ceos/opencode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(core): enforce V2 tool permissions (#31061)

Browse source
This commit is contained in:
Kit Langton 2026-06-06 08:00:24 -04:00 • committed by GitHub
commit 4814ab3a3d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 180 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

27
packages/core/test/application-tools.test.ts
View file

@ -37,6 +37,26 @@ const contextual = (contexts: Tool.Context[]) =>
})
describe("ApplicationTools", () => {
it.effect("filters an application tool by its name without adding execution authorization", () =>
Effect.gen(function* () {
const applications = yield* ApplicationTools.Service
const registry = yield* ToolRegistry.Service
const contexts: Tool.Context[] = []
yield* applications.attach({ application_context: contextual(contexts) })
expect(yield* registry.definitions([{ action: "application_context", resource: "*", effect: "deny" }])).toEqual(
[],
)
expect(
yield* registry.settle({
sessionID,
call: { type: "tool-call", id: "call-denied", name: "application_context", input: { query: "hello" } },
}),
).toMatchObject({ result: { type: "content" } })
expect(contexts).toEqual([{ sessionID, id: "call-denied", name: "application_context" }])
}),
)
it.effect("advertises and executes a scoped application tool with Session context", () =>
Effect.gen(function* () {
const applications = yield* ApplicationTools.Service
@ -169,13 +189,18 @@ describe("ApplicationTools", () => {
yield* transform((editor) =>
editor.set("shared", {
tool: location.definition,
permission: { action: "question", resource: "*" },
execute: ({ parameters, sessionID, call }) =>
location.execute(parameters, { sessionID, id: call.id, name: call.name }),
}),
)
yield* applications.attach({ shared: contextual(applicationContexts) })
expect((yield* registry.definitions()).map((definition) => definition.name)).toEqual(["shared"])
expect(
(yield* registry.definitions([{ action: "question", resource: "*", effect: "deny" }])).map(
(definition) => definition.name,
),
).toEqual([])
expect(
yield* registry.settle({
sessionID,