@open-mercato/ai-assistant 0.10.1-develop.7776.1.3032ea0741 → 0.10.1-develop.7781.1.079f42c863

package/dist/modules/ai_assistant/api/tools/execute/route.js

@@ -2,14 +2,20 @@ import { createLogger } from "@open-mercato/shared/lib/logger";
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { executeTool } from "../../../lib/tool-executor.js";
 import { loadAllModuleTools } from "../../../lib/tool-loader.js";
+import { getToolRegistry } from "../../../lib/tool-registry.js";
 const logger = createLogger("ai_assistant");
 const openApi = {
   tag: "AI Assistant",
   summary: "Execute AI tool",
   methods: {
-    POST: { summary: "Execute a specific MCP tool by name" }
+    POST: {
+      summary: "Execute a specific read-only MCP tool by name",
+      description: "Mutation tools must use the agent chat or run-object dispatcher and its mutation approval policy.",
+      errors: [{ status: 403, description: "Mutation tools cannot execute directly, or caller lacks tool permissions." }]
+    }
   }
 };
 const metadata = {
@@ -33,6 +39,14 @@ async function POST(req) {
       organizationId: auth.orgId
     });
     await loadAllModuleTools();
+    const tool = getToolRegistry().getTool(toolName);
+    if (tool?.isMutation === true) {
+      const { t } = await resolveTranslations();
+      return NextResponse.json(
+        { success: false, error: t("ai_assistant.errors.directMutationDenied") },
+        { status: 403 }
+      );
+    }
     const toolContext = {
       tenantId: auth.tenantId,
       organizationId: auth.orgId,

