9266. 9266 let store = vak_plugin::PluginStore::new(dir.path().join(".vak"));
9267. 9267 store
9268. 9268 .install_local(package.as_path(), vak_plugin::InstallOptions::default())
9269. 9269 .unwrap();
9270. 9270
9271. 9271 // Nothing configured yet: no manager.
9272. 9272 assert!(core.mcp_manager().is_none());
9273. 9273
9274. 9274 // Enable on the fly: next call sees the new server immediately.
9275. 9275 store.enable("tools-pack").unwrap();
9276. 9276 let first = core.mcp_manager().unwrap();
9277. 9277 assert_eq!(first.server_names(), vec!["plugin.tools-pack.lookup"]);
9278. 9278
9279. 9279 // The contributed server's egress follows the SAME effective-policy
9280. 9280 // seam the runner tools read: deny-by-default, and a hot persisted
9281. 9281 // grant reaches it next time `effective_mcp` resolves - not after a
9282. 9282 // restart. (Regression for a base-config read that left the server
9283. 9283 // stale for the whole process once an override landed.)
9284. 9284 assert!(
9285. 9285 !core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9286. 9286 "plugin-contributed MCP server must deny egress by default"
9287. 9287 );
9288. 9288 core.apply_persisted_plugins(vak_config::PluginResolved {
9289. 9289 network_allow: Some(vec!["tools-pack".into()]),
9290. 9290 ..core.effective_plugins()
9291. 9291 });
9292. 9292 assert!(
9293. 9293 core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9294. 9294 "persisted grant must reach the contributed MCP server live"
9295. 9295 );
9296. 9296 core.apply_persisted_plugins(vak_config::PluginResolved {
9297. 9297 network_allow: None,
9298. 9298 ..core.effective_plugins()
9299. 9299 });
9300. 9300 assert!(
9301. 9301 !core.effective_mcp().servers["plugin.tools-pack.lookup"].network,
9302. 9302 "persisted revoke must take the contributed server's egress away"
9303. 9303 );
9304. 9304
9305. 9305 // Same server set: same manager instance (no respawn/reconnect).
9306. 9306 let second = core.mcp_manager().unwrap();
9307. 9307 assert!(
9308. 9308 Arc::ptr_eq(&first, &second),
9309. 9309 "unchanged server set must reuse the cached manager"
9310. 9310 );
9311. 9311
9312. 9312 // Disable on the fly: next call sees it's gone immediately, no
9313. 9313 // restart required.
9314. 9314 store.disable("tools-pack").unwrap();
9315. 9315 assert!(core.mcp_manager().is_none());
9316. 9316 }
9317. 9317}
9318. 9318
9319. 9319#[cfg(test)]
9320. 9320mod webfetch_classification_tests {
9321. 9321 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9322. 9322 use super::*;
9323. 9323
9324. 9324 use vak_config::PermissionMode;
9325. 9325 use vak_permission::{Decision, Mode, PermissionEngine};
9326. 9326
9327. 9327 fn decide(
9328. 9328 cfg: &vak_config::Config,
9329. 9329 extra: &[String],
9330. 9330 mode: PermissionMode,
9331. 9331 tool: &str,
9332. 9332 ) -> Decision {
9333. 9333 let dir = tempfile::tempdir().unwrap();
9334. 9334 let engine: PermissionEngine = build_engine_with(cfg, extra).expect("engine builds");
9335. 9335 engine.evaluate(tool, &serde_json::json!({}), to_mode(mode), dir.path())
9336. 9336 }
9337. 9337
9338. 9338 fn to_mode(mode: PermissionMode) -> Mode {
9339. 9339 match mode {
9340. 9340 PermissionMode::ReadOnly => Mode::ReadOnly,
9341. 9341 PermissionMode::WorkspaceWrite => Mode::WorkspaceWrite,
9342. 9342 PermissionMode::FullAccess => Mode::FullAccess,
9343. 9343 }
9344. 9344 }
9345. 9345
9346. 9346 #[test]
9347. 9347 fn no_rule_outside_fullaccess_asks_fullaccess_allows() {
9348. 9348 let cfg = vak_config::Config::default();
9349. 9349 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9350. 9350 for tool in NETWORK_TOOLS {
9351. 9351 let d = decide(&cfg, &[], mode, tool);
9352. 9352 assert!(
9353. 9353 matches!(d, Decision::Ask { .. }),
9354. 9354 "{tool} in {mode:?} must Ask, got {d:?}"
9355. 9355 );
9356. 9356 }
9357. 9357 }
9358. 9358 for tool in NETWORK_TOOLS {
9359. 9359 let d = decide(&cfg, &[], PermissionMode::FullAccess, tool);
9360. 9360 assert!(
9361. 9361 matches!(d, Decision::Allow),
9362. 9362 "{tool} under FullAccess must Allow, got {d:?}"
9363. 9363 );
9364. 9364 }
9365. 9365 }
9366. 9366
9367. 9367 #[test]
9368. 9368 fn explicit_allow_rule_wins_in_every_restricted_mode() {
9369. 9369 for spec in ["webfetch", "+webfetch"] {
9370. 9370 let mut cfg = vak_config::Config::default();
9371. 9371 cfg.allow.push(spec.into());
9372. 9372 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9373. 9373 let d = decide(&cfg, &[], mode, "webfetch");
9374. 9374 assert!(matches!(d, Decision::Allow), "{spec:?} in {mode:?}: {d:?}");
9375. 9375 }
9376. 9376 }
9377. 9377 // Learned rules ride in via `extra`.
