@fusionkit/adapter-ai-sdk 0.1.0

package/dist/test/mlx-env.test.js

@@ -0,0 +1,351 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, test } from "node:test";
+import { mlxServer } from "../managed-server.js";
+import { MLX_LM_STRUCTURED_PIN, MlxCapabilityError, MlxEnv } from "../mlx-env.js";
+/**
+ * Exercises real environment ownership without MLX or macOS: the package
+ * spec, import name, and install step are injectable, so these tests
+ * provision a genuine venv into a temp dir and "install" a stub module
+ * directly into its site-packages — the full own-the-env chain (venv
+ * creation, import verification, manifest, repair, destroy) minus the
+ * network-dependent pip download.
+ */
+const pythonAvailable = spawnSync("python3", ["-c", "import ensurepip"], { encoding: "utf8" })
+    .status === 0;
+const skip = pythonAvailable
+    ? false
+    : "python3 with venv support is not available on this host";
+const uvAvailable = spawnSync("uv", ["--version"], { encoding: "utf8" }).status === 0;
+const skipUv = uvAvailable ? false : "uv is not available on this host";
+const tempDirs = [];
+function tempDir() {
+    const dir = mkdtempSync(join(tmpdir(), "warrant-mlxenv-"));
+    tempDirs.push(dir);
+    return dir;
+}
+after(() => {
+    for (const dir of tempDirs)
+        rmSync(dir, { recursive: true, force: true });
+});
+/**
+ * Write stub modules into the venv's site-packages. Dotted names create
+ * package directories (e.g. "mlx_lm.structured.integration" becomes
+ * mlx_lm/structured/integration.py with __init__.py files along the way).
+ */
+function stubInstaller(counter, moduleNames = ["warrant_stub"]) {
+    return (venvPython, packageSpec, extraPackageSpecs) => {
+        counter.installs++;
+        counter.specs?.push([packageSpec, ...extraPackageSpecs]);
+        const purelib = spawnSync(venvPython, ["-c", "import sysconfig; print(sysconfig.get_paths()['purelib'])"], { encoding: "utf8" }).stdout.trim();
+        for (const name of moduleNames) {
+            const parts = name.split(".");
+            let dir = purelib;
+            for (const pkg of parts.slice(0, -1)) {
+                dir = join(dir, pkg);
+                mkdirSync(dir, { recursive: true });
+                writeFileSync(join(dir, "__init__.py"), "");
+            }
+            writeFileSync(join(dir, `${parts[parts.length - 1]}.py`), "VALUE = 1\n");
+        }
+    };
+}
+test("provisions an owned venv, writes the manifest, and is idempotent", { skip }, async () => {
+    const dir = tempDir();
+    const counter = { installs: 0 };
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller(counter)
+    });
+    assert.equal(env.verify(), false, "nothing provisioned yet");
+    const manifest = await env.ensureProvisioned();
+    assert.equal(counter.installs, 1);
+    assert.equal(manifest.packageSpec, "warrant-stub==1.0.0");
+    assert.equal(manifest.interpreterPath, env.venvPython);
+    assert.ok(existsSync(env.venvPython), "venv interpreter exists");
+    assert.ok(existsSync(env.manifestPath), "manifest written");
+    assert.equal(env.verify(), true);
+    // Re-provisioning with a matching manifest is a no-op.
