told the user it had no way to search
9599/// the web. Nothing was broken. Nothing was logged. The prompt had promised
9600/// a capability the composed policy would never permit.
9601#[cfg(test)]
9602mod capability_reach_tests {
9603 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9604
9605 use super::*;
9606 use crate::reach::Reach;
9607 use vak_permission::{Decision, Mode};
9608
9609 /// A workspace with one MCP server and an explicit permission mode.
9610 ///
9611 /// The data home is pinned first. `global_path()` resolves to
9612 /// `default_workspace()/.vak/config.toml` — a developer's real
9613 /// `~/vak-home` config — and it merges UNDER this tempdir's project
9614 /// layer. Without the pin, an operator who sets `full-access` on their
9615 /// own install turns every `Gated`/`Blocked` expectation here into
9616 /// `Open`, and the suite fails on their machine only. That is exactly
9617 /// what happened.
9618 fn workspace(extra: &str) -> tempfile::TempDir {
9619 vak_config::paths::isolate_home_for_tests();
9620 let dir = tempfile::tempdir().unwrap();
9621 let vak = dir.path().join(".vak");
9622 std::fs::create_dir_all(&vak).unwrap();
9623 std::fs::write(
9624 vak.join("config.toml"),
9625 format!(
9626 "permission_mode = \"workspace-write\"\n\
9627 {extra}\n\
9628 [mcp.servers.tavily]\n\
9629 command = \"npx\"\n\
9630 args = [\"-y\", \"tavily-mcp@latest\"]\n\
9631 network = true\n"
9632 ),
9633 )
9634 .unwrap();
9635 dir
9636 }
9637
9638 fn core_for(dir: &tempfile::TempDir, answerable: bool) -> Core {
9639 let core = Core::new_with_trust(dir.path().to_path_buf(), true)
9640 .unwrap()
9641 .with_approver_answerable(answerable);
9642 core.set_sessions_home(dir.path().join("home"));
9643 core
9644 }
9645
9646 fn standing_for<'a>(standings: &'a [reach::Standing], label: &str) -> &'a reach::Standing {
9647 standings
9648 .iter()
9649 .find(|standing| standing.label == label)
9650 .unwrap_or_else(|| panic!("no standing for {label} in {standings:?}"))
9651 }
9652
9653 /// The bug, stated as a test: an unattended surface must not be told it
9654 /// has a capability whose every use it will refuse.
9655 #[test]
9656 fn an_unattended_surface_does_not_advertise_a_capability_it_will_refuse() {
9657 let dir = workspace("");
9658 let core = core_for(&dir, false);
9659
9660 let standings = core.capability_standings();
9661 assert_eq!(
9662 standing_for(&standings, "mcp server `tavily`").reach,
9663 Reach::Blocked
9664 );
9665
9666 let prompt = core.system_prompt();
9667 // It is no longer offered as usable...
9668 assert!(
9669 !prompt.contains("\n- tavily\n"),
9670 "unreachable server still advertised as usable:\n{prompt}"
9671 );
9672 // ...but it is not silently erased either: the model is told it
9673 // exists, that it cannot be used, and what would fix it, so it can
9674 // answer the user instead of hunting for a substitute tool.
9675 assert!(prompt.contains("Configured but NOT usable on this turn"));
9676 assert!(prompt.contains("mcp server `tavily`"));
9677 assert!(prompt.contains("no approver to answer it"));
9678 assert!(prompt.contains("approvals = \"forward\""));
9679 }
9680
9681 /// The same workspace on an attended surface is unchanged: a gate
9682 /// somebody can answer is a working capability, and still advertised.
9683 #[test]
9684 fn an_attended_surface_still_advertises_a_gated_capability() {
9685 let dir = workspace("");
9686 let core = core_for(&dir, true);
9687
9688 assert_eq!(
9689 standing_for(&core.capability_standings(), "mcp server `tavily`").reach,
9690 Reach::Gated
9691 );
9692 let prompt = core.system_prompt();
9693 assert!(prompt.contains("\n- tavily\n"));
9694 assert!(!prompt.contains("Configured but NOT usable"));
9695 }
9696
9697 /// And the operator's actual fix works: allowing the tool outright
9698 /// removes the gate, so even the unattended surface can use it.
9699 ///
9700 /// Note what stays blocked. `webfetch` and `browse` still gate on an
9701 /// approval this surface cannot answer, so they are still reported —
9702 /// which is correct, and is the second half of the same transcript:
9703 /// after the MCP denials the model fell back to `webfetch` and was
9704 /// refused there too. Reachability is per capability, not per turn.