9378. 9378 let cfg = vak_config::Config::default();
9379. 9379 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9380. 9380 let d = decide(&cfg, &["+webfetch".to_string()], mode, "webfetch");
9381. 9381 assert!(matches!(d, Decision::Allow), "learned in {mode:?}: {d:?}");
9382. 9382 }
9383. 9383 }
9384. 9384
9385. 9385 #[test]
9386. 9386 fn explicit_deny_rule_wins_everywhere() {
9387. 9387 let mut cfg = vak_config::Config::default();
9388. 9388 cfg.deny.push("-webfetch".into());
9389. 9389 for mode in [
9390. 9390 PermissionMode::ReadOnly,
9391. 9391 PermissionMode::WorkspaceWrite,
9392. 9392 PermissionMode::FullAccess,
9393. 9393 ] {
9394. 9394 let d = decide(&cfg, &[], mode, "webfetch");
9395. 9395 assert!(matches!(d, Decision::Deny { .. }), "{mode:?}: {d:?}");
9396. 9396 }
9397. 9397 }
9398. 9398
9399. 9399 #[test]
9400. 9400 fn explicit_ask_rule_is_honored_even_under_fullaccess() {
9401. 9401 let mut cfg = vak_config::Config::default();
9402. 9402 cfg.ask.push("?webfetch".into());
9403. 9403 for mode in [
9404. 9404 PermissionMode::ReadOnly,
9405. 9405 PermissionMode::WorkspaceWrite,
9406. 9406 PermissionMode::FullAccess,
9407. 9407 ] {
9408. 9408 let d = decide(&cfg, &[], mode, "webfetch");
9409. 9409 assert!(matches!(d, Decision::Ask { .. }), "{mode:?}: {d:?}");
9410. 9410 }
9411. 9411 }
9412. 9412
9413. 9413 #[test]
9414. 9414 fn browse_shares_the_full_webfetch_mode_matrix() {
9415. 9415 // Same family, same posture: restricted modes Ask by default,
9416. 9416 // FullAccess allows, blanket allow lifts the Ask, blanket deny
9417. 9417 // denies even under FullAccess, and an explicit ?ask is honored
9418. 9418 // everywhere.
9419. 9419 let base = vak_config::Config::default();
9420. 9420 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9421. 9421 let d = decide(&base, &[], mode, "browse");
9422. 9422 assert!(matches!(d, Decision::Ask { .. }), "{mode:?}: {d:?}");
9423. 9423 }
9424. 9424 let d = decide(&base, &[], PermissionMode::FullAccess, "browse");
9425. 9425 assert!(matches!(d, Decision::Allow), "FullAccess: {d:?}");
9426. 9426
9427. 9427 let mut allowed = vak_config::Config::default();
9428. 9428 allowed.allow.push("browse".into());
9429. 9429 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9430. 9430 let d = decide(&allowed, &[], mode, "browse");
9431. 9431 assert!(
9432. 9432 matches!(d, Decision::Allow),
9433. 9433 "allow rule in {mode:?}: {d:?}"
9434. 9434 );
9435. 9435 }
9436. 9436
9437. 9437 let mut denied = vak_config::Config::default();
9438. 9438 denied.deny.push("-browse".into());
9439. 9439 for mode in [
9440. 9440 PermissionMode::ReadOnly,
9441. 9441 PermissionMode::WorkspaceWrite,
9442. 9442 PermissionMode::FullAccess,
9443. 9443 ] {
9444. 9444 let d = decide(&denied, &[], mode, "browse");
9445. 9445 assert!(
9446. 9446 matches!(d, Decision::Deny { .. }),
9447. 9447 "-browse in {mode:?}: {d:?}"
9448. 9448 );
9449. 9449 }
9450. 9450
9451. 9451 let mut asked = vak_config::Config::default();
9452. 9452 asked.ask.push("?browse".into());
9453. 9453 let d = decide(&asked, &[], PermissionMode::FullAccess, "browse");
9454. 9454 assert!(
9455. 9455 matches!(d, Decision::Ask { .. }),
9456. 9456 "?browse under FullAccess: {d:?}"
9457. 9457 );
9458. 9458 }
9459. 9459
9460. 9460 #[test]
9461. 9461 fn deny_outranks_allow_regardless_of_layer_order() {
9462. 9462 let mut cfg = vak_config::Config::default();
9463. 9463 cfg.allow.push("webfetch".into());
9464. 9464 cfg.deny.push("-webfetch".into());
9465. 9465 let dir = tempfile::tempdir().unwrap();
9466. 9466 let e = build_engine_with(&cfg, &[]).unwrap();
9467. 9467 let d = e.evaluate(
9468. 9468 "webfetch",
9469. 9469 &serde_json::json!({}),
9470. 9470 Mode::WorkspaceWrite,
9471. 9471 dir.path(),
9472. 9472 );
9473. 9473 assert!(matches!(d, Decision::Deny { .. }));
9474. 9474 }
9475. 9475
9476. 9476 #[test]
9477. 9477 fn patterned_allow_cannot_lift_the_ask_default() {
9478. 9478 // Patterned rules cannot see webfetch args today, so a patterned
9479. 9479 // allow must NOT suppress the injected Ask: matching URLs still ask
9480. 9480 // (severity Ask > Allow) and non-matching ones fall through to the
9481. 9481 // same Ask. Failing toward asking is the safe direction.
9482. 9482 let mut cfg = vak_config::Config::default();
9483. 9483 cfg.allow.push("webfetch(example.com/*)".into());
9484. 9484 let dir = tempfile::tempdir().unwrap();
9485. 9485 let e = build_engine_with(&cfg, &[]).unwrap();
9486. 9486 for url in ["other.org/x", "example.com/x"] {
9487. 9487 let d = e.evaluate(
9488. 9488 "webfetch",
9489. 9489 &serde_json::json!({"url": url}),
9490. 9490 Mode::WorkspaceWrite,
9491. 9491 dir.path(),
9492. 9492 );
9493. 9493 assert!(matches!(d, Decision::Ask { .. }), "{url}: {d:?}");
9494. 9494 }
9495. 9495 }
9496. 9496
9497. 9497 #[test]
9498. 9498 fn other_tools_keep_their_existing_defaults() {
9499. 9499 // The seam must not widen: bash still asks under workspace-write,
9500. 9500 // session_search stays a read tool, remember stays sanctioned.
9501. 9501 let dir = tempfile::tempdir().unwrap();
9502. 9502 let e = build_engine_with(&vak_config::Config::default(), &[]).unwrap();
9503. 9503 let bash = e.evaluate(
9504. 9504 "bash",
9505. 9505 &serde_json::json!({"command": "ls"}),
9506. 9506 Mode::WorkspaceWrite,
9507. 9507 dir.path(),
9508. 9508 );
9509. 9509 assert!(matches!(bash, Decision::Ask { .. }));
9510. 9510 for tool in ["session_search", "remember", "propose_skill"] {
9511. 9511 let d = e.evaluate(
9512. 9512 tool,
9513. 9513 &serde_json::json!({}),
9514. 9514 Mode::WorkspaceWrite,
9515. 9515 dir.path(),
9516. 9516 );
9517. 9517 assert!(matches!(d, Decision::Allow), "{tool}: {d:?}");
9518. 9518 }
9519. 9519 }
9520. 9520
9521. 9521 /// The regression the synthetic `?webfetch` injection caused: a network
9522. 9522 /// tool's restricted-mode gate must be a MODE default, so that
9523. 9523 /// `approval_mode = "auto-approve"` reaches it exactly as it reaches
9524. 9524 /// bash and every other mode-gated tool. When the gate was an injected
9525. 9525 /// rule, `auto_approve` refused it — the desktop kept prompting for
9526. 9526 /// webfetch with auto-approve on, and only for webfetch.
