@securecoms/agent-bridge 0.26.3 → 0.26.5

package/connectors/hermes/tests/test_adapter_wiring.py

@@ -55,6 +55,12 @@ def _install_gateway_stub():
         message_id: Optional[str] = None
         timestamp: Any = field(default_factory=datetime.now)
         channel_prompt: Optional[str] = None
+        # Real Hermes (gateway/platforms/event.py): free-form per-event
+        # metadata that plugins read with .get().
+        metadata: dict = field(default_factory=dict)
+        # Real Hermes: may this event resolve gateway commands / control
+        # prompts? False keeps untrusted payload text conversational.
+        allow_gateway_control: bool = True
 
     @dataclass
     class SendResult:
@@ -294,6 +300,12 @@ class TestEchoGuardWiring:
 
     @pytest.mark.asyncio
     async def test_other_sender_is_dispatched(self, monkeypatch):
+        # This frame carries no authorization block, so it is a no-tools turn.
+        # It is dispatched only because the tool veto is active, which is the
+        # state register(ctx) leaves a current Hermes in (the adapter is only
+        # ever built by the factory register(ctx) installs, after the veto
+        # hook registration). The veto-inactive case is TestToolGate's.
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
         a, _ = make_adapter(monkeypatch)
         a._bound_identity = "A"
         handled = []
@@ -321,7 +333,9 @@ class TestEchoGuardWiring:
         await a._pump()
 
         assert len(handled) == 1
-        assert handled[0].text == "hi"
+        # No authorization block: an ungranted turn, so its text carries the
+        # command escape (N1).
+        assert handled[0].text == adapter.securecoms_authz.COMMAND_ESCAPE + "hi"
         assert ws.sent == [{"type": "ack", "message_id": "m2"}]
 
 
@@ -336,11 +350,14 @@ class TestVoiceGuidance:
             handled.append(event)
 
         a.set_message_handler(handler)
+        # The owner's turns (granted tools), so no no-tools note joins the
+        # prompt; TestToolGate covers a voice turn without tools.
         frames = [
             {"type": "message", "sender_id": "B", "channel_id": "c", "text": "what's the weather?",
-             "message_id": "v1", "voice": True, "guidance": "One short spoken sentence."},
+             "message_id": "v1", "voice": True, "guidance": "One short spoken sentence.",
+             "authorization": OWNER_AUTH},
             {"type": "message", "sender_id": "B", "channel_id": "c", "text": "hi",
-             "message_id": "t1", "guidance": "ignored without voice"},
+             "message_id": "t1", "guidance": "ignored without voice", "authorization": OWNER_AUTH},
         ]
         ws = FakeWS([_FakeWSMsg(aiohttp.WSMsgType.TEXT, json.dumps(f)) for f in frames]
                     + [_FakeWSMsg(aiohttp.WSMsgType.CLOSED)])
@@ -353,6 +370,467 @@ class TestVoiceGuidance:
         assert handled[1].channel_prompt is None
 
 
+# ---------------------------------------------------------------------------
+# Tool gate: only the daemon-granted owner turn runs with Hermes tools.