+    const again = await env.ensureProvisioned();
+    assert.equal(counter.installs, 1, "no second install");
+    assert.equal(again.createdAt, manifest.createdAt);
+    const info = env.info();
+    assert.equal(info.provisioned, true);
+    assert.ok(info.diskBytes > 0, "owned dir has a measurable footprint");
+});
+test("a pin change re-provisions the env in place", { skip }, async () => {
+    const dir = tempDir();
+    const counter = { installs: 0 };
+    const v1 = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller(counter)
+    });
+    await v1.ensureProvisioned();
+    assert.equal(counter.installs, 1);
+    const v2 = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==2.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller(counter)
+    });
+    assert.equal(v2.verify(), false, "old manifest does not satisfy the new pin");
+    const manifest = await v2.ensureProvisioned();
+    assert.equal(counter.installs, 2, "pin bump rebuilt the env");
+    assert.equal(manifest.packageSpec, "warrant-stub==2.0.0");
+    assert.equal(v2.verify(), true);
+});
+test("prepare() spawns from the owned env with contained caches", { skip }, async () => {
+    const dir = tempDir();
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller({ installs: 0 })
+    });
+    const spec = await env.prepare("mlx-community/test-model", 12345, ["--max-tokens", "64"]);
+    assert.equal(spec.cmd, env.venvPython, "always the venv interpreter, never PATH");
+    assert.deepEqual(spec.args.slice(0, 3), ["-m", "mlx_lm", "server"]);
+    assert.ok(spec.args.includes("mlx-community/test-model"));
+    assert.ok(spec.args.includes("12345"));
+    assert.ok(spec.args.includes("--max-tokens"));
+    assert.equal(spec.env.HF_HOME, env.hfCacheDir, "model cache lives in the owned dir");
+    assert.ok(spec.env.HF_HOME.startsWith(dir));
+    assert.ok(spec.logFile?.startsWith(dir), "server logs live in the owned dir");
+});
+test("extra package specs are installed, recorded, and verified", { skip }, async () => {
+    const dir = tempDir();
+    const counter = { installs: 0, specs: [] };
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        extraPackageSpecs: ["outlines-core==0.0.0", "/path/to/overlay"],
+        importName: "warrant_stub",
+        extraImportNames: ["warrant_overlay_stub"],
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller(counter, ["warrant_stub", "warrant_overlay_stub"])
+    });
+    const manifest = await env.ensureProvisioned();
+    assert.deepEqual(counter.specs, [
+        ["warrant-stub==1.0.0", "outlines-core==0.0.0", "/path/to/overlay"]
+    ]);
+    assert.deepEqual(manifest.extraPackageSpecs, [
+        "outlines-core==0.0.0",
+        "/path/to/overlay"
+    ]);
+    assert.equal(env.verify(), true);
+    // Changing the extras invalidates the env: the next ensureProvisioned
+    // rebuilds it.
+    const changed = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        extraPackageSpecs: ["outlines-core==9.9.9", "/path/to/overlay"],
+        importName: "warrant_stub",
+        extraImportNames: ["warrant_overlay_stub"],
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller(counter, ["warrant_stub", "warrant_overlay_stub"])
+    });
+    assert.equal(changed.verify(), false, "extras drift fails verification");
+    await changed.ensureProvisioned();
+    assert.equal(counter.installs, 2, "extras drift re-provisioned");
+    assert.equal(changed.verify(), true);
+});
+test("a missing extra import fails verification", { skip }, async () => {
+    const dir = tempDir();
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        extraPackageSpecs: ["/path/to/overlay"],
+        importName: "warrant_stub",
+        extraImportNames: ["warrant_overlay_stub"],
+        requirePlatform: false,
+        uv: false,
+        // Installs only the primary stub: the overlay import must fail.