9527. 9527 #[test]
9528. 9528 fn network_tools_gate_as_a_mode_default_so_auto_approve_reaches_them() {
9529. 9529 let dir = tempfile::tempdir().unwrap();
9530. 9530 let cfg = vak_config::Config::default();
9531. 9531 for mode in [PermissionMode::ReadOnly, PermissionMode::WorkspaceWrite] {
9532. 9532 let engine = build_engine_with(&cfg, &[]).unwrap();
9533. 9533 for tool in NETWORK_TOOLS {
9534. 9534 let decision =
9535. 9535 engine.evaluate(tool, &serde_json::json!({}), to_mode(mode), dir.path());
9536. 9536 let Decision::Ask { source, .. } = decision else {
9537. 9537 panic!("{tool} in {mode:?} must Ask, got {decision:?}");
9538. 9538 };
9539. 9539 assert_eq!(
9540. 9540 source,
9541. 9541 vak_permission::AskSource::ModeDefault,
9542. 9542 "{tool} in {mode:?} must ask as a mode default, not as a rule"
9543. 9543 );
9544. 9544 assert!(
9545. 9545 vak_agent::auto_approve(
9546. 9546 vak_agent::ApprovalMode::AutoApprove,
9547. 9547 source,
9548. 9548 tool,
9549. 9549 &serde_json::json!({}),
9550. 9550 to_mode(mode),
9551. 9551 false,
9552. 9552 dir.path(),
9553. 9553 ),
9554. 9554 "{tool} in {mode:?} must be reachable under auto-approve"
9555. 9555 );
9556. 9556 }
9557. 9557 }
9558. 9558 }
9559. 9559
9560. 9560 /// An operator's own `?webfetch` is still a rule, and still outranks
9561. 9561 /// auto-approve. Removing the injection must not remove that.
9562. 9562 #[test]
9563. 9563 fn a_deliberate_ask_rule_still_outranks_auto_approve() {
9564. 9564 let dir = tempfile::tempdir().unwrap();
9565. 9565 let mut cfg = vak_config::Config::default();
9566. 9566 cfg.ask.push("?webfetch".into());
9567. 9567 let engine = build_engine_with(&cfg, &[]).unwrap();
9568. 9568 let decision = engine.evaluate(
9569. 9569 "webfetch",
9570. 9570 &serde_json::json!({}),
9571. 9571 Mode::WorkspaceWrite,
9572. 9572 dir.path(),
9573. 9573 );
9574. 9574 let Decision::Ask { source, .. } = decision else {
9575. 9575 panic!("expected Ask, got {decision:?}");
9576. 9576 };
9577. 9577 assert_eq!(source, vak_permission::AskSource::Rule);
9578. 9578 assert!(!vak_agent::auto_approve(
9579. 9579 vak_agent::ApprovalMode::AutoApprove,
9580. 9580 source,
9581. 9581 "webfetch",
9582. 9582 &serde_json::json!({}),
9583. 9583 Mode::WorkspaceWrite,
9584. 9584 false,
9585. 9585 dir.path(),
9586. 9586 ));
9587. 9587 }
9588. 9588}
9589. 9589
9590. 9590/// Configured capability reconciled against reachable capability.
9591. 9591///
9592. 9592/// The scenario every test here is built from is a real one: a Telegram
9593. 9593/// turn, `permission_mode = "workspace-write"`, one MCP server (`tavily`)
9594. 9594/// configured with a valid key, and `gateway.approvals` left at its `deny`
9595. 9595/// default. Discovery worked perfectly — the model listed the catalogue and
9596. 9596/// called `tavily_search` with correct arguments on its first attempt — and
9597. 9597/// every call was refused by an approver that was never going to say yes.
9598. 9598/// It burned four tool calls, then told the user it had no way to search
9599. 9599/// the web. Nothing was broken. Nothing was logged. The prompt had promised
9600. 9600/// a capability the composed policy would never permit.
9601. 9601#[cfg(test)]
9602. 9602mod capability_reach_tests {
9603. 9603 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9604. 9604
9605. 9605 use super::*;
9606. 9606 use crate::reach::Reach;
9607. 9607 use vak_permission::{Decision, Mode};
9608. 9608
9609. 9609 /// A workspace with one MCP server and an explicit permission mode.
9610. 9610 ///
9611. 9611 /// The data home is pinned first. `global_path()` resolves to
9612. 9612 /// `default_workspace()/.vak/config.toml` — a developer's real
9613. 9613 /// `~/vak-home` config — and it merges UNDER this tempdir's project
9614. 9614 /// layer. Without the pin, an operator who sets `full-access` on their
9615. 9615 /// own install turns every `Gated`/`Blocked` expectation here into
9616. 9616 /// `Open`, and the suite fails on their machine only. That is exactly
9617. 9617 /// what happened.
9618. 9618 fn workspace(extra: &str) -> tempfile::TempDir {
9619. 9619 vak_config::paths::isolate_home_for_tests();
9620. 9620 let dir = tempfile::tempdir().unwrap();
9621. 9621 let vak = dir.path().join(".vak");
9622. 9622 std::fs::create_dir_all(&vak).unwrap();
9623. 9623 std::fs::write(
9624. 9624 vak.join("config.toml"),
9625. 9625 format!(
9626. 9626 "permission_mode = \"workspace-write\"\n\
9627. 9627 {extra}\n\
9628. 9628 [mcp.servers.tavily]\n\
9629. 9629 command = \"npx\"\n\
9630. 9630 args = [\"-y\", \"tavily-mcp@latest\"]\n\
9631. 9631 network = true\n"
9632. 9632 ),
9633. 9633 )
9634. 9634 .unwrap();
9635. 9635 dir
9636. 9636 }
9637. 9637
9638. 9638 fn core_for(dir: &tempfile::TempDir, answerable: bool) -> Core {
9639. 9639 let core = Core::new_with_trust(dir.path().to_path_buf(), true)
9640. 9640 .unwrap()
9641. 9641 .with_approver_answerable(answerable);
9642. 9642 core.set_sessions_home(dir.path().join("home"));
9643. 9643 core
9644. 9644 }
9645. 9645
9646. 9646 fn standing_for<'a>(standings: &'a [reach::Standing], label: &str) -> &'a reach::Standing {
9647. 9647 standings
9648. 9648 .iter()
9649. 9649 .find(|standing| standing.label == label)
9650. 9650 .unwrap_or_else(|| panic!("no standing for {label} in {standings:?}"))
9651. 9651 }
9652. 9652
9653. 9653 /// The bug, stated as a test: an unattended surface must not be told it
9654. 9654 /// has a capability whose every use it will refuse.