9705 #[test]
9706 fn allowing_the_tool_makes_it_reachable_unattended() {
9707 let dir = workspace("allow = [\"mcp\"]");
9708 let core = core_for(&dir, false);
9709
9710 let standings = core.capability_standings();
9711 assert_eq!(
9712 standing_for(&standings, "mcp server `tavily`").reach,
9713 Reach::Open
9714 );
9715 let prompt = core.system_prompt();
9716 assert!(prompt.contains("\n- tavily\n"));
9717 assert!(
9718 !reach::prompt_section(&standings).contains("tavily"),
9719 "a reachable server must not be listed as unusable"
9720 );
9721 // The network tools are a separate capability and still gated.
9722 assert_eq!(standing_for(&standings, "`webfetch`").reach, Reach::Blocked);
9723 }
9724
9725 /// A deny is unreachable on every surface — no approver can answer a
9726 /// `Deny`, so an attended surface must report it exactly as bluntly.
9727 #[test]
9728 fn a_denied_capability_is_unreachable_even_when_attended() {
9729 let dir = workspace("deny = [\"-mcp\"]");
9730 let core = core_for(&dir, true);
9731
9732 let standings = core.capability_standings();
9733 let standing = standing_for(&standings, "mcp server `tavily`");
9734 assert_eq!(standing.reach, Reach::Blocked);
9735 assert!(standing.reason.contains("denied by rule"));
9736 assert!(!core.system_prompt().contains("\n- tavily\n"));
9737 }
9738
9739 /// Uncertainty must degrade to `Gated`, never to `Blocked`. The probe
9740 /// runs before a tool name exists, so a patterned rule cannot be
9741 /// evaluated — and hiding a capability that would in fact have worked
9742 /// is worse than advertising one that gates.
9743 #[test]
9744 fn a_patterned_rule_keeps_the_capability_advertised() {
9745 let dir = workspace("allow = [\"mcp(tavily/tavily_search)\"]");
9746 let core = core_for(&dir, false);
9747
9748 assert_eq!(
9749 standing_for(&core.capability_standings(), "mcp server `tavily`").reach,
9750 Reach::Gated
9751 );
9752 assert!(core.system_prompt().contains("\n- tavily\n"));
9753 }
9754
9755 /// AGENTS.md invariant 20: a channel overlay is restrictive. Both call
9756 /// sites used to compile `tools_allow` into blanket `+` allow rules, so
9757 /// narrowing a chat to one tool handed that chat the tool with its
9758 /// approval gate removed — an escalation performed by adding a
9759 /// restriction.
9760 #[test]
9761 fn a_narrowing_channel_overlay_never_removes_an_approval_gate() {
9762 let dir = workspace("");
9763 let core = core_for(&dir, true);
9764 let cwd = core.cwd().clone();
9765
9766 let baseline = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9767 assert!(matches!(
9768 baseline.evaluate(
9769 "bash",
9770 &serde_json::json!({"command": "ls"}),
9771 Mode::WorkspaceWrite,
9772 &cwd,
9773 ),
9774 Decision::Ask { .. }
9775 ));
9776
9777 core.apply_channel_policy(vak_config::ChannelPolicy {
9778 tools_allow: Some(vec!["bash".into()]),
9779 mcp_allow: Some(vec!["tavily/tavily_search".into()]),
9780 ..Default::default()
9781 });
9782 let narrowed = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9783
9784 for (tool, args) in [
9785 ("bash", serde_json::json!({"command": "ls"})),
9786 (
9787 "mcp",
9788 serde_json::json!({"action": "call", "server": "tavily", "tool": "tavily_search"}),
9789 ),
9790 ] {
9791 let decision = narrowed.evaluate(tool, &args, Mode::WorkspaceWrite, &cwd);
9792 assert!(
9793 !matches!(decision, Decision::Allow),
9794 "narrowing overlay granted {tool} an unattended Allow: {decision:?}"
9795 );
9796 }
9797 }
9798
9799 /// `Some([])` still means "block this category outright".
9800 #[test]
9801 fn an_empty_channel_allowlist_still_denies_the_category() {
9802 let dir = workspace("");
9803 let core = core_for(&dir, true);
9804 let cwd = core.cwd().clone();
9805 core.apply_channel_policy(vak_config::ChannelPolicy {
9806 tools_allow: Some(Vec::new()),
9807 mcp_allow: Some(Vec::new()),
9808 ..Default::default()
9809 });
9810 let engine = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9811 for tool in ["bash", "read", "webfetch", "browse", "mcp"] {
9812 let decision =
9813 engine.evaluate(tool, &serde_json::json!({}), Mode::WorkspaceWrite, &cwd);
9814 assert!(
9815 matches!(decision, Decision::Deny { .. }),
9816 "{tool} survived an empty channel allowlist: {decision:?}"
9817 );
9818 }
9819 }
9820
9821 /// One blocked MCP server must not take the broker down with it, and a
9822 /// tool with no reachable use left must not stay in the registry.