+# ---------------------------------------------------------------------------
+
+_GRANTS = [{"tool": "current_time", "mode": "read"}, {"tool": "web_search", "mode": "read"}]
+OWNER_AUTH = {"version": 1, "audience": "owner_dm", "sender_membership": "active", "tool_grants": _GRANTS}
+
+
+def _no_grant(audience):
+    return {"version": 1, "audience": audience, "sender_membership": "active", "tool_grants": []}
+
+
+_MISSING = object()
+
+# (case id, authorization block or _MISSING, expected sender_role)
+NO_TOOL_SENDERS = [
+    ("room_member", _no_grant("team_room"), "member"),
+    ("other_org_member", _no_grant("partner_room"), "other_org"),
+    ("agent_sender", _no_grant("agent_to_agent"), "agent"),
+    ("missing_authorization", _MISSING, "unknown"),
+]
+
+
+def _frame(message_id, sender, channel, text, authorization=_MISSING, **kw):
+    f = {"type": "message", "sender_id": sender, "channel_id": channel, "text": text, "message_id": message_id}
+    if authorization is not _MISSING:
+        f["authorization"] = authorization
+    f.update(kw)
+    return f
+
+
+async def _pump_frames(a, frames):
+    ws = FakeWS([_FakeWSMsg(aiohttp.WSMsgType.TEXT, json.dumps(f)) for f in frames]
+                + [_FakeWSMsg(aiohttp.WSMsgType.CLOSED)])
+    a._ws = ws
+    await a._pump()
+    return ws
+
+
+def _session_env(platform, chat_id, user_id):
+    values = {"HERMES_SESSION_PLATFORM": platform, "HERMES_SESSION_CHAT_ID": chat_id, "HERMES_SESSION_USER_ID": user_id}
+    return lambda name, default="": values.get(name, default)
+
+
+class _FakeCtx:
+    def __init__(self, with_hook=True, hook_raises=False):
+        self.hooks = []
+        self.platforms = []
+        if with_hook:
+            def register_hook(name, callback):
+                if hook_raises:
+                    raise ValueError("hooks unsupported")
+                self.hooks.append((name, callback))
+
+            self.register_hook = register_hook
+
+    def register_platform(self, **kw):
+        self.platforms.append(kw)
+
+
+def _install_hermes_modules(monkeypatch, *, veto=True, session_env=True, env_values=None,
+                            engaged=True, version="0.12.0"):
+    """Stub hermes_cli(.plugins) (veto support, version) and gateway.session_context.
+    engaged: True/False -> session_context_engaged() returns it; None -> no accessor."""
+    plugins_mod = types.ModuleType("hermes_cli.plugins")
+    if veto:
+        plugins_mod._get_pre_tool_call_directive_details = lambda *a, **k: None
+    cli_mod = types.ModuleType("hermes_cli")
+    if version is not None:
+        cli_mod.__version__ = version
+    monkeypatch.setitem(sys.modules, "hermes_cli", cli_mod)
+    monkeypatch.setitem(sys.modules, "hermes_cli.plugins", plugins_mod)
+    if session_env:
+        ctx_mod = types.ModuleType("gateway.session_context")
+        values = dict(env_values or {})
+        ctx_mod.get_session_env = lambda name, default="": values.get(name, default)
+        if engaged is not None:
+            ctx_mod.session_context_engaged = lambda: engaged
+        monkeypatch.setitem(sys.modules, "gateway.session_context", ctx_mod)
+        return values
+    monkeypatch.delitem(sys.modules, "gateway.session_context", raising=False)
+    return None
+
+
+@pytest.fixture
+def fresh_gate(monkeypatch):
+    """Each test starts with an empty ledger and the veto state register()
+    would leave; tests that need it set _TOOL_VETO_ACTIVE explicitly."""
+    monkeypatch.setattr(adapter, "_TURN_AUTHZ", adapter.securecoms_authz.TurnAuthzLedger())
+    monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", False)
+    monkeypatch.setattr(adapter, "_GET_SESSION_ENV", None)
+    monkeypatch.setattr(adapter, "_SESSION_ENGAGED", None)
+    monkeypatch.setattr(adapter, "_IS_CRON", None)
+    monkeypatch.setattr(adapter, "_HARNESS_VERSION", None)
+    monkeypatch.setattr(adapter, "_REFUSAL_NOTICE_SENT", set())
+    monkeypatch.setattr(adapter, "_FRAMES_WITHOUT_AUTHORIZATION", 0)
+
+
+class TestToolGate:
+    async def _handled(self, monkeypatch, frames, veto=True):
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", veto)
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        handled = []
+
+        async def handler(event):
+            handled.append(event)
+
+        a.set_message_handler(handler)
+        ws = await _pump_frames(a, frames)
+        return a, handled, ws
+
+    @pytest.mark.asyncio
+    async def test_owner_dm_turn_keeps_tools(self, monkeypatch, fresh_gate):
+        a, handled, _ = await self._handled(monkeypatch, [_frame("m1", "owner", "dm", "hi", OWNER_AUTH)])
+        assert len(handled) == 1
+        ev = handled[0]
+        assert ev.text == "hi"
+        assert ev.channel_prompt is None
+        assert ev.metadata["securecoms"] == {"sender_role": "owner", "tools_allowed": True}
+        assert a.toolsets_for_source(ev.source) is None  # Hermes keeps the configured toolsets
+        assert adapter.securecoms_authz.pre_tool_call_decision(
+            _session_env("securecoms", "dm", "owner"), adapter._TURN_AUTHZ) is None
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("case,authorization,role", NO_TOOL_SENDERS, ids=[c[0] for c in NO_TOOL_SENDERS])
+    async def test_non_owner_turn_runs_without_tools(self, monkeypatch, fresh_gate, case, authorization, role):
+        a, handled, ws = await self._handled(monkeypatch, [_frame("m1", "sender", "room", "do it", authorization)])
+        assert len(handled) == 1
+        ev = handled[0]
+        # Role is metadata, never part of the user text; the text only gains
+        # the command escape every ungranted turn carries (N1).