9655. 9655 #[test]
9656. 9656 fn an_unattended_surface_does_not_advertise_a_capability_it_will_refuse() {
9657. 9657 let dir = workspace("");
9658. 9658 let core = core_for(&dir, false);
9659. 9659
9660. 9660 let standings = core.capability_standings();
9661. 9661 assert_eq!(
9662. 9662 standing_for(&standings, "mcp server `tavily`").reach,
9663. 9663 Reach::Blocked
9664. 9664 );
9665. 9665
9666. 9666 let prompt = core.system_prompt();
9667. 9667 // It is no longer offered as usable...
9668. 9668 assert!(
9669. 9669 !prompt.contains("\n- tavily\n"),
9670. 9670 "unreachable server still advertised as usable:\n{prompt}"
9671. 9671 );
9672. 9672 // ...but it is not silently erased either: the model is told it
9673. 9673 // exists, that it cannot be used, and what would fix it, so it can
9674. 9674 // answer the user instead of hunting for a substitute tool.
9675. 9675 assert!(prompt.contains("Configured but NOT usable on this turn"));
9676. 9676 assert!(prompt.contains("mcp server `tavily`"));
9677. 9677 assert!(prompt.contains("no approver to answer it"));
9678. 9678 assert!(prompt.contains("approvals = \"forward\""));
9679. 9679 }
9680. 9680
9681. 9681 /// The same workspace on an attended surface is unchanged: a gate
9682. 9682 /// somebody can answer is a working capability, and still advertised.
9683. 9683 #[test]
9684. 9684 fn an_attended_surface_still_advertises_a_gated_capability() {
9685. 9685 let dir = workspace("");
9686. 9686 let core = core_for(&dir, true);
9687. 9687
9688. 9688 assert_eq!(
9689. 9689 standing_for(&core.capability_standings(), "mcp server `tavily`").reach,
9690. 9690 Reach::Gated
9691. 9691 );
9692. 9692 let prompt = core.system_prompt();
9693. 9693 assert!(prompt.contains("\n- tavily\n"));
9694. 9694 assert!(!prompt.contains("Configured but NOT usable"));
9695. 9695 }
9696. 9696
9697. 9697 /// And the operator's actual fix works: allowing the tool outright
9698. 9698 /// removes the gate, so even the unattended surface can use it.
9699. 9699 ///
9700. 9700 /// Note what stays blocked. `webfetch` and `browse` still gate on an
9701. 9701 /// approval this surface cannot answer, so they are still reported —
9702. 9702 /// which is correct, and is the second half of the same transcript:
9703. 9703 /// after the MCP denials the model fell back to `webfetch` and was
9704. 9704 /// refused there too. Reachability is per capability, not per turn.
9705. 9705 #[test]
9706. 9706 fn allowing_the_tool_makes_it_reachable_unattended() {
9707. 9707 let dir = workspace("allow = [\"mcp\"]");
9708. 9708 let core = core_for(&dir, false);
9709. 9709
9710. 9710 let standings = core.capability_standings();
9711. 9711 assert_eq!(
9712. 9712 standing_for(&standings, "mcp server `tavily`").reach,
9713. 9713 Reach::Open
9714. 9714 );
9715. 9715 let prompt = core.system_prompt();
9716. 9716 assert!(prompt.contains("\n- tavily\n"));
9717. 9717 assert!(
9718. 9718 !reach::prompt_section(&standings).contains("tavily"),
9719. 9719 "a reachable server must not be listed as unusable"
9720. 9720 );
9721. 9721 // The network tools are a separate capability and still gated.
9722. 9722 assert_eq!(standing_for(&standings, "`webfetch`").reach, Reach::Blocked);
9723. 9723 }
9724. 9724
9725. 9725 /// A deny is unreachable on every surface — no approver can answer a
9726. 9726 /// `Deny`, so an attended surface must report it exactly as bluntly.
9727. 9727 #[test]
9728. 9728 fn a_denied_capability_is_unreachable_even_when_attended() {
9729. 9729 let dir = workspace("deny = [\"-mcp\"]");
9730. 9730 let core = core_for(&dir, true);
9731. 9731
9732. 9732 let standings = core.capability_standings();
9733. 9733 let standing = standing_for(&standings, "mcp server `tavily`");
9734. 9734 assert_eq!(standing.reach, Reach::Blocked);
9735. 9735 assert!(standing.reason.contains("denied by rule"));
9736. 9736 assert!(!core.system_prompt().contains("\n- tavily\n"));
9737. 9737 }
9738. 9738
9739. 9739 /// Uncertainty must degrade to `Gated`, never to `Blocked`. The probe
9740. 9740 /// runs before a tool name exists, so a patterned rule cannot be
9741. 9741 /// evaluated — and hiding a capability that would in fact have worked
9742. 9742 /// is worse than advertising one that gates.
9743. 9743 #[test]
9744. 9744 fn a_patterned_rule_keeps_the_capability_advertised() {
9745. 9745 let dir = workspace("allow = [\"mcp(tavily/tavily_search)\"]");
9746. 9746 let core = core_for(&dir, false);
9747. 9747
9748. 9748 assert_eq!(
9749. 9749 standing_for(&core.capability_standings(), "mcp server `tavily`").reach,
9750. 9750 Reach::Gated
9751. 9751 );
9752. 9752 assert!(core.system_prompt().contains("\n- tavily\n"));
9753. 9753 }
9754. 9754
9755. 9755 /// AGENTS.md invariant 20: a channel overlay is restrictive. Both call
9756. 9756 /// sites used to compile `tools_allow` into blanket `+` allow rules, so
9757. 9757 /// narrowing a chat to one tool handed that chat the tool with its
9758. 9758 /// approval gate removed — an escalation performed by adding a
9759. 9759 /// restriction.
