Give loopd's tool port approvals, its own clock and plain denials

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)
2026-09-20 17:43:05 -07:00
parent 3ecaef3c8b
commit 1ceaa36b9b
8 changed files with 600 additions and 55 deletions
@@ -1,9 +1,12 @@
-//! Tests for the registry, dispatch, the result cap and the fake tools. Do not edit.
+//! Tests for the registry, dispatch, the denial sentences, the result cap and the fake tools.
+//! Do not edit.

 mod support;

-use loopd::tools::{Dispatch, FakeTools, Registry, ToolPort, cap_result, dispatch};
-use proto::{CallId, SessionId, ToolRequest, ToolResponse};
+use loopd::tools::{
+    Dispatch, FakeTools, Pending, Registry, ToolPort, cap_result, denial_text, dispatch,
+};
+use proto::{CallId, DenyReason, SessionId, ToolRequest, ToolResponse};

 fn req(tool: &str, arguments: &str) -> ToolRequest {
    ToolRequest {
@@ -105,17 +108,151 @@ fn call_tool_unwraps_a_known_non_core_tool_and_nothing_else() {
 #[test]
 fn any_other_tool_goes_to_the_port_as_it_is() {
    let r = Registry::m2b();
-    let want = Dispatch::Port {
-        tool: "clock".to_string(),
-        arguments: "{}".to_string(),
-    };
-    assert_eq!(dispatch(&r, "clock", "{}"), want);
    // Even one the registry does not know: the port (brokerd) decides, not loopd.
    let want = Dispatch::Port {
        tool: "read_file".to_string(),
        arguments: r#"{"path":"/x"}"#.to_string(),
    };
    assert_eq!(dispatch(&r, "read_file", r#"{"path":"/x"}"#), want);
+    let want = Dispatch::Port {
+        tool: "weather".to_string(),
+        arguments: "not json".to_string(),
+    };
+    assert_eq!(dispatch(&r, "weather", "not json"), want);
+}
+
+#[test]
+fn the_clock_is_answered_locally_whatever_its_arguments() {
+    for registry in [Registry::m2b(), Registry::m3a(), Registry::new(vec![])] {
+        for arguments in ["{}", r#"{"zone":"UTC"}"#, "not json", ""] {
+            let before = proto::Timestamp::now();
+            match dispatch(&registry, "clock", arguments) {
+                Dispatch::Local(text) => {
+                    let time = proto::Timestamp::parse(&text)
+                        .unwrap_or_else(|e| panic!("an RFC 3339 time, got {text:?}: {e:?}"));
+                    assert!(time >= before, "{text}");
+                    assert!(text.ends_with('Z'), "UTC: {text}");
+                }
+                other => panic!("{arguments:?}: {other:?}, the clock must not reach the port"),
+            }
+        }
+    }
+}
+
+#[test]
+fn the_m3a_registry_has_the_same_core_and_the_four_broker_tools() {
+    let r = Registry::m3a();
+    assert_eq!(
+        r.core_schemas(),
+        Registry::m2b().core_schemas(),
+        "the tools array is part of the baseline: it must not change"
+    );
+    let names = |q: &str| r.find(q).iter().map(|s| s.name.clone()).collect::<Vec<_>>();
+    assert_eq!(names("file"), ["read_file", "write_file"]);
+    assert_eq!(names("shell"), ["shell"]);
+    assert_eq!(names("fetch"), ["http_fetch"]);
+    assert_eq!(names("https"), ["http_fetch"]);
+    assert!(names("echo").is_empty(), "echo is a test tool only");
+
+    // The argument schemas are section 3's table: exactly these properties, all strings.
+    let table: [(&str, &[&str], &[&str]); 4] = [
+        ("read_file", &["path"], &["path"]),
+        ("write_file", &["content", "path"], &["path", "content"]),
+        ("shell", &["command", "cwd"], &["command"]),
+        ("http_fetch", &["url"], &["url"]),
+    ];
+    for (name, properties, required) in table {
+        let entry = r.get(name).unwrap_or_else(|| panic!("{name} is missing"));
+        assert!(!entry.core, "{name} is found with find_tool, not declared");
+        let p = &entry.schema.parameters;
+        assert_eq!(p["type"], "object", "{name}");
+        let mut got: Vec<&str> = p["properties"]
+            .as_object()
+            .unwrap()
+            .keys()
+            .map(String::as_str)
+            .collect();
+        got.sort_unstable();
+        assert_eq!(got, properties, "{name}: properties");
+        for property in properties {
+            assert_eq!(
+                p["properties"][property]["type"], "string",
+                "{name}.{property}"
+            );
+            assert!(
+                p["properties"][property]["description"].is_string(),
+                "{name}.{property} needs a description"
+            );
+        }
+        assert_eq!(
+            p["required"],
+            serde_json::json!(required),
+            "{name}: required"
+        );
+    }
+
+    // call_tool lets the four through to the port and nothing else.
+    match dispatch(
+        &r,
+        "call_tool",
+        r#"{"name":"shell","arguments":{"command":"ls"}}"#,
+    ) {
+        Dispatch::Port { tool, arguments } => {
+            assert_eq!(tool, "shell");
+            assert_eq!(arguments, r#"{"command":"ls"}"#);
+        }
+        other => panic!("{other:?}"),
+    }
+    assert!(matches!(
+        dispatch(&r, "call_tool", r#"{"name":"echo","arguments":{}}"#),
+        Dispatch::Local(t) if t.contains("No tool named \"echo\"")
+    ));
+}
+
+#[test]
+fn every_deny_reason_has_its_sentence() {
+    let table = [
+        (DenyReason::NoGrant, "Denied: no grant allows this call."),
+        (
+            DenyReason::GrantExpired,
+            "Denied: the grant for this call has expired.",
+        ),
+        (
+            DenyReason::TaintTooHigh,
+            "Denied: this session has seen data too sensitive for this call.",
+        ),
+        (
+            DenyReason::DeniedByGrant,
+            "Denied: a grant forbids this call.",
+        ),
+        (
+            DenyReason::ApprovalRefused,
+            "Denied: the owner refused this call.",
+        ),
+        (
+            DenyReason::ApprovalExpired,
+            "Denied: the approval request expired without an answer.",
+        ),
+        (
+            DenyReason::InvalidArguments,
+            "Denied: the arguments are not valid for this tool.",
+        ),
+        (
+            DenyReason::GrantsInvalid,
+            "Denied: the grant files have an error; the owner has been told.",
+        ),
+        (
+            DenyReason::AuditUnavailable,
+            "Denied: the audit log cannot be written; the owner has been told.",
+        ),
+        (
+            DenyReason::StateUnreadable,
+            "Denied: this session's broker state is damaged; the owner has been told.",
+        ),
+    ];
+    for (reason, want) in table {
+        assert_eq!(denial_text(reason), want, "{reason:?}");
+    }
 }