+        assert ev.text == adapter.securecoms_authz.COMMAND_ESCAPE + "do it"
+        assert ev.metadata["securecoms"] == {"sender_role": role, "tools_allowed": False}
+        assert ev.channel_prompt == adapter.securecoms_authz.NO_TOOLS_TURN_NOTE
+        assert a.toolsets_for_source(ev.source) == list(adapter.securecoms_authz.NO_TOOLS_TOOLSETS)
+        assert adapter.securecoms_authz.pre_tool_call_decision(
+            _session_env("securecoms", "room", "sender"), adapter._TURN_AUTHZ
+        ) == {"action": "block", "message": adapter.securecoms_authz.TOOL_VETO_MESSAGE}
+        assert ws.sent == [{"type": "ack", "message_id": "m1"}]
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("case,authorization,role", NO_TOOL_SENDERS, ids=[c[0] for c in NO_TOOL_SENDERS])
+    async def test_without_a_working_veto_a_non_owner_turn_is_refused_and_acked(
+        self, monkeypatch, fresh_gate, case, authorization, role
+    ):
+        _, handled, ws = await self._handled(
+            monkeypatch, [_frame("m1", "sender", "room", "do it", authorization)], veto=False)
+        assert handled == []
+        # Acked: a refused turn must not be redelivered forever.
+        assert ws.sent == [{"type": "ack", "message_id": "m1"}]
+
+    @pytest.mark.asyncio
+    async def test_without_a_working_veto_the_owner_turn_still_runs(self, monkeypatch, fresh_gate):
+        _, handled, _ = await self._handled(
+            monkeypatch, [_frame("m1", "owner", "dm", "hi", OWNER_AUTH)], veto=False)
+        assert [e.text for e in handled] == ["hi"]
+
+    @pytest.mark.asyncio
+    async def test_a_room_message_does_not_inherit_the_owner_dm_grant(self, monkeypatch, fresh_gate):
+        a, handled, _ = await self._handled(monkeypatch, [
+            _frame("m1", "owner", "dm", "hi", OWNER_AUTH),
+            _frame("m2", "owner", "room", "in the room", _no_grant("team_room")),
+        ])
+        assert [e.metadata["securecoms"]["tools_allowed"] for e in handled] == [True, False]
+        assert a.toolsets_for_source(handled[0].source) is None
+        assert a.toolsets_for_source(handled[1].source) == list(adapter.securecoms_authz.NO_TOOLS_TOOLSETS)
+
+    @pytest.mark.asyncio
+    async def test_voice_turn_without_tools_carries_guidance_and_the_note(self, monkeypatch, fresh_gate):
+        _, handled, _ = await self._handled(monkeypatch, [_frame(
+            "v1", "sender", "room", "weather?", _no_grant("team_room"), voice=True, guidance="Be brief.")])