package/dist/modules/ai_assistant/api/tools/execute/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/ai_assistant/api/tools/execute/route.ts"],
-  "sourcesContent": ["import { createLogger } from '@open-mercato/shared/lib/logger'\nimport { NextResponse, type NextRequest } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { executeTool } from '../../../lib/tool-executor'\nimport { loadAllModuleTools } from '../../../lib/tool-loader'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { McpToolContext } from '../../../lib/types'\n\nconst logger = createLogger('ai_assistant')\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'AI Assistant',\n  summary: 'Execute AI tool',\n  methods: {\n    POST: { summary: 'Execute a specific MCP tool by name' },\n  },\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },\n}\n\nexport async function POST(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  try {\n    const body = await req.json()\n    const { toolName, args = {} } = body\n\n    if (!toolName || typeof toolName !== 'string') {\n      return NextResponse.json({ error: 'toolName is required' }, { status: 400 })\n    }\n\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n\n    // Load ACL for user\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n\n    // Ensure tools are loaded\n    await loadAllModuleTools()\n\n    // Build tool context\n    const toolContext: McpToolContext = {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      container,\n      userFeatures: acl.features,\n      isSuperAdmin: acl.isSuperAdmin,\n    }\n\n    // Execute the tool\n    const result = await executeTool(toolName, args, toolContext)\n\n    if (!result.success) {\n      return NextResponse.json(\n        { success: false, error: result.error },\n        { status: result.errorCode === 'UNAUTHORIZED' ? 403 : 400 }\n      )\n    }\n\n    return NextResponse.json({\n      success: true,\n      result: result.result,\n    })\n  } catch (error) {\n    logger.error('AI Tools \u2014 Error executing tool', { err: error })\n    return NextResponse.json(\n      { success: false, error: 'Tool execution failed' },\n      { status: 500 }\n    )\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,oBAAsC;AAE/C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AAInC,MAAM,SAAS,aAAa,cAAc;AAEnC,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM,EAAE,SAAS,sCAAsC;AAAA,EACzD;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAkB;AAC3C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AAEzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,EAAE,UAAU,OAAO,CAAC,EAAE,IAAI;AAEhC,QAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7E;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAGhE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAGD,UAAM,mBAAmB;AAGzB,UAAM,cAA8B;AAAA,MAClC,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA,IACpB;AAGA,UAAM,SAAS,MAAM,YAAY,UAAU,MAAM,WAAW;AAE5D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,SAAS,OAAO,OAAO,OAAO,MAAM;AAAA,QACtC,EAAE,QAAQ,OAAO,cAAc,iBAAiB,MAAM,IAAI;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,wCAAmC,EAAE,KAAK,MAAM,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createLogger } from '@open-mercato/shared/lib/logger'\nimport { NextResponse, type NextRequest } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { executeTool } from '../../../lib/tool-executor'\nimport { loadAllModuleTools } from '../../../lib/tool-loader'\nimport { getToolRegistry } from '../../../lib/tool-registry'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { AiToolDefinition, McpToolContext } from '../../../lib/types'\n\nconst logger = createLogger('ai_assistant')\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'AI Assistant',\n  summary: 'Execute AI tool',\n  methods: {\n    POST: {\n      summary: 'Execute a specific read-only MCP tool by name',\n      description: 'Mutation tools must use the agent chat or run-object dispatcher and its mutation approval policy.',\n      errors: [{ status: 403, description: 'Mutation tools cannot execute directly, or caller lacks tool permissions.' }],\n    },\n  },\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },\n}\n\nexport async function POST(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  try {\n    const body = await req.json()\n    const { toolName, args = {} } = body\n\n    if (!toolName || typeof toolName !== 'string') {\n      return NextResponse.json({ error: 'toolName is required' }, { status: 400 })\n    }\n\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n\n    // Load ACL for user\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n\n    // Ensure tools are loaded\n    await loadAllModuleTools()\n\n    const tool = getToolRegistry().getTool(toolName) as AiToolDefinition | undefined\n    if (tool?.isMutation === true) {\n      const { t } = await resolveTranslations()\n      return NextResponse.json(\n        { success: false, error: t('ai_assistant.errors.directMutationDenied') },\n        { status: 403 }\n      )\n    }\n\n    // Build tool context\n    const toolContext: McpToolContext = {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      container,\n      userFeatures: acl.features,\n      isSuperAdmin: acl.isSuperAdmin,\n    }\n\n    // Execute the tool\n    const result = await executeTool(toolName, args, toolContext)\n\n    if (!result.success) {\n      return NextResponse.json(\n        { success: false, error: result.error },\n        { status: result.errorCode === 'UNAUTHORIZED' ? 403 : 400 }\n      )\n    }\n\n    return NextResponse.json({\n      success: true,\n      result: result.result,\n    })\n  } catch (error) {\n    logger.error('AI Tools \u2014 Error executing tool', { err: error })\n    return NextResponse.json(\n      { success: false, error: 'Tool execution failed' },\n      { status: 500 }\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,oBAAsC;AAE/C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AACnC,SAAS,uBAAuB;AAIhC,MAAM,SAAS,aAAa,cAAc;AAEnC,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,4EAA4E,CAAC;AAAA,IACpH;AAAA,EACF;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAkB;AAC3C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AAEzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,EAAE,UAAU,OAAO,CAAC,EAAE,IAAI;AAEhC,QAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7E;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAGhE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAGD,UAAM,mBAAmB;AAEzB,UAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ;AAC/C,QAAI,MAAM,eAAe,MAAM;AAC7B,YAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,aAAO,aAAa;AAAA,QAClB,EAAE,SAAS,OAAO,OAAO,EAAE,0CAA0C,EAAE;AAAA,QACvE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAA8B;AAAA,MAClC,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA,IACpB;AAGA,UAAM,SAAS,MAAM,YAAY,UAAU,MAAM,WAAW;AAE5D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,SAAS,OAAO,OAAO,OAAO,MAAM;AAAA,QACtC,EAAE,QAAQ,OAAO,cAAc,iBAAiB,MAAM,IAAI;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,wCAAmC,EAAE,KAAK,MAAM,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/ai_assistant/i18n/de.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Links andocken",
   "ai_assistant.dock.minimize": "Minimieren",
   "ai_assistant.dock.right": "Rechts andocken",
+  "ai_assistant.errors.directMutationDenied": "Änderungswerkzeuge können nicht direkt ausgeführt werden. Verwenden Sie einen Agenten-Chat oder eine run-object-Anfrage mit der Richtlinie zur Genehmigung von Änderungen.",
   "ai_assistant.errors.moderationBlocked": "Ihre Nachricht wurde vom Inhaltssicherheitsfilter blockiert. Bitte formulieren Sie sie um und versuchen Sie es erneut.",
   "ai_assistant.errors.moderationUnavailable": "Die Inhaltssicherheitsprüfung ist vorübergehend nicht verfügbar. Bitte versuchen Sie es in einem Moment erneut.",
   "ai_assistant.errors.pendingAllRecordsStale": "Alle ausstehenden Datensätze sind veraltet; der Assistent muss die Änderung neu vorschlagen.",