9823 #[test]
9824 fn only_fully_blocked_tools_are_dropped() {
9825 let standing = |kind: CapabilityKind, name: &str, reach: Reach| reach::Standing {
9826 id: capability::CapabilityId::new(kind.clone(), name),
9827 tool: if kind == CapabilityKind::McpServer {
9828 "mcp".into()
9829 } else {
9830 name.into()
9831 },
9832 label: name.into(),
9833 reach,
9834 reason: String::new(),
9835 remedy: String::new(),
9836 };
9837 let server = |name: &str, reach| standing(CapabilityKind::McpServer, name, reach);
9838
9839 let mixed = vec![
9840 server("a", Reach::Blocked),
9841 server("b", Reach::Open),
9842 standing(CapabilityKind::Tool, "webfetch", Reach::Blocked),
9843 ];
9844 assert_eq!(reach::fully_blocked_tools(&mixed), vec!["webfetch"]);
9845 assert_eq!(reach::blocked_mcp_servers(&mixed), vec!["a"]);
9846
9847 let all = vec![server("a", Reach::Blocked), server("b", Reach::Blocked)];
9848 assert_eq!(reach::fully_blocked_tools(&all), vec!["mcp"]);
9849 }
9850
9851 #[test]
9852 fn denied_skill_is_blocked_and_dropped_from_descriptors() {
9853 let dir = workspace("deny = [\"-skill(blocked-skill)\"]");
9854 let skill_dir = dir.path().join(".vak/skills/blocked-skill");
9855 std::fs::create_dir_all(&skill_dir).unwrap();
9856 std::fs::write(
9857 skill_dir.join("SKILL.md"),
9858 "---\nname: blocked-skill\ndescription: test blocked skill\n---\nbody",
9859 )
9860 .unwrap();
9861
9862 let core = core_for(&dir, true);
9863 let standings = core.capability_standings();
9864 let standing = standing_for(&standings, "skill `blocked-skill`");
9865 assert_eq!(standing.reach, Reach::Blocked);
9866
9867 let descriptors = core.capability_descriptors();
9868 assert!(
9869 !descriptors.iter().any(|d| d.name == "blocked-skill"),
9870 "blocked skill must not be in admitted capability descriptors"
9871 );
9872
9873 let prompt = core.system_prompt();
9874 assert!(
9875 prompt.contains("skill `blocked-skill`"),
9876 "prompt should report blocked skill in standing section"
9877 );
9878 }
9879
9880 #[test]
9881 fn capability_diagnostics_reports_parse_failure_and_prompt_includes_it() {
9882 let dir = workspace("");
9883 let bad_skill_dir = dir.path().join(".vak/skills/Bad_Skill");
9884 std::fs::create_dir_all(&bad_skill_dir).unwrap();
9885 std::fs::write(
9886 bad_skill_dir.join("SKILL.md"),
9887 "---\nname: Bad_Skill\ndescription: bad format\n---\nbody",
9888 )
9889 .unwrap();
9890
9891 let core = core_for(&dir, true);
9892 let diags = core.capability_diagnostics();
9893 let bad_diag = diags.iter().find(|d| d.name == "Bad_Skill");
9894 assert!(bad_diag.is_some(), "diagnostic must report Bad_Skill");
9895 assert!(bad_diag.unwrap().reason.contains("lowercase kebab-case"));
9896
9897 let prompt = core.system_prompt();
9898 assert!(prompt.contains("skill `Bad_Skill`"));
9899 assert!(prompt.contains("Fix: fix the SKILL.md frontmatter"));
9900 }
9901
9902 #[test]
9903 fn tools_and_commitment_overrides_are_dynamic() {
9904 let dir = workspace("");
9905 let core = core_for(&dir, true);
9906
9907 // web_fetch and browse default to true
9908 assert!(core.effective_web_fetch());
9909 assert!(core.effective_browse());
9910 assert!(core.tool_names().contains(&"webfetch".to_string()));
9911 assert!(core.tool_names().contains(&"browse".to_string()));
9912
9913 // Apply dynamic tool toggle: disable both
9914 core.apply_persisted_tools(false, false);
9915 assert!(!core.effective_web_fetch());
9916 assert!(!core.effective_browse());
9917 assert!(!core.tool_names().contains(&"webfetch".to_string()));
9918 assert!(!core.tool_names().contains(&"browse".to_string()));
9919
9920 // Toggle back
9921 core.apply_persisted_tools(true, true);
9922 assert!(core.effective_web_fetch());
9923 assert!(core.effective_browse());
9924 assert!(core.tool_names().contains(&"webfetch".to_string()));
9925 assert!(core.tool_names().contains(&"browse".to_string()));
9926
9927 // Toggle commitment
9928 core.apply_persisted_commitment(true);
9929 assert!(core.effective_commitment());
9930 assert!(core.tool_names().contains(&"commitments".to_string()));