+        assert handled[0].channel_prompt == (
+            adapter.VOICE_TURN_PREFIX + "Be brief.\n\n" + adapter.securecoms_authz.NO_TOOLS_TURN_NOTE)
+
+    def test_toolsets_for_an_unknown_source_is_no_tools(self, monkeypatch, fresh_gate):
+        a, _ = make_adapter(monkeypatch)
+        src = types.SimpleNamespace(chat_id="dm", user_id="owner")
+        assert a.toolsets_for_source(src) == list(adapter.securecoms_authz.NO_TOOLS_TOOLSETS)
+        assert a.toolsets_for_source(None) == list(adapter.securecoms_authz.NO_TOOLS_TOOLSETS)
+
+
+class TestToolVetoRegistration:
+    def test_register_installs_the_veto_and_activates_it(self, monkeypatch, fresh_gate):
+        env = _install_hermes_modules(monkeypatch)
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        assert [name for name, _ in ctx.hooks] == ["pre_tool_call"]
+        assert adapter._TOOL_VETO_ACTIVE is True
+        assert len(ctx.platforms) == 1
+        # The registered callback reads the CURRENT turn's session and blocks
+        # a SecureComs turn that was not granted tools.
+        callback = ctx.hooks[0][1]
+        env.update(HERMES_SESSION_PLATFORM="securecoms", HERMES_SESSION_CHAT_ID="room", HERMES_SESSION_USER_ID="m")
+        adapter._TURN_AUTHZ.record("room", "m", False)
+        assert callback(tool_name="terminal", args={}, task_id="t")["action"] == "block"
+        adapter._TURN_AUTHZ.record("room", "m", True)
+        assert callback(tool_name="terminal", args={}, task_id="t") is None
+
+    def test_no_register_hook_leaves_the_veto_inactive(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch)
+        adapter.register(_FakeCtx(with_hook=False))
+        assert adapter._TOOL_VETO_ACTIVE is False
+
+    def test_register_hook_that_raises_leaves_the_veto_inactive(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch)
+        adapter.register(_FakeCtx(hook_raises=True))
+        assert adapter._TOOL_VETO_ACTIVE is False
+
+    def test_hermes_without_block_directives_leaves_the_veto_inactive(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch, veto=False)
+        adapter.register(_FakeCtx())
+        assert adapter._TOOL_VETO_ACTIVE is False
+
+    def test_hermes_without_task_local_session_context_leaves_the_veto_inactive(self, monkeypatch, fresh_gate):
+        # Without gateway.session_context the session vars are process-global
+        # os.environ, which a concurrent turn can overwrite: not attributable.
+        _install_hermes_modules(monkeypatch, session_env=False)
+        adapter.register(_FakeCtx())
+        assert adapter._TOOL_VETO_ACTIVE is False
+
+    def test_callback_that_cannot_read_the_session_blocks(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch)
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+
+        def boom(name, default=""):
+            raise RuntimeError("no session")
+
+        monkeypatch.setattr(adapter, "_GET_SESSION_ENV", boom)
+        assert ctx.hooks[0][1](tool_name="terminal")["action"] == "block"
+
+    def test_callback_without_a_session_reader_blocks(self, monkeypatch, fresh_gate):
+        adapter._TURN_AUTHZ.record("dm", "owner", True)
+        assert adapter._GET_SESSION_ENV is None
+        assert adapter._securecoms_pre_tool_call(tool_name="terminal")["action"] == "block"
+
+
+class TestEmptyTurnIdentity:
+    def test_register_binds_the_engaged_reader_and_an_empty_identity_blocks(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch, engaged=True)
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        assert ctx.hooks[0][1](tool_name="terminal")["action"] == "block"
+
+    def test_a_process_with_no_bound_sessions_is_left_alone(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch, engaged=False)
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        assert ctx.hooks[0][1](tool_name="terminal") is None
+
+    def test_without_an_engaged_accessor_the_gateway_is_assumed_engaged(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch, engaged=None)
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        assert adapter._TOOL_VETO_ACTIVE is True
+        assert ctx.hooks[0][1](tool_name="terminal")["action"] == "block"
+
+
+class TestRegistrationPrerequisites:
+    def test_hermes_without_allow_gateway_control_leaves_the_veto_inactive(self, monkeypatch, fresh_gate):
+        # N1: without MessageEvent.allow_gateway_control an ungranted turn
+        # could still drive gateway commands, so such a Hermes is not trusted.