package/dist/modules/ai_assistant/i18n/en.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Dock Left",
   "ai_assistant.dock.minimize": "Minimize",
   "ai_assistant.dock.right": "Dock Right",
+  "ai_assistant.errors.directMutationDenied": "Mutation tools cannot execute directly. Use an agent chat or run-object request with the mutation approval policy.",
   "ai_assistant.errors.moderationBlocked": "Your message was blocked by the content safety filter. Please rephrase and try again.",
   "ai_assistant.errors.moderationUnavailable": "The content safety check is temporarily unavailable. Please try again in a moment.",
   "ai_assistant.errors.pendingAllRecordsStale": "All pending records are stale; the model must re-propose the batch.",

package/dist/modules/ai_assistant/i18n/es.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Anclar a la izquierda",
   "ai_assistant.dock.minimize": "Minimizar",
   "ai_assistant.dock.right": "Anclar a la derecha",
+  "ai_assistant.errors.directMutationDenied": "Las herramientas de modificación no pueden ejecutarse directamente. Use un chat de agente o una solicitud run-object con la política de aprobación de modificaciones.",
   "ai_assistant.errors.moderationBlocked": "Tu mensaje fue bloqueado por el filtro de seguridad de contenido. Reformúlalo e inténtalo de nuevo.",
   "ai_assistant.errors.moderationUnavailable": "La verificación de seguridad de contenido no está disponible temporalmente. Inténtalo de nuevo en un momento.",
   "ai_assistant.errors.pendingAllRecordsStale": "Todos los registros pendientes están desactualizados; el asistente debe volver a proponer el cambio.",

package/dist/modules/ai_assistant/i18n/ko.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "왼쪽 독",
   "ai_assistant.dock.minimize": "최소화",
   "ai_assistant.dock.right": "오른쪽 독",
+  "ai_assistant.errors.directMutationDenied": "변경 도구는 직접 실행할 수 없습니다. 변경 승인 정책이 적용되는 에이전트 채팅 또는 run-object 요청을 사용하세요.",
   "ai_assistant.errors.moderationBlocked": "귀하의 메시지가 콘텐츠 안전 필터에 의해 차단되었습니다. 문구를 바꾸고 다시 시도해 주세요.",
   "ai_assistant.errors.moderationUnavailable": "콘텐츠 안전 확인을 일시적으로 사용할 수 없습니다. 잠시 후 다시 시도해 주세요.",
   "ai_assistant.errors.pendingAllRecordsStale": "대기 중인 모든 레코드가 오래되었습니다. 어시스턴트가 변경을 다시 제안해야 합니다.",