9931
9932 core.apply_persisted_commitment(false);
9933 assert!(!core.effective_commitment());
9934 assert!(!core.tool_names().contains(&"commitments".to_string()));
9935 }
9936
9937 #[tokio::test]
9938 async fn permission_mode_change_cancels_existing_permission_lease() {
9939 let dir = tempfile::tempdir().unwrap();
9940 let core = Core::new(dir.path().to_path_buf()).unwrap();
9941 let lease = core.permission_lease();
9942 core.set_permission_mode(vak_config::PermissionMode::ReadOnly);
9943 assert!(lease.is_cancelled());
9944 assert!(!core.permission_lease().is_cancelled());
9945 }
9946}
9947
9948/// Every `Core` accessor must terminate while session-scoped overrides are
9949/// set. `cache_home` once locked `sessions_home_override` and then called
9950/// `sessions_home()`, which locks the same non-reentrant mutex — the
9951/// thread wedged forever. It surfaced only in tests, because production
9952/// leaves the override unset and never entered the branch, and it made
9953/// `cargo test --workspace` hang rather than fail.
9954///
9955/// These run each accessor on a worker thread with a deadline, so a
9956/// reintroduced deadlock fails the suite instead of hanging it. A test
9957/// that hangs reports nothing and blocks every gate behind it.
9958#[cfg(test)]
9959#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9960mod override_deadlock {
9961 use super::*;
9962
9963 /// Run `f` on its own thread, failing if it has not returned in time.
9964 fn within<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Send + 'static) -> T {
9965 let (tx, rx) = std::sync::mpsc::channel();
9966 let handle = std::thread::spawn(move || {
9967 let out = f();
9968 // Send may fail if the receiver already gave up; the timeout
9969 // below is what reports that, so ignore the error here.
9970 let _ = tx.send(());
9971 out
9972 });
9973 match rx.recv_timeout(std::time::Duration::from_secs(10)) {
9974 Ok(()) => handle.join().expect("accessor thread panicked"),
9975 Err(_) => panic!(
9976 "{label} did not return within 10s — an accessor is deadlocked \
9977 (a guard held across a call that re-locks the same mutex)"
9978 ),
9979 }
9980 }
9981
9982 /// One accessor to exercise, boxed so a heterogeneous set can share
9983 /// a list.
9984 type AccessorCheck = Box<dyn FnOnce(Arc<Core>) + Send>;
9985
9986 fn core_with_override() -> (tempfile::TempDir, Core) {
9987 let dir = tempfile::tempdir().unwrap();
9988 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9989 core.set_sessions_home(dir.path().join("home"));
9990 (dir, core)
9991 }
9992
9993 #[test]
9994 fn cache_home_returns_while_the_sessions_home_override_is_set() {
9995 let (dir, core) = core_with_override();
9996 let expected = dir.path().join("home").join("cache");
9997 let got = within("cache_home", move || core.cache_home());
9998 assert_eq!(
9999 got, expected,
10000 "an overridden home is a self-contained sandbox"
10001 );
10002 }
10003
10004 #[test]
10005 fn cache_home_falls_back_to_the_platform_directory_without_an_override() {
10006 let dir = tempfile::tempdir().unwrap();
10007 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
10008 let got = within("cache_home (no override)", move || core.cache_home());
10009 assert_eq!(got, vak_config::paths::cache_home());
10010 }
10011
10012 #[test]
10013 fn every_override_backed_accessor_terminates() {
10014 // Breadth matters more than depth here: the hazard is the
10015 // locking idiom, so each accessor that reads an override is
10016 // exercised with one set.
10017 let (_dir, core) = core_with_override();
10018 let core = Arc::new(core);
10019 core.set_model("m".into());
10020 core.set_provider("p".into());
10021 core.set_permission_mode(vak_config::PermissionMode::FullAccess);
10022 core.set_sandbox_backend(Some("os".into()));
10023
10024 let checks: Vec<(&str, AccessorCheck)> = vec![
10025 (
10026 "sessions_home",
10027 Box::new(|c: Arc<Core>| {
10028 c.sessions_home();
10029 }),
10030 ),

Lib

Indexing the workspace…

Lib