+        install: stubInstaller({ installs: 0 }, ["warrant_stub"])
+    });
+    await assert.rejects(() => env.ensureProvisioned(), /cannot import "warrant_stub, warrant_overlay_stub"/);
+    assert.equal(env.verify(), false);
+});
+test("a manifest without extras does not satisfy options with extras", { skip }, async () => {
+    const dir = tempDir();
+    const plain = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller({ installs: 0 })
+    });
+    await plain.ensureProvisioned();
+    assert.equal(plain.verify(), true);
+    const withExtras = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        extraPackageSpecs: ["/path/to/overlay"],
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller({ installs: 0 })
+    });
+    assert.equal(withExtras.verify(), false);
+});
+test("prepare() spawns an overridden server module when configured", { skip }, async () => {
+    const dir = tempDir();
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        serverModule: "my_custom.server",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller({ installs: 0 })
+    });
+    const spec = await env.prepare("mlx-community/test-model", 12345);
+    assert.deepEqual(spec.args.slice(0, 2), ["-m", "my_custom.server"]);
+    assert.ok(!spec.args.includes("server"), "no stray stock subcommand");
+    assert.ok(spec.args.includes("mlx-community/test-model"));
+});
+test("destroy() removes the entire owned footprint", { skip }, async () => {
+    const dir = tempDir();
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: false,
+        install: stubInstaller({ installs: 0 })
+    });
+    await env.ensureProvisioned();
+    assert.equal(env.verify(), true);
+    env.destroy();
+    assert.equal(existsSync(dir), false, "env, manifest, caches, and logs are gone");
+    assert.equal(env.verify(), false);
+});
+test("mlxServer with structured provisions the self-contained fork", { skip }, async () => {
+    const dir = tempDir();
+    const counter = { installs: 0, specs: [] };
+    const server = mlxServer({
+        model: "mlx-community/test-model",
+        structured: true,
+        env: {
+            dir,
+            requirePlatform: false,
+            uv: false,
+            install: stubInstaller(counter, ["mlx_lm", "mlx_lm.structured.integration"])
+        }
+    });
+    // Drive the env directly (starting the real server needs a model).
+    const spec = await server.env.prepare("mlx-community/test-model", 12345);
+    assert.equal(counter.installs, 1);
+    assert.deepEqual(counter.specs[0], [MLX_LM_STRUCTURED_PIN], "the fork with its [structured] extra is the only spec");
+    // The fork keeps the stock entry point; the hooks activate because the
+    // structured extra's dependencies import, not via a different module.
+    assert.deepEqual(spec.args.slice(0, 3), ["-m", "mlx_lm", "server"]);
+    assert.equal(server.env.verify(), true);
+});
+test("structured verification requires the structured subpackage import", { skip }, async () => {
+    const env = mlxServer({
+        model: "mlx-community/test-model",
+        structured: true,
+        env: {
+            dir: tempDir(),
+            requirePlatform: false,
+            uv: false,
+            // Installs mlx_lm without the structured subpackage: must fail.
+            install: stubInstaller({ installs: 0 }, ["mlx_lm"])
+        }
+    }).env;
+    await assert.rejects(() => env.ensureProvisioned(), /cannot import "mlx_lm, mlx_lm\.structured\.integration"/);
+});
+test("explicit env options win over structured defaults", { skip }, async () => {
+    const counter = { installs: 0, specs: [] };
+    const server = mlxServer({
+        model: "mlx-community/test-model",
+        structured: true,
+        env: {
+            dir: tempDir(),
+            packageSpec: "mlx-lm[structured] @ git+https://example.invalid/fork@my-rev",
+            requirePlatform: false,
+            uv: false,
+            install: stubInstaller(counter, ["mlx_lm", "mlx_lm.structured.integration"])
+        }
+    });
+    await server.env.prepare("mlx-community/test-model", 12345);
+    assert.equal(counter.specs[0]?.[0], "mlx-lm[structured] @ git+https://example.invalid/fork@my-rev");
+});
+test("mlxServer without structured keeps the stock entry point", { skip }, async () => {
+    const server = mlxServer({
+        model: "mlx-community/test-model",
+        env: {
+            dir: tempDir(),
+            packageSpec: "warrant-stub==1.0.0",
+            importName: "warrant_stub",
+            requirePlatform: false,
+            uv: false,
+            install: stubInstaller({ installs: 0 })
+        }
+    });