package/dist/modules/ai_assistant/i18n/pl.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Dokuj po lewej",
   "ai_assistant.dock.minimize": "Minimalizuj",
   "ai_assistant.dock.right": "Dokuj po prawej",
+  "ai_assistant.errors.directMutationDenied": "Narzędzia modyfikujące dane nie mogą być uruchamiane bezpośrednio. Użyj czatu agenta lub żądania run-object z zasadami zatwierdzania zmian.",
   "ai_assistant.errors.moderationBlocked": "Twoja wiadomość została zablokowana przez filtr bezpieczeństwa treści. Przeformułuj ją i spróbuj ponownie.",
   "ai_assistant.errors.moderationUnavailable": "Sprawdzanie bezpieczeństwa treści jest chwilowo niedostępne. Spróbuj ponownie za chwilę.",
   "ai_assistant.errors.pendingAllRecordsStale": "Wszystkie rekordy oczekującej akcji są nieaktualne; asystent musi ponownie zaproponować zmianę.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/ai-assistant",
-  "version": "0.10.1-develop.7776.1.3032ea0741",
+  "version": "0.10.1-develop.7781.1.079f42c863",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -100,16 +100,16 @@
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7776.1.3032ea0741",
-    "@open-mercato/ui": "0.10.1-develop.7776.1.3032ea0741",
+    "@open-mercato/shared": "0.10.1-develop.7781.1.079f42c863",
+    "@open-mercato/ui": "0.10.1-develop.7781.1.079f42c863",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "zod": ">=3.23.0"
   },
   "devDependencies": {
-    "@open-mercato/cli": "0.10.1-develop.7776.1.3032ea0741",
-    "@open-mercato/shared": "0.10.1-develop.7776.1.3032ea0741",
-    "@open-mercato/ui": "0.10.1-develop.7776.1.3032ea0741",
+    "@open-mercato/cli": "0.10.1-develop.7781.1.079f42c863",
+    "@open-mercato/shared": "0.10.1-develop.7781.1.079f42c863",
+    "@open-mercato/ui": "0.10.1-develop.7781.1.079f42c863",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.5",
     "react": "19.2.8",