9760. 9760 #[test]
9761. 9761 fn a_narrowing_channel_overlay_never_removes_an_approval_gate() {
9762. 9762 let dir = workspace("");
9763. 9763 let core = core_for(&dir, true);
9764. 9764 let cwd = core.cwd().clone();
9765. 9765
9766. 9766 let baseline = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9767. 9767 assert!(matches!(
9768. 9768 baseline.evaluate(
9769. 9769 "bash",
9770. 9770 &serde_json::json!({"command": "ls"}),
9771. 9771 Mode::WorkspaceWrite,
9772. 9772 &cwd,
9773. 9773 ),
9774. 9774 Decision::Ask { .. }
9775. 9775 ));
9776. 9776
9777. 9777 core.apply_channel_policy(vak_config::ChannelPolicy {
9778. 9778 tools_allow: Some(vec!["bash".into()]),
9779. 9779 mcp_allow: Some(vec!["tavily/tavily_search".into()]),
9780. 9780 ..Default::default()
9781. 9781 });
9782. 9782 let narrowed = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9783. 9783
9784. 9784 for (tool, args) in [
9785. 9785 ("bash", serde_json::json!({"command": "ls"})),
9786. 9786 (
9787. 9787 "mcp",
9788. 9788 serde_json::json!({"action": "call", "server": "tavily", "tool": "tavily_search"}),
9789. 9789 ),
9790. 9790 ] {
9791. 9791 let decision = narrowed.evaluate(tool, &args, Mode::WorkspaceWrite, &cwd);
9792. 9792 assert!(
9793. 9793 !matches!(decision, Decision::Allow),
9794. 9794 "narrowing overlay granted {tool} an unattended Allow: {decision:?}"
9795. 9795 );
9796. 9796 }
9797. 9797 }
9798. 9798
9799. 9799 /// `Some([])` still means "block this category outright".
9800. 9800 #[test]
9801. 9801 fn an_empty_channel_allowlist_still_denies_the_category() {
9802. 9802 let dir = workspace("");
9803. 9803 let core = core_for(&dir, true);
9804. 9804 let cwd = core.cwd().clone();
9805. 9805 core.apply_channel_policy(vak_config::ChannelPolicy {
9806. 9806 tools_allow: Some(Vec::new()),
9807. 9807 mcp_allow: Some(Vec::new()),
9808. 9808 ..Default::default()
9809. 9809 });
9810. 9810 let engine = build_engine_with(core.config(), &core.channel_permission_rules()).unwrap();
9811. 9811 for tool in ["bash", "read", "webfetch", "browse", "mcp"] {
9812. 9812 let decision =
9813. 9813 engine.evaluate(tool, &serde_json::json!({}), Mode::WorkspaceWrite, &cwd);
9814. 9814 assert!(
9815. 9815 matches!(decision, Decision::Deny { .. }),
9816. 9816 "{tool} survived an empty channel allowlist: {decision:?}"
9817. 9817 );
9818. 9818 }
9819. 9819 }
9820. 9820
9821. 9821 /// One blocked MCP server must not take the broker down with it, and a
9822. 9822 /// tool with no reachable use left must not stay in the registry.
9823. 9823 #[test]
9824. 9824 fn only_fully_blocked_tools_are_dropped() {
9825. 9825 let standing = |kind: CapabilityKind, name: &str, reach: Reach| reach::Standing {
9826. 9826 id: capability::CapabilityId::new(kind.clone(), name),
9827. 9827 tool: if kind == CapabilityKind::McpServer {
9828. 9828 "mcp".into()
9829. 9829 } else {
9830. 9830 name.into()
9831. 9831 },
9832. 9832 label: name.into(),
9833. 9833 reach,
9834. 9834 reason: String::new(),
9835. 9835 remedy: String::new(),
9836. 9836 };
9837. 9837 let server = |name: &str, reach| standing(CapabilityKind::McpServer, name, reach);
9838. 9838
9839. 9839 let mixed = vec![
9840. 9840 server("a", Reach::Blocked),
9841. 9841 server("b", Reach::Open),
9842. 9842 standing(CapabilityKind::Tool, "webfetch", Reach::Blocked),
9843. 9843 ];
9844. 9844 assert_eq!(reach::fully_blocked_tools(&mixed), vec!["webfetch"]);
9845. 9845 assert_eq!(reach::blocked_mcp_servers(&mixed), vec!["a"]);
9846. 9846
9847. 9847 let all = vec![server("a", Reach::Blocked), server("b", Reach::Blocked)];
9848. 9848 assert_eq!(reach::fully_blocked_tools(&all), vec!["mcp"]);
9849. 9849 }
9850. 9850
9851. 9851 #[test]
9852. 9852 fn denied_skill_is_blocked_and_dropped_from_descriptors() {
9853. 9853 let dir = workspace("deny = [\"-skill(blocked-skill)\"]");
9854. 9854 let skill_dir = dir.path().join(".vak/skills/blocked-skill");
9855. 9855 std::fs::create_dir_all(&skill_dir).unwrap();
9856. 9856 std::fs::write(
9857. 9857 skill_dir.join("SKILL.md"),
9858. 9858 "---\nname: blocked-skill\ndescription: test blocked skill\n---\nbody",
9859. 9859 )
9860. 9860 .unwrap();
9861. 9861
9862. 9862 let core = core_for(&dir, true);
9863. 9863 let standings = core.capability_standings();
9864. 9864 let standing = standing_for(&standings, "skill `blocked-skill`");
9865. 9865 assert_eq!(standing.reach, Reach::Blocked);
9866. 9866
9867. 9867 let descriptors = core.capability_descriptors();
9868. 9868 assert!(
9869. 9869 !descriptors.iter().any(|d| d.name == "blocked-skill"),
9870. 9870 "blocked skill must not be in admitted capability descriptors"
9871. 9871 );
9872. 9872
9873. 9873 let prompt = core.system_prompt();
9874. 9874 assert!(
9875. 9875 prompt.contains("skill `blocked-skill`"),
9876. 9876 "prompt should report blocked skill in standing section"
9877. 9877 );
9878. 9878 }
9879. 9879
9880. 9880 #[test]