+    const spec = await server.env.prepare("mlx-community/test-model", 12345);
+    assert.deepEqual(spec.args.slice(0, 3), ["-m", "mlx_lm", "server"]);
+});
+test("structured cannot be combined with a pre-built MlxEnv", () => {
+    const env = new MlxEnv({ dir: tempDir(), requirePlatform: false });
+    assert.throws(() => mlxServer({ model: "m", env, structured: true }), /configure extraPackageSpecs/);
+});
+test("a missing interpreter is a clear capability error", { skip }, async () => {
+    const env = new MlxEnv({
+        dir: tempDir(),
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        python: "/definitely/not/a/python"
+    });
+    await assert.rejects(() => env.ensureProvisioned(), (error) => error instanceof MlxCapabilityError && /no usable Python/.test(error.message));
+});
+test("the platform gate refuses non-Apple-Silicon hosts", { skip: process.platform === "darwin" && process.arch === "arm64" }, async () => {
+    const env = new MlxEnv({ dir: tempDir() });
+    await assert.rejects(() => env.ensureProvisioned(), (error) => error instanceof MlxCapabilityError &&
+        /macOS on Apple Silicon/.test(error.message));
+});
+test("provisions with uv when it is available", { skip: skipUv }, async () => {
+    const dir = tempDir();
+    const counter = { installs: 0 };
+    const env = new MlxEnv({
+        dir,
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        install: stubInstaller(counter)
+    });
+    const manifest = await env.ensureProvisioned();
+    assert.match(manifest.toolchain, /^uv /, "uv was preferred over venv+pip");
+    assert.equal(counter.installs, 1);
+    assert.equal(env.verify(), true);
+    assert.ok(existsSync(env.venvPython), "uv-built venv interpreter exists");
+});
+test("an explicitly requested uv that cannot run is an error, not a fallback", async () => {
+    const env = new MlxEnv({
+        dir: tempDir(),
+        packageSpec: "warrant-stub==1.0.0",
+        importName: "warrant_stub",
+        requirePlatform: false,
+        uv: "/definitely/not/a/uv"
+    });
+    await assert.rejects(() => env.ensureProvisioned(), (error) => error instanceof MlxCapabilityError && /not runnable/.test(error.message));
+});

package/dist/test/model.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/model.test.js

@@ -0,0 +1,110 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { generateText } from "ai";
+import { MockLanguageModelV3 } from "ai/test";
+import { handoff, localFirst, targets, triggers } from "@fusionkit/handoff";
+import { handoffModel, withModel } from "../model.js";
+const usage = {
+    inputTokens: {
+        total: 1,
+        noCache: 1,
+        cacheRead: undefined,
+        cacheWrite: undefined
+    },
+    outputTokens: { total: 1, text: 1, reasoning: undefined }
+};
+function textModel(id, text) {
+    return new MockLanguageModelV3({
+        modelId: id,
+        doGenerate: async () => ({
+            content: [{ type: "text", text }],
+            finishReason: { unified: "stop", raw: "stop" },
+            usage,
+            warnings: []
+        })
+    });
+}
+function failingModel(id, message) {
+    return new MockLanguageModelV3({
+        modelId: id,
+        doGenerate: async () => {
+            throw new Error(message);
+        }
+    });
+}
+test("local-first: healthy local model handles the call", async () => {
+    const decisions = [];
+    const model = handoffModel({
+        local: textModel("tiny-local", "answer from local"),
+        cloud: textModel("frontier-cloud", "answer from cloud"),
+        onDecision: (d) => decisions.push(d)
+    });
+    const result = await generateText({ model, prompt: "hello" });
+    assert.equal(result.text, "answer from local");
+    assert.deepEqual(decisions, [
+        {
+            model: "tiny-local",
+            route: "local",
+            escalated: false,
+            reason: "local-first policy"
+        }
+    ]);
+});
+test("escalates on local failure, classifies overflow, and stays sticky", async () => {
+    const decisions = [];
+    const model = handoffModel({
+        local: failingModel("tiny-local", "prompt exceeds maximum context length"),
+        cloud: textModel("frontier-cloud", "cloud handled it"),
+        onDecision: (d) => decisions.push(d)
+    });
+    const first = await generateText({ model, prompt: "long prompt" });
+    assert.equal(first.text, "cloud handled it");
+    const escalation = decisions.find((d) => d.escalated);
+    assert.ok(escalation);
+    assert.equal(escalation.route, "cloud");
+    assert.match(escalation.reason, /context-overflow/);
+    // Sticky: the next call goes straight to cloud without touching local.