package/src/modules/ai_assistant/api/tools/execute/__tests__/route.test.ts

@@ -0,0 +1,169 @@
+import { NextRequest } from 'next/server'
+import { z } from 'zod'
+import { registerMcpTool, toolRegistry } from '../../../../lib/tool-registry'
+import type { AiToolDefinition } from '../../../../lib/types'
+import enTranslations from '../../../../i18n/en.json'
+import { POST, metadata } from '../route'
+
+const authMock = jest.fn()
+const loadAclMock = jest.fn()
+const resolveMock = jest.fn()
+const loadAllModuleToolsMock = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/auth/server', () => ({
+  getAuthFromRequest: (...args: unknown[]) => authMock(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: async () => ({ resolve: resolveMock }),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: async () => ({
+    t: (key: string) => (enTranslations as Record<string, string>)[key] ?? key,
+  }),
+}))
+
+jest.mock('../../../../lib/tool-loader', () => ({
+  loadAllModuleTools: (...args: unknown[]) => loadAllModuleToolsMock(...args),
+}))
+
+function request(body: Record<string, unknown>): NextRequest {
+  return new NextRequest('http://localhost/api/ai_assistant/tools/execute', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+}
+
+function registerTool(isMutation?: boolean) {
+  const handler = jest.fn(async () => ({ recordId: 'record-1' }))
+  const tool: AiToolDefinition = {
+    name: 'test.direct_execution',
+    description: 'Direct execution regression fixture',
+    inputSchema: z.object({ title: z.string() }),
+    requiredFeatures: ['test.records.manage'],
+    ...(isMutation === undefined ? {} : { isMutation }),
+    handler,
+  }
+  registerMcpTool(tool, { moduleId: 'test' })
+  return handler
+}
+
+describe('POST /api/ai_assistant/tools/execute approval boundary', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    toolRegistry.clear()
+    authMock.mockResolvedValue({ sub: 'user-1', tenantId: 'tenant-1', orgId: 'org-1' })
+    loadAclMock.mockResolvedValue({ features: ['test.records.manage'], isSuperAdmin: false })
+    resolveMock.mockReturnValue({ loadAcl: loadAclMock })
+    loadAllModuleToolsMock.mockResolvedValue(undefined)
+  })
+
+  afterEach(() => toolRegistry.clear())
+
+  it.each([false, true])('refuses mutations before their handler runs (superadmin=%s)', async (isSuperAdmin) => {
+    const handler = registerTool(true)
+    loadAclMock.mockResolvedValue({ features: ['test.records.manage'], isSuperAdmin })
+
+    const response = await POST(request({ toolName: 'test.direct_execution', args: { title: 'Changed' } }))
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(response.status).toBe(403)
+    expect(await response.json()).toEqual({
+      success: false,
+      error: enTranslations['ai_assistant.errors.directMutationDenied'],
+    })
+  })
+
+  it('ignores client-supplied approval and agent policy claims', async () => {
+    const handler = registerTool(true)
+
+    const response = await POST(request({
+      toolName: 'test.direct_execution',
+      args: { title: 'Changed', approved: true },
+      approved: true,
+      pendingActionId: 'forged-action',
+      agent: 'test.assistant',
+      mutationPolicy: 'destructive-confirm-required',
+    }))
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(response.status).toBe(403)
+  })
+
+  it('checks the registry populated by tool loading', async () => {
+    const handler = jest.fn(async () => ({ written: true }))
+    loadAllModuleToolsMock.mockImplementationOnce(async () => {
+      const tool: AiToolDefinition = {
+        name: 'test.loaded_mutation',
+        description: 'Loaded mutation fixture',
+        inputSchema: z.object({}),
+        isMutation: true,
+        handler,
+      }
+      registerMcpTool(tool, { moduleId: 'test' })
+    })
+
+    const response = await POST(request({ toolName: 'test.loaded_mutation' }))
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(response.status).toBe(403)
+  })
+
+  it.each([false, undefined])('executes read tools and preserves the scoped context (isMutation=%s)', async (isMutation) => {
+    const handler = registerTool(isMutation)
+
+    const response = await POST(request({ toolName: 'test.direct_execution', args: { title: 'Read' } }))
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ success: true, result: { recordId: 'record-1' } })
+    expect(handler).toHaveBeenCalledWith({ title: 'Read' }, expect.objectContaining({
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+      userId: 'user-1',
+      userFeatures: ['test.records.manage'],
+      isSuperAdmin: false,
+    }))
+    expect(loadAclMock).toHaveBeenCalledWith('user-1', { tenantId: 'tenant-1', organizationId: 'org-1' })
+  })
+
+  it('keeps tool ACL checks on read execution', async () => {
+    const handler = registerTool(false)
+    loadAclMock.mockResolvedValue({ features: [], isSuperAdmin: false })
+
+    const response = await POST(request({ toolName: 'test.direct_execution', args: { title: 'Read' } }))
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ success: false, error: expect.stringContaining('Insufficient permissions') })
+  })
+
+  it('keeps tool schema validation on read execution', async () => {
+    const handler = registerTool(false)
+
+    const response = await POST(request({ toolName: 'test.direct_execution', args: { title: 123 } }))
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(response.status).toBe(400)
+  })
+
+  it('keeps unknown-tool errors', async () => {
+    const response = await POST(request({ toolName: 'test.unknown' }))
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ success: false, error: expect.stringContaining('not found') })
+  })
+
+  it('keeps endpoint authentication and declarative feature requirements', async () => {
+    const handler = registerTool(true)
+    authMock.mockResolvedValue(null)
+
+    const response = await POST(request({ toolName: 'test.direct_execution', args: { title: 'Changed' } }))
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(loadAllModuleToolsMock).not.toHaveBeenCalled()
+    expect(response.status).toBe(401)
+    expect(metadata.POST).toEqual({ requireAuth: true, requireFeatures: ['ai_assistant.view'] })
+  })
+})

package/src/modules/ai_assistant/api/tools/execute/route.ts

@@ -3,10 +3,12 @@ import { NextResponse, type NextRequest } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { executeTool } from '../../../lib/tool-executor'
 import { loadAllModuleTools } from '../../../lib/tool-loader'
+import { getToolRegistry } from '../../../lib/tool-registry'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import type { McpToolContext } from '../../../lib/types'
+import type { AiToolDefinition, McpToolContext } from '../../../lib/types'
 
 const logger = createLogger('ai_assistant')
 