9881. 9881 fn capability_diagnostics_reports_parse_failure_and_prompt_includes_it() {
9882. 9882 let dir = workspace("");
9883. 9883 let bad_skill_dir = dir.path().join(".vak/skills/Bad_Skill");
9884. 9884 std::fs::create_dir_all(&bad_skill_dir).unwrap();
9885. 9885 std::fs::write(
9886. 9886 bad_skill_dir.join("SKILL.md"),
9887. 9887 "---\nname: Bad_Skill\ndescription: bad format\n---\nbody",
9888. 9888 )
9889. 9889 .unwrap();
9890. 9890
9891. 9891 let core = core_for(&dir, true);
9892. 9892 let diags = core.capability_diagnostics();
9893. 9893 let bad_diag = diags.iter().find(|d| d.name == "Bad_Skill");
9894. 9894 assert!(bad_diag.is_some(), "diagnostic must report Bad_Skill");
9895. 9895 assert!(bad_diag.unwrap().reason.contains("lowercase kebab-case"));
9896. 9896
9897. 9897 let prompt = core.system_prompt();
9898. 9898 assert!(prompt.contains("skill `Bad_Skill`"));
9899. 9899 assert!(prompt.contains("Fix: fix the SKILL.md frontmatter"));
9900. 9900 }
9901. 9901
9902. 9902 #[test]
9903. 9903 fn tools_and_commitment_overrides_are_dynamic() {
9904. 9904 let dir = workspace("");
9905. 9905 let core = core_for(&dir, true);
9906. 9906
9907. 9907 // web_fetch and browse default to true
9908. 9908 assert!(core.effective_web_fetch());
9909. 9909 assert!(core.effective_browse());
9910. 9910 assert!(core.tool_names().contains(&"webfetch".to_string()));
9911. 9911 assert!(core.tool_names().contains(&"browse".to_string()));
9912. 9912
9913. 9913 // Apply dynamic tool toggle: disable both
9914. 9914 core.apply_persisted_tools(false, false);
9915. 9915 assert!(!core.effective_web_fetch());
9916. 9916 assert!(!core.effective_browse());
9917. 9917 assert!(!core.tool_names().contains(&"webfetch".to_string()));
9918. 9918 assert!(!core.tool_names().contains(&"browse".to_string()));
9919. 9919
9920. 9920 // Toggle back
9921. 9921 core.apply_persisted_tools(true, true);
9922. 9922 assert!(core.effective_web_fetch());
9923. 9923 assert!(core.effective_browse());
9924. 9924 assert!(core.tool_names().contains(&"webfetch".to_string()));
9925. 9925 assert!(core.tool_names().contains(&"browse".to_string()));
9926. 9926
9927. 9927 // Toggle commitment
9928. 9928 core.apply_persisted_commitment(true);
9929. 9929 assert!(core.effective_commitment());
9930. 9930 assert!(core.tool_names().contains(&"commitments".to_string()));
9931. 9931
9932. 9932 core.apply_persisted_commitment(false);
9933. 9933 assert!(!core.effective_commitment());
9934. 9934 assert!(!core.tool_names().contains(&"commitments".to_string()));
9935. 9935 }
9936. 9936
9937. 9937 #[tokio::test]
9938. 9938 async fn permission_mode_change_cancels_existing_permission_lease() {
9939. 9939 let dir = tempfile::tempdir().unwrap();
9940. 9940 let core = Core::new(dir.path().to_path_buf()).unwrap();
9941. 9941 let lease = core.permission_lease();
9942. 9942 core.set_permission_mode(vak_config::PermissionMode::ReadOnly);
9943. 9943 assert!(lease.is_cancelled());
9944. 9944 assert!(!core.permission_lease().is_cancelled());
9945. 9945 }
9946. 9946}
9947. 9947
9948. 9948/// Every `Core` accessor must terminate while session-scoped overrides are
9949. 9949/// set. `cache_home` once locked `sessions_home_override` and then called
9950. 9950/// `sessions_home()`, which locks the same non-reentrant mutex — the
9951. 9951/// thread wedged forever. It surfaced only in tests, because production
9952. 9952/// leaves the override unset and never entered the branch, and it made
9953. 9953/// `cargo test --workspace` hang rather than fail.
9954. 9954///
9955. 9955/// These run each accessor on a worker thread with a deadline, so a
9956. 9956/// reintroduced deadlock fails the suite instead of hanging it. A test
9957. 9957/// that hangs reports nothing and blocks every gate behind it.
9958. 9958#[cfg(test)]
9959. 9959#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
9960. 9960mod override_deadlock {
9961. 9961 use super::*;
9962. 9962
9963. 9963 /// Run `f` on its own thread, failing if it has not returned in time.
9964. 9964 fn within<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Send + 'static) -> T {
9965. 9965 let (tx, rx) = std::sync::mpsc::channel();
9966. 9966 let handle = std::thread::spawn(move || {
9967. 9967 let out = f();
9968. 9968 // Send may fail if the receiver already gave up; the timeout
9969. 9969 // below is what reports that, so ignore the error here.
9970. 9970 let _ = tx.send(());
9971. 9971 out
9972. 9972 });
9973. 9973 match rx.recv_timeout(std::time::Duration::from_secs(10)) {
9974. 9974 Ok(()) => handle.join().expect("accessor thread panicked"),
9975. 9975 Err(_) => panic!(
9976. 9976 "{label} did not return within 10s — an accessor is deadlocked \
9977. 9977 (a guard held across a call that re-locks the same mutex)"
9978. 9978 ),
9979. 9979 }
9980. 9980 }
9981. 9981
9982. 9982 /// One accessor to exercise, boxed so a heterogeneous set can share
9983. 9983 /// a list.