 #[test]
@@ -134,36 +271,37 @@ fn results_are_cut_on_a_character_boundary_and_marked() {
 }

 #[test]
-fn fake_tools_answer_clock_and_echo_and_record_calls() {
+fn fake_tools_answer_echo_deny_the_rest_and_record_calls() {
    let fake = FakeTools::new();
-    match fake.call(&req("clock", "{}")) {
+    let mut seen = 0;
+    let mut on_pending = |_: &Pending| seen += 1;
+    match fake.call(&req("echo", r#"{"text":"box"}"#), &mut on_pending) {
        ToolResponse::Result {
            content,
            class,
            untrusted,
            truncated,
        } => {
-            assert!(
-                proto::Timestamp::parse(&content).is_ok(),
-                "an RFC 3339 time: {content}"
-            );
+            assert_eq!(content, "box");
            assert_eq!(class, proto::DataClass::Public);
            assert!(!untrusted && !truncated);
        }
        other => panic!("{other:?}"),
    }
-    match fake.call(&req("echo", r#"{"text":"box"}"#)) {
-        ToolResponse::Result { content, .. } => assert_eq!(content, "box"),
-        other => panic!("{other:?}"),
-    }
    assert!(matches!(
-        fake.call(&req("echo", r#"{"tex":"box"}"#)),
+        fake.call(&req("echo", r#"{"tex":"box"}"#), &mut on_pending),
        ToolResponse::Failed { .. }
    ));
-    assert!(matches!(
-        fake.call(&req("weather", "{}")),
-        ToolResponse::Denied { .. }
-    ));
-    assert_eq!(fake.calls().len(), 4);
-    assert_eq!(fake.calls()[1].tool, "echo");
+    for tool in ["weather", "read_file", "clock"] {
+        assert_eq!(
+            fake.call(&req(tool, "{}"), &mut on_pending),
+            ToolResponse::Denied {
+                reason: DenyReason::NoGrant
+            },
+            "{tool}: the clock is loopd's own now, not the port's"
+        );
+    }
+    assert_eq!(seen, 0, "the fake never asks for approval");
+    assert_eq!(fake.calls().len(), 5);
+    assert_eq!(fake.calls()[0].tool, "echo");
 }