@@ -14,7 +16,11 @@ export const openApi: OpenApiRouteDoc = {
   tag: 'AI Assistant',
   summary: 'Execute AI tool',
   methods: {
-    POST: { summary: 'Execute a specific MCP tool by name' },
+    POST: {
+      summary: 'Execute a specific read-only MCP tool by name',
+      description: 'Mutation tools must use the agent chat or run-object dispatcher and its mutation approval policy.',
+      errors: [{ status: 403, description: 'Mutation tools cannot execute directly, or caller lacks tool permissions.' }],
+    },
   },
 }
 
@@ -49,6 +55,15 @@ export async function POST(req: NextRequest) {
     // Ensure tools are loaded
     await loadAllModuleTools()
 
+    const tool = getToolRegistry().getTool(toolName) as AiToolDefinition | undefined
+    if (tool?.isMutation === true) {
+      const { t } = await resolveTranslations()
+      return NextResponse.json(
+        { success: false, error: t('ai_assistant.errors.directMutationDenied') },
+        { status: 403 }
+      )
+    }
+
     // Build tool context
     const toolContext: McpToolContext = {
       tenantId: auth.tenantId,

package/src/modules/ai_assistant/i18n/de.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Links andocken",
   "ai_assistant.dock.minimize": "Minimieren",
   "ai_assistant.dock.right": "Rechts andocken",
+  "ai_assistant.errors.directMutationDenied": "Änderungswerkzeuge können nicht direkt ausgeführt werden. Verwenden Sie einen Agenten-Chat oder eine run-object-Anfrage mit der Richtlinie zur Genehmigung von Änderungen.",
   "ai_assistant.errors.moderationBlocked": "Ihre Nachricht wurde vom Inhaltssicherheitsfilter blockiert. Bitte formulieren Sie sie um und versuchen Sie es erneut.",
   "ai_assistant.errors.moderationUnavailable": "Die Inhaltssicherheitsprüfung ist vorübergehend nicht verfügbar. Bitte versuchen Sie es in einem Moment erneut.",
   "ai_assistant.errors.pendingAllRecordsStale": "Alle ausstehenden Datensätze sind veraltet; der Assistent muss die Änderung neu vorschlagen.",

package/src/modules/ai_assistant/i18n/en.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Dock Left",
   "ai_assistant.dock.minimize": "Minimize",
   "ai_assistant.dock.right": "Dock Right",
+  "ai_assistant.errors.directMutationDenied": "Mutation tools cannot execute directly. Use an agent chat or run-object request with the mutation approval policy.",
   "ai_assistant.errors.moderationBlocked": "Your message was blocked by the content safety filter. Please rephrase and try again.",
   "ai_assistant.errors.moderationUnavailable": "The content safety check is temporarily unavailable. Please try again in a moment.",
   "ai_assistant.errors.pendingAllRecordsStale": "All pending records are stale; the model must re-propose the batch.",

package/src/modules/ai_assistant/i18n/es.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Anclar a la izquierda",
   "ai_assistant.dock.minimize": "Minimizar",
   "ai_assistant.dock.right": "Anclar a la derecha",
+  "ai_assistant.errors.directMutationDenied": "Las herramientas de modificación no pueden ejecutarse directamente. Use un chat de agente o una solicitud run-object con la política de aprobación de modificaciones.",
   "ai_assistant.errors.moderationBlocked": "Tu mensaje fue bloqueado por el filtro de seguridad de contenido. Reformúlalo e inténtalo de nuevo.",
   "ai_assistant.errors.moderationUnavailable": "La verificación de seguridad de contenido no está disponible temporalmente. Inténtalo de nuevo en un momento.",
   "ai_assistant.errors.pendingAllRecordsStale": "Todos los registros pendientes están desactualizados; el asistente debe volver a proponer el cambio.",