9984. 9984 type AccessorCheck = Box<dyn FnOnce(Arc<Core>) + Send>;
9985. 9985
9986. 9986 fn core_with_override() -> (tempfile::TempDir, Core) {
9987. 9987 let dir = tempfile::tempdir().unwrap();
9988. 9988 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
9989. 9989 core.set_sessions_home(dir.path().join("home"));
9990. 9990 (dir, core)
9991. 9991 }
9992. 9992
9993. 9993 #[test]
9994. 9994 fn cache_home_returns_while_the_sessions_home_override_is_set() {
9995. 9995 let (dir, core) = core_with_override();
9996. 9996 let expected = dir.path().join("home").join("cache");
9997. 9997 let got = within("cache_home", move || core.cache_home());
9998. 9998 assert_eq!(
9999. 9999 got, expected,
10000. 10000 "an overridden home is a self-contained sandbox"
10001. 10001 );
10002. 10002 }
10003. 10003
10004. 10004 #[test]
10005. 10005 fn cache_home_falls_back_to_the_platform_directory_without_an_override() {
10006. 10006 let dir = tempfile::tempdir().unwrap();
10007. 10007 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
10008. 10008 let got = within("cache_home (no override)", move || core.cache_home());
10009. 10009 assert_eq!(got, vak_config::paths::cache_home());
10010. 10010 }
10011. 10011
10012. 10012 #[test]
10013. 10013 fn every_override_backed_accessor_terminates() {
10014. 10014 // Breadth matters more than depth here: the hazard is the
10015. 10015 // locking idiom, so each accessor that reads an override is
10016. 10016 // exercised with one set.
10017. 10017 let (_dir, core) = core_with_override();
10018. 10018 let core = Arc::new(core);
10019. 10019 core.set_model("m".into());
10020. 10020 core.set_provider("p".into());
10021. 10021 core.set_permission_mode(vak_config::PermissionMode::FullAccess);
10022. 10022 core.set_sandbox_backend(Some("os".into()));
10023. 10023
10024. 10024 let checks: Vec<(&str, AccessorCheck)> = vec![
10025. 10025 (
10026. 10026 "sessions_home",
10027. 10027 Box::new(|c: Arc<Core>| {
10028. 10028 c.sessions_home();
10029. 10029 }),
10030. 10030 ),
10031. 10031 (
10032. 10032 "cache_home",
10033. 10033 Box::new(|c: Arc<Core>| {
10034. 10034 c.cache_home();
10035. 10035 }),
10036. 10036 ),
10037. 10037 (
10038. 10038 "effective_model",
10039. 10039 Box::new(|c: Arc<Core>| {
10040. 10040 c.effective_model();
10041. 10041 }),
10042. 10042 ),
10043. 10043 (
10044. 10044 "effective_provider",
10045. 10045 Box::new(|c: Arc<Core>| {
10046. 10046 c.effective_provider();
10047. 10047 }),
10048. 10048 ),
10049. 10049 (
10050. 10050 "effective_max_turns",
10051. 10051 Box::new(|c: Arc<Core>| {
10052. 10052 c.effective_max_turns();
10053. 10053 }),
10054. 10054 ),
10055. 10055 (
10056. 10056 "effective_theme",
10057. 10057 Box::new(|c: Arc<Core>| {
10058. 10058 c.effective_theme();
10059. 10059 }),
10060. 10060 ),
10061. 10061 (
10062. 10062 "effective_permission_mode",
10063. 10063 Box::new(|c: Arc<Core>| {
10064. 10064 c.effective_permission_mode();
10065. 10065 }),
10066. 10066 ),
10067. 10067 (
10068. 10068 "effective_sandbox_backend",
10069. 10069 Box::new(|c: Arc<Core>| {
10070. 10070 c.effective_sandbox_backend();
10071. 10071 }),
10072. 10072 ),
10073. 10073 ];
10074. 10074 for (label, check) in checks {
10075. 10075 let c = Arc::clone(&core);
10076. 10076 within(label, move || check(c));
10077. 10077 }
10078. 10078 }
10079. 10079}
10080. 10080
10081. 10081#[cfg(test)]
10082. 10082#[allow(clippy::unwrap_used, clippy::expect_used)]
10083. 10083mod route_control_tests {
10084. 10084 use super::*;
10085. 10085
10086. 10086 #[test]
10087. 10087 fn provider_and_model_are_never_observed_as_a_torn_pair() {
10088. 10088 let dir = tempfile::tempdir().unwrap();
10089. 10089 let core = Arc::new(Core::new(dir.path().to_path_buf()).unwrap());
10090. 10090 core.set_route("provider-a".into(), "model-a".into());
10091. 10091 let writer = {
10092. 10092 let core = Arc::clone(&core);
10093. 10093 std::thread::spawn(move || {
10094. 10094 for _ in 0..10_000 {
10095. 10095 core.set_route("provider-b".into(), "model-b".into());
10096. 10096 core.set_route("provider-a".into(), "model-a".into());
10097. 10097 }
10098. 10098 })
10099. 10099 };
10100. 10100 for _ in 0..20_000 {
10101. 10101 let route = core.effective_route();
10102. 10102 assert!(
10103. 10103 (route.provider == "provider-a" && route.model == "model-a")
10104. 10104 || (route.provider == "provider-b" && route.model == "model-b")
10105. 10105 );
10106. 10106 }
10107. 10107 writer.join().unwrap();
10108. 10108 }
10109. 10109
10110. 10110 #[test]
10111. 10111 fn independent_cores_observe_one_persisted_route_change() {
10112. 10112 let dir = tempfile::tempdir().unwrap();
10113. 10113 let first = Core::new(dir.path().to_path_buf()).unwrap();
10114. 10114 let second = Core::new(dir.path().to_path_buf()).unwrap();
10115. 10115 vak_config::persist_project_preferences(
10116. 10116 dir.path(),
10117. 10117 Some("provider-new"),
10118. 10118 Some("model-new"),
10119. 10119 None,
10120. 10120 None,
10121. 10121 None,
10122. 10122 None,
10123. 10123 )
10124. 10124 .unwrap();
10125. 10125 first.refresh_persisted_route().unwrap();
10126. 10126 second.refresh_persisted_route().unwrap();
10127. 10127 assert_eq!(first.effective_provider(), "provider-new");
10128. 10128 assert_eq!(first.effective_model(), "model-new");
10129. 10129 assert_eq!(first.effective_route(), second.effective_route());
10130. 10130 }
10131. 10131
10132. 10132 #[test]
10133. 10133 fn persisted_non_route_preferences_refresh_without_touching_runtime_pins() {