+    const second = await generateText({ model, prompt: "another" });
+    assert.equal(second.text, "cloud handled it");
+    const last = decisions.at(-1);
+    assert.ok(last);
+    assert.equal(last.route, "cloud");
+    assert.equal(last.escalated, false);
+    assert.match(last.reason, /sticky/);
+});
+test("prompt-size threshold escalates before trying local", async () => {
+    const decisions = [];
+    const model = handoffModel({
+        local: failingModel("tiny-local", "should never be called"),
+        cloud: textModel("frontier-cloud", "cloud handled the big prompt"),
+        maxLocalPromptBytes: 8,
+        onDecision: (d) => decisions.push(d)
+    });
+    const result = await generateText({
+        model,
+        prompt: "a prompt comfortably larger than eight bytes"
+    });
+    assert.equal(result.text, "cloud handled the big prompt");
+    const decision = decisions[0];
+    assert.ok(decision);
+    assert.equal(decision.escalated, true);
+    assert.match(decision.reason, /over the local threshold/);
+});
+test("withModel records routing in the trace and gates needs()", async () => {
+    const h = withModel(handoff({
+        workspace: ".",
+        plane: { url: "http://127.0.0.1:9", adminToken: "unused" },
+        policy: localFirst({ continueWhen: [triggers.modelEscalated()] })
+    }), {
+        local: failingModel("tiny-local", "boom"),
+        cloud: textModel("frontier-cloud", "recovered in cloud")
+    });
+    assert.equal(h.needs(targets.pool("eng-prod")), false, "nothing escalated yet");
+    const result = await generateText({ model: h.model, prompt: "do the thing" });
+    assert.equal(result.text, "recovered in cloud");
+    const routed = h.trace().filter((event) => event.type === "model.routed");
+    assert.ok(routed.some((event) => event.type === "model.routed" && event.escalated));
+    assert.equal(h.needs(targets.pool("eng-prod")), true, "the escalation makes continuation needed");
+    const summary = await h.summary();
+    assert.equal(summary.modelRoutes.escalations, 1);
+});

package/dist/test/remote-tools.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/remote-tools.test.js

@@ -0,0 +1,151 @@
+import assert from "node:assert/strict";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { after, before, test } from "node:test";
+import { generateText, stepCountIs } from "ai";
+import { MockLanguageModelV3 } from "ai/test";
+import { localFirst } from "@fusionkit/handoff";
+import { PolicyDeniedError } from "@fusionkit/protocol";
+import { makeRepo, startStack } from "@fusionkit/testkit";
+import { remoteTools } from "../remote-tools.js";
+const POOL = "eng-prod";
+let stack;
+let repoDir;
+const usage = {
+    inputTokens: {
+        total: 1,
+        noCache: 1,
+        cacheRead: undefined,
+        cacheWrite: undefined
+    },
+    outputTokens: { total: 1, text: 1, reasoning: undefined }
+};
+before(async () => {
+    stack = await startStack({
+        pool: POOL,
+        startRunner: true,
+        policy: (policy) => {
+            policy.agents.allow = ["command"];
+        }
+    });
+    repoDir = makeRepo({
+        files: { "README.md": "# app-owned loop fixture\n", "data.txt": "alpha beta gamma\n" }
+    });
+});
+after(async () => {
+    await stack.stop();
+    rmSync(repoDir, { recursive: true, force: true });
+});
+test("generateText executes tool calls in governed sessions and pulls results", async () => {
+    const rt = remoteTools({
+        workspace: repoDir,
+        plane: { url: stack.planeUrl, adminToken: stack.adminToken },
+        pool: POOL,
+        actor: { kind: "human", id: "loop-owner" }
+    });
+    const command = "wc -w < data.txt > word-count.txt && echo governed-session-output && cat word-count.txt";
+    // A scripted two-step model: first request a shell tool call, then close
+    // out with text once the (governed) tool result is in the conversation.