package/src/modules/ai_assistant/i18n/ko.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "왼쪽 독",
   "ai_assistant.dock.minimize": "최소화",
   "ai_assistant.dock.right": "오른쪽 독",
+  "ai_assistant.errors.directMutationDenied": "변경 도구는 직접 실행할 수 없습니다. 변경 승인 정책이 적용되는 에이전트 채팅 또는 run-object 요청을 사용하세요.",
   "ai_assistant.errors.moderationBlocked": "귀하의 메시지가 콘텐츠 안전 필터에 의해 차단되었습니다. 문구를 바꾸고 다시 시도해 주세요.",
   "ai_assistant.errors.moderationUnavailable": "콘텐츠 안전 확인을 일시적으로 사용할 수 없습니다. 잠시 후 다시 시도해 주세요.",
   "ai_assistant.errors.pendingAllRecordsStale": "대기 중인 모든 레코드가 오래되었습니다. 어시스턴트가 변경을 다시 제안해야 합니다.",

package/src/modules/ai_assistant/i18n/pl.json

@@ -316,6 +316,7 @@
   "ai_assistant.dock.left": "Dokuj po lewej",
   "ai_assistant.dock.minimize": "Minimalizuj",
   "ai_assistant.dock.right": "Dokuj po prawej",
+  "ai_assistant.errors.directMutationDenied": "Narzędzia modyfikujące dane nie mogą być uruchamiane bezpośrednio. Użyj czatu agenta lub żądania run-object z zasadami zatwierdzania zmian.",
   "ai_assistant.errors.moderationBlocked": "Twoja wiadomość została zablokowana przez filtr bezpieczeństwa treści. Przeformułuj ją i spróbuj ponownie.",
   "ai_assistant.errors.moderationUnavailable": "Sprawdzanie bezpieczeństwa treści jest chwilowo niedostępne. Spróbuj ponownie za chwilę.",
   "ai_assistant.errors.pendingAllRecordsStale": "Wszystkie rekordy oczekującej akcji są nieaktualne; asystent musi ponownie zaproponować zmianę.",

package/src/modules/ai_assistant/lib/__tests__/direct-execution-approval-paths.test.ts