+        @dataclass
+        class OldMessageEvent:
+            text: str
+            message_type: Any = None
+            source: Any = None
+            message_id: Optional[str] = None
+            timestamp: Any = field(default_factory=datetime.now)
+
+        monkeypatch.setattr(adapter, "MessageEvent", OldMessageEvent)
+        _install_hermes_modules(monkeypatch)
+        adapter.register(_FakeCtx())
+        assert adapter._TOOL_VETO_ACTIVE is False
+
+    def test_cron_is_read_from_the_context_var_never_the_environment(self, monkeypatch, fresh_gate):
+        # N2: HERMES_CRON_SESSION in os.environ with the ContextVar empty is
+        # NOT a cron turn: an empty identity still blocks.
+        import contextvars
+
+        _install_hermes_modules(monkeypatch)
+        cron_var = contextvars.ContextVar("HERMES_CRON_SESSION", default=object())
+        sys.modules["gateway.session_context"]._CRON_SESSION = cron_var
+        monkeypatch.setenv("HERMES_CRON_SESSION", "1")
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        hook = ctx.hooks[0][1]
+        assert hook(tool_name="terminal")["action"] == "block"
+        token = cron_var.set("1")
+        try:
+            assert hook(tool_name="terminal") is None
+        finally:
+            cron_var.reset(token)
+        assert hook(tool_name="terminal")["action"] == "block"
+
+    def test_without_the_cron_context_var_nothing_is_exempt(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch)
+        monkeypatch.setenv("HERMES_CRON_SESSION", "1")
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        assert ctx.hooks[0][1](tool_name="terminal")["action"] == "block"
+
+
+class _SendRecorder:
+    def __init__(self):
+        self.sent = []
+
+    async def __call__(self, chat_id, content, reply_to=None, metadata=None):
+        self.sent.append((chat_id, content, reply_to))
+        return types.SimpleNamespace(success=True)
+
+
+class TestRolloutSignals:
+    @pytest.mark.asyncio
+    async def test_hello_reports_harness_and_active_veto(self, monkeypatch, fresh_gate):
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
+        monkeypatch.setattr(adapter, "_HARNESS_VERSION", "0.12.0")
+        a, _ = make_adapter(monkeypatch)
+        a._ws = FakeWS()
+        await a._send_hello()
+        assert a._ws.sent == [{"type": "hello", "harness": {"name": "hermes", "version": "0.12.0", "tool_veto": "active"}}]
+
+    @pytest.mark.asyncio
+    async def test_hello_reports_inactive_veto(self, monkeypatch, fresh_gate):
+        a, _ = make_adapter(monkeypatch)
+        a._ws = FakeWS()
+        await a._send_hello()
+        assert a._ws.sent == [{"type": "hello", "harness": {"name": "hermes", "version": None, "tool_veto": "inactive"}}]
+
+    @pytest.mark.asyncio
+    async def test_a_successful_connect_sends_the_hello(self, monkeypatch, fresh_gate):
+        files = {BINDING_PATH: binding("A"), CONNECTIONS_DIR + "/A.json": conn_file(identity_id="A"), "/tok/A": "token-A"}
+        a, _ = make_adapter(monkeypatch, files=files)
+        a._bound_identity = "A"
+        ws = FakeWS()
+        session = FakeSession(healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "A"}}, ws=ws)
+        monkeypatch.setattr(adapter, "_new_client_session", lambda: session)
+        assert await a._open_ws() is True
+        assert ws.sent[0]["type"] == "hello"
+        assert ws.sent[0]["harness"]["tool_veto"] == "inactive"
+
+    def test_register_records_the_hermes_version(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch, version="0.12.0")
+        adapter.register(_FakeCtx())
+        assert adapter._HARNESS_VERSION == "0.12.0"
+
+    @pytest.mark.asyncio
+    async def test_a_refused_turn_gets_one_room_notice_per_channel(self, monkeypatch, fresh_gate):
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        rec = _SendRecorder()
+        monkeypatch.setattr(a, "send", rec)
+        a.set_message_handler(lambda e: None)
+        await _pump_frames(a, [
+            _frame("m1", "member", "room", "hi", _no_grant("team_room")),
+            _frame("m2", "member", "room", "hi again", _no_grant("team_room")),
+            _frame("m3", "other", "room-2", "hello", _no_grant("partner_room")),
+        ])
+        assert rec.sent == [
+            ("room", adapter.securecoms_authz.REFUSED_TURN_NOTICE, None),
+            ("room-2", adapter.securecoms_authz.REFUSED_TURN_NOTICE, None),
+        ]
+
+    @pytest.mark.asyncio
+    async def test_a_refused_agent_turn_gets_no_notice(self, monkeypatch, fresh_gate):
+        # Two agents whose vetoes are both inactive would otherwise answer
+        # each other's notices.