+    let modelCalls = 0;
+    const model = new MockLanguageModelV3({
+        doGenerate: async () => {
+            modelCalls++;
+            if (modelCalls === 1) {
+                return {
+                    content: [
+                        {
+                            type: "tool-call",
+                            toolCallId: "call-1",
+                            toolName: "shell",
+                            input: JSON.stringify({ command })
+                        }
+                    ],
+                    finishReason: { unified: "tool-calls", raw: "tool-calls" },
+                    usage,
+                    warnings: []
+                };
+            }
+            return {
+                content: [{ type: "text", text: "the word count is recorded" }],
+                finishReason: { unified: "stop", raw: "stop" },
+                usage,
+                warnings: []
+            };
+        }
+    });
+    const result = await generateText({
+        model,
+        tools: rt.tools,
+        prompt: "count the words in data.txt inside the governed sandbox",
+        stopWhen: stepCountIs(2)
+    });
+    // The loop stayed app-owned: the mock model drove two steps.
+    assert.equal(result.text, "the word count is recorded");
+    // The tool call executed remotely, with evidence.
+    const calls = rt.calls();
+    assert.equal(calls.length, 1);
+    const call = calls[0];
+    assert.ok(call);
+    assert.equal(call.toolName, "shell");
+    assert.equal(call.command, command);
+    assert.equal(call.status, "completed");
+    assert.equal(call.exitCode, 0);
+    assert.equal(call.receiptVerified, true, "receipt must verify offline");
+    assert.equal(call.pullMode, "applied");
+    assert.match(call.contractHash, /^[0-9a-f]{64}$/);
+    // The tool result the model saw came from the governed session log.
+    const toolResult = result.steps
+        .flatMap((step) => step.toolResults)
+        .find((r) => r.toolName === "shell");
+    assert.ok(toolResult);
+    const output = toolResult.output;
+    assert.ok(output.output.includes("governed-session-output"));
+    assert.equal(output.exitCode, 0);
+    // The session's workspace output was pulled back into the local repo.
+    assert.ok(existsSync(join(repoDir, "word-count.txt")));
+    assert.equal(readFileSync(join(repoDir, "word-count.txt"), "utf8").trim(), "3");
+    // The continuation trace explains the boundary crossing.
+    const types = rt.context.trace().map((event) => event.type);
+    assert.ok(types.includes("envelope.created"));
+    assert.ok(types.includes("results.pulled"));
+});
+test("tool execution fails closed when continuation policy denies the pool", async () => {
+    const rt = remoteTools({
+        workspace: repoDir,
+        plane: { url: stack.planeUrl, adminToken: stack.adminToken },
+        pool: POOL,
+        policy: localFirst({ denyPools: [POOL] })
+    });
+    const execute = rt.tools.shell.execute;
+    assert.ok(execute);
+    await assert.rejects(() => Promise.resolve(execute({ command: "echo should-not-run" }, { toolCallId: "call-x", messages: [] })), (error) => {
+        assert.ok(error instanceof PolicyDeniedError);
+        return true;
+    });
+    assert.equal(rt.calls().length, 0, "denied calls must not produce records");
+});
+test("org policy denies the command harness when not allowlisted", async () => {
+    const restricted = await startStack({
+        pool: "locked-pool",
+        policy: (policy) => {
+            policy.agents.allow = ["mock"];
+        }
+    });
+    try {
+        const rt = remoteTools({
+            workspace: repoDir,
+            plane: { url: restricted.planeUrl, adminToken: restricted.adminToken },
+            pool: "locked-pool"
+        });
+        const execute = rt.tools.shell.execute;
+        assert.ok(execute);
+        await assert.rejects(() => Promise.resolve(execute({ command: "echo nope" }, { toolCallId: "call-y", messages: [] })), (error) => {
+            assert.ok(error instanceof Error);
+            assert.match(error.message, /not allowed/);
+            return true;
+        });
+    }
+    finally {
+        await restricted.stop();
+    }
+});

package/dist/test/routed-model.test.d.ts

@@ -0,0 +1 @@
+export {};