10134. 10134 let dir = tempfile::tempdir().unwrap();
10135. 10135 let core = Core::new(dir.path().to_path_buf()).unwrap();
10136. 10136 vak_config::persist_project_preferences(
10137. 10137 dir.path(),
10138. 10138 None,
10139. 10139 None,
10140. 10140 Some(17),
10141. 10141 None,
10142. 10142 None,
10143. 10143 Some("plain"),
10144. 10144 )
10145. 10145 .unwrap();
10146. 10146 core.refresh_persisted_preferences().unwrap();
10147. 10147 assert_eq!(core.effective_max_turns(), 17);
10148. 10148 assert_eq!(core.effective_theme(), "plain");
10149. 10149
10150. 10150 core.set_max_turns(23);
10151. 10151 vak_config::persist_project_preferences(dir.path(), None, None, Some(31), None, None, None)
10152. 10152 .unwrap();
10153. 10153 core.refresh_persisted_preferences().unwrap();
10154. 10154 assert_eq!(core.effective_max_turns(), 23, "scoped runtime pin wins");
10155. 10155 }
10156. 10156
10157. 10157 #[tokio::test]
10158. 10158 async fn explicit_session_route_does_not_mutate_the_shared_default() {
10159. 10159 let dir = tempfile::tempdir().unwrap();
10160. 10160 let core = Core::new(dir.path().to_path_buf()).unwrap();
10161. 10161 core.set_sessions_home(dir.path().join("home"));
10162. 10162 let default = core.effective_route();
10163. 10163 let session = core
10164. 10164 .start_session_with_route("channel-provider".into(), "channel-model".into())
10165. 10165 .await
10166. 10166 .unwrap();
10167. 10167 let contract = &session.header().unwrap().contract;
10168. 10168 assert_eq!(contract.provider, "channel-provider");
10169. 10169 assert_eq!(contract.model, "channel-model");
10170. 10170 assert_eq!(core.effective_route(), default);
10171. 10171 }
10172. 10172
10173. 10173 #[tokio::test]
10174. 10174 async fn every_new_core_session_gets_local_conversation_admission() {
10175. 10175 let dir = tempfile::tempdir().unwrap();
10176. 10176 let core = Core::new(dir.path().to_path_buf()).unwrap();
10177. 10177 core.set_sessions_home(dir.path().join("home"));
10178. 10178 let session = core.start_session().await.unwrap();
10179. 10179 let header = session.header().unwrap();
10180. 10180 let context = header
10181. 10181 .conversation
10182. 10182 .as_ref()
10183. 10183 .expect("conversation admission");
10184. 10184 assert_eq!(context.conversation_id, header.session_id);
10185. 10185 assert_eq!(context.audience_id, "local");
10186. 10186 assert_eq!(
10187. 10187 context
10188. 10188 .origin
10189. 10189 .as_ref()
10190. 10190 .map(|origin| origin.surface.as_str()),
10191. 10191 Some("local")
10192. 10192 );
10193. 10193 assert_eq!(
10194. 10194 header.agent.as_ref().map(|agent| agent.id.as_str()),
10195. 10195 Some("vak")
10196. 10196 );
10197. 10197 }
10198. 10198}
10199. 10199
10200. 10200#[cfg(test)]
10201. 10201#[allow(clippy::unwrap_used, clippy::expect_used)]
10202. 10202mod spend_gate_persistence_tests {
10203. 10203 // Regression coverage for the FinOps audit fix: `spend_gate_for` used
10204. 10204 // to be `finops::CoreSpendGate::new(..)` called fresh inline on every
10205. 10205 // turn, so `max_run_usd`'s in-memory spend counter reset to zero each
10206. 10206 // message — a multi-turn conversation could blow past the run cap by
10207. 10207 // an arbitrary multiple. `spend_gate_for` now caches one gate per
10208. 10208 // session and reuses it turn over turn.
10209. 10209 use super::Core;
10210. 10210 use std::sync::Arc;
10211. 10211 use vak_agent::{SpendCheck, SpendGate};
10212. 10212 use vak_llm::Usage;
10213. 10213
10214. 10214 fn core_with_run_cap(dir: &std::path::Path, cap: f64) -> Core {
10215. 10215 let core = Core::new(dir.join("cwd")).unwrap();
10216. 10216 core.set_sessions_home(dir.join("home"));
10217. 10217 core.apply_persisted_finops_caps(Some(Some(cap)), None);
10218. 10218 core
10219. 10219 }
10220. 10220
10221. 10221 fn check(session_id: &'static str) -> SpendCheck<'static> {
10222. 10222 SpendCheck {
10223. 10223 model: "claude-sonnet",
10224. 10224 provider: "anthropic",
10225. 10225 session_id,
10226. 10226 est_input_tokens: 1_000_000,
10227. 10227 planned_output_tokens: 100_000,
10228. 10228 }
10229. 10229 }
10230. 10230
10231. 10231 fn usage_1m_in_100k_out() -> Usage {
10232. 10232 Usage {
10233. 10233 input_tokens: 1_000_000,
10234. 10234 output_tokens: 100_000,
10235. 10235 ..Default::default()
10236. 10236 }
10237. 10237 }
10238. 10238
10239. 10239 #[test]
10240. 10240 fn same_session_reuses_one_gate_across_calls() {
10241. 10241 let dir = tempfile::tempdir().unwrap();
10242. 10242 let core = core_with_run_cap(dir.path(), 5.0);
10243. 10243
10244. 10244 let turn1 = core.spend_gate_for("s1");
10245. 10245 let turn2 = core.spend_gate_for("s1");
10246. 10246 assert!(
10247. 10247 Arc::ptr_eq(&turn1, &turn2),
10248. 10248 "the same session must get the SAME gate on its next turn, \
10249. 10249 not a freshly zeroed one"
10250. 10250 );
10251. 10251
10252. 10252 let other_session = core.spend_gate_for("s2");
10253. 10253 assert!(
10254. 10254 !Arc::ptr_eq(&turn1, &other_session),
10255. 10255 "a different session must not share another session's run budget"
10256. 10256 );
10257. 10257 }
10258. 10258
10259. 10259 #[tokio::test]
10260. 10260 async fn run_cap_spend_survives_across_simulated_turns() {
10261. 10261 // sonnet: $3/MTok in, $15/MTok out => 1M in + 100k out = $4.50.
10262. 10262 let dir = tempfile::tempdir().unwrap();
10263. 10263 let core = core_with_run_cap(dir.path(), 5.0);
10264. 10264
10265. 10265 // Turn 1: `run_turn_inner` fetches the session's gate, admits the