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        rec = _SendRecorder()
+        monkeypatch.setattr(a, "send", rec)
+        a.set_message_handler(lambda e: None)
+        await _pump_frames(a, [_frame("m1", "agent-b", "room", "hi", _no_grant("agent_to_agent"))])
+        assert rec.sent == []
+
+    @pytest.mark.asyncio
+    async def test_with_an_active_veto_no_notice_is_sent(self, monkeypatch, fresh_gate):
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        rec = _SendRecorder()
+        monkeypatch.setattr(a, "send", rec)
+        handled = []
+
+        async def handler(e):
+            handled.append(e)
+
+        a.set_message_handler(handler)
+        await _pump_frames(a, [_frame("m1", "member", "room", "hi", _no_grant("team_room"))])
+        assert rec.sent == []
+        assert len(handled) == 1
+
+    @pytest.mark.asyncio
+    async def test_frames_without_an_authorization_block_warn(self, monkeypatch, fresh_gate, caplog):
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+
+        async def handler(e):
+            pass
+
+        a.set_message_handler(handler)
+        with caplog.at_level("WARNING"):
+            await _pump_frames(a, [_frame("m1", "s", "c", "x"), _frame("m2", "s", "c", "y", OWNER_AUTH)])
+        hits = [r for r in caplog.records if "NO authorization block" in r.getMessage()]
+        assert len(hits) == 1
+
+
+class TestGatewayCommandsFromUngrantedSenders:
+    @pytest.mark.asyncio
+    async def test_an_ungranted_slash_message_cannot_drive_gateway_commands(self, monkeypatch, fresh_gate):
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        handled = []
+
+        async def handler(e):
+            handled.append(e)
+
+        a.set_message_handler(handler)
+        await _pump_frames(a, [_frame("m1", "member", "room", "  /model gpt-x", _no_grant("team_room"))])
+        ev = handled[0]
+        assert ev.allow_gateway_control is False
+        assert not ev.text.lstrip().startswith("/")
+        assert ev.text == "\u2060  /model gpt-x"
+
+    @pytest.mark.asyncio
+    async def test_the_owner_keeps_gateway_commands(self, monkeypatch, fresh_gate):
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        handled = []
+
+        async def handler(e):
+            handled.append(e)
+
+        a.set_message_handler(handler)
+        await _pump_frames(a, [_frame("m1", "owner", "dm", "/reset", OWNER_AUTH)])
+        assert handled[0].text == "/reset"
+        assert handled[0].allow_gateway_control is True
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("text", ["a/b", "@url:x /reset", "@file:/tmp/a /model gpt-x", "hello"])
+    async def test_every_ungranted_text_is_escaped(self, monkeypatch, fresh_gate, text):
+        # N1: Hermes strips leading @url:/@file: refs before its "/" check, so
+        # escaping only slash-leading text is not enough: every ungranted
+        # text starts with the escape, which no ref pattern or lstrip removes.
+        monkeypatch.setattr(adapter, "_TOOL_VETO_ACTIVE", True)
+        a, _ = make_adapter(monkeypatch)
+        a._bound_identity = "A"
+        handled = []
+
+        async def handler(e):
+            handled.append(e)
+
+        a.set_message_handler(handler)
+        await _pump_frames(a, [_frame("m1", "member", "room", text, _no_grant("team_room"))])
+        assert handled[0].text == "\u2060" + text
+        assert handled[0].allow_gateway_control is False
+
+
 # ---------------------------------------------------------------------------
 # (2) send() success fires the status manager's on_reply_posted
 # ---------------------------------------------------------------------------