@@ -0,0 +1,124 @@
+import { asValue, createContainer } from 'awilix'
+import { z } from 'zod'
+import type { ToolExecutionOptions } from 'ai'
+import { resolveAiAgentTools } from '../agent-tools'
+import { resetAgentRegistryForTests, seedAgentRegistryForTests } from '../agent-registry'
+import { registerMcpTool, toolRegistry } from '../tool-registry'
+import type { AiToolDefinition } from '../types'
+import type { AiAgentDefinition } from '../ai-agent-definition'
+
+const prepareMutationMock = jest.fn()
+const container = createContainer()
+container.register({ rbacService: asValue({}) })
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: async () => container,
+}))
+
+jest.mock('../tool-loader', () => ({
+  ensureModuleToolsLoaded: async () => undefined,
+}))
+
+jest.mock('../prepare-mutation', () => ({
+  prepareMutation: (...args: unknown[]) => prepareMutationMock(...args),
+}))
+
+const authContext = {
+  tenantId: 'tenant-1',
+  organizationId: 'org-1',
+  userId: 'user-1',
+  features: ['test.records.manage'],
+  isSuperAdmin: false,
+}
+
+const executionOptions: ToolExecutionOptions<unknown> = { toolCallId: 'call-1', messages: [], context: undefined }
+
+function seedAgent(overrides: Partial<AiAgentDefinition> = {}) {
+  const agent: AiAgentDefinition = {
+    id: 'test.assistant',
+    moduleId: 'test',
+    label: 'Test assistant',
+    description: 'Approval path fixture',
+    systemPrompt: 'Test',
+    allowedTools: ['test.mutation'],
+    readOnly: false,
+    mutationPolicy: 'confirm-required',
+    ...overrides,
+  }
+  seedAgentRegistryForTests([agent])
+}
+
+describe('agent approval paths alongside the direct HTTP refusal', () => {
+  let handler: jest.Mock
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    resetAgentRegistryForTests()
+    toolRegistry.clear()
+    handler = jest.fn(async () => ({ written: true }))
+    const tool: AiToolDefinition = {
+      name: 'test.mutation',
+      description: 'Mutation fixture',
+      inputSchema: z.object({ title: z.string() }),
+      isMutation: true,
+      isDestructive: false,
+      requiredFeatures: ['test.records.manage'],
+      handler,
+    }
+    registerMcpTool(tool, { moduleId: 'test' })
+    prepareMutationMock.mockResolvedValue({
+      uiPart: { type: 'mutation-preview-card', data: { pendingActionId: 'action-1' } },
+      pendingAction: { id: 'action-1', expiresAt: new Date('2099-01-01'), status: 'pending' },
+      reused: false,
+    })
+  })
+
+  afterEach(() => {
+    resetAgentRegistryForTests()
+    toolRegistry.clear()
+  })
+
+  it.each(['chat', 'object'] as const)('still stages confirm-required mutations for %s agents', async (requestedExecutionMode) => {
+    seedAgent({ executionMode: requestedExecutionMode })
+    const resolved = await resolveAiAgentTools({
+      agentId: 'test.assistant', authContext, container, requestedExecutionMode,
+    })
+
+    const result = await resolved.tools.test__mutation.execute?.({ title: 'Changed' }, executionOptions)
+
+    expect(handler).not.toHaveBeenCalled()
+    expect(prepareMutationMock).toHaveBeenCalledWith(
+      expect.objectContaining({ toolCallArgs: { title: 'Changed' }, agent: expect.objectContaining({ id: 'test.assistant' }) }),
+      expect.objectContaining({ tenantId: 'tenant-1', organizationId: 'org-1', userId: 'user-1', container }),
+    )
+    expect(result).toEqual(expect.stringContaining('pending-confirmation'))
+    expect(resolved.uiPartQueue.drain()).toEqual([
+      { type: 'mutation-preview-card', data: { pendingActionId: 'action-1' } },
+    ])
+  })
+
+  it('preserves policy-permitted non-destructive writes through the shared executor', async () => {
+    seedAgent({ mutationPolicy: 'destructive-confirm-required' })
+    const resolved = await resolveAiAgentTools({ agentId: 'test.assistant', authContext, container })
+
+    const result = await resolved.tools.test__mutation.execute?.({ title: 'Changed' }, executionOptions)
+
+    expect(prepareMutationMock).not.toHaveBeenCalled()
+    expect(handler).toHaveBeenCalledWith({ title: 'Changed' }, expect.objectContaining({
+      tenantId: 'tenant-1', organizationId: 'org-1', userId: 'user-1',
+    }))
+    expect(result).toEqual(expect.stringContaining('"written": true'))
+  })
+
+  it.each([
+    { mutationPolicyOverride: 'read-only' as const },
+    { authContext: { ...authContext, features: [] } },
+  ])('keeps tenant policy downgrades and tool ACL filtering', async (overrides) => {
+    seedAgent()
+    const resolved = await resolveAiAgentTools({ agentId: 'test.assistant', authContext, container, ...overrides })
+
+    expect(resolved.tools).toEqual({})
+    expect(handler).not.toHaveBeenCalled()
+    expect(prepareMutationMock).not.toHaveBeenCalled()
+  })
+})