@vellumai/assistant 0.3.0

package/src/__tests__/tool-metrics-listener.test.ts

@@ -0,0 +1,225 @@
+import { beforeEach, describe, expect, test } from 'bun:test';
+import { EventBus } from '../events/bus.js';
+import type { AssistantDomainEvents } from '../events/domain-events.js';
+import { registerToolMetricsLoggingListener } from '../events/tool-metrics-listener.js';
+
+let debugEnabled = false;
+const debugCalls: unknown[][] = [];
+const infoCalls: unknown[][] = [];
+const warnCalls: unknown[][] = [];
+const errorCalls: unknown[][] = [];
+
+const testLogger = {
+  debug: (...args: unknown[]) => debugCalls.push(args),
+  info: (...args: unknown[]) => infoCalls.push(args),
+  warn: (...args: unknown[]) => warnCalls.push(args),
+  error: (...args: unknown[]) => errorCalls.push(args),
+};
+
+function truncate(value: string, maxLen: number): string {
+  if (value.length <= maxLen) return value;
+  return value.slice(0, maxLen) + `... (${value.length - maxLen} chars truncated)`;
+}
+
+function clearCalls(): void {
+  debugCalls.length = 0;
+  infoCalls.length = 0;
+  warnCalls.length = 0;
+  errorCalls.length = 0;
+}
+
+describe('registerToolMetricsLoggingListener', () => {
+  beforeEach(() => {
+    debugEnabled = false;
+    clearCalls();
+  });
+
+  test('logs execution start and finish diagnostics in debug mode', async () => {
+    debugEnabled = true;
+    const bus = new EventBus<AssistantDomainEvents>();
+    registerToolMetricsLoggingListener(bus, {
+      logger: testLogger,
+      debugEnabled: () => debugEnabled,
+      truncate,
+    });
+
+    await bus.emit('tool.execution.started', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      input: { path: 'README.md' },
+      startedAtMs: 100,
+    });
+
+    await bus.emit('tool.execution.finished', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      decision: 'allow',
+      riskLevel: 'low',
+      isError: false,
+      durationMs: 12,
+      finishedAtMs: 112,
+    });
+
+    expect(debugCalls).toHaveLength(2);
+    expect(debugCalls[0][1]).toBe('Tool execute start');
+    expect(debugCalls[1][1]).toBe('Tool execute result');
+
+    const startPayload = debugCalls[0][0] as Record<string, unknown>;
+    expect(startPayload.tool).toBe('file_read');
+    expect(startPayload.input as string).toContain('"path":"README.md"');
+
+    const finishPayload = debugCalls[1][0] as Record<string, unknown>;
+    expect(finishPayload.execDurationMs).toBe(12);
+    expect(finishPayload.decision).toBe('allow');
+  });
+
+  test('does not emit debug execution logs when debug mode is disabled', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    registerToolMetricsLoggingListener(bus, {
+      logger: testLogger,
+      debugEnabled: () => debugEnabled,
+      truncate,
+    });
+
+    await bus.emit('tool.execution.started', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      input: { path: 'README.md' },
+      startedAtMs: 100,
+    });
+    await bus.emit('tool.execution.finished', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      decision: 'allow',
+      riskLevel: 'low',
+      isError: false,
+      durationMs: 12,
+      finishedAtMs: 112,
+    });
+
+    expect(debugCalls).toHaveLength(0);
+  });
+
+  test('logs permission request and deny decisions as info', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    registerToolMetricsLoggingListener(bus, {
+      logger: testLogger,
+      debugEnabled: () => debugEnabled,
+      truncate,
+    });
+
+    await bus.emit('tool.permission.requested', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'bash',
+      riskLevel: 'high',
+      requestedAtMs: 120,
+    });
+    await bus.emit('tool.permission.decided', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'bash',
+      decision: 'deny',
+      riskLevel: 'high',
+      decidedAtMs: 125,
+    });
+
+    expect(infoCalls).toHaveLength(2);
+    expect(infoCalls[0][1]).toBe('Tool permission requested');
+    expect(infoCalls[1][1]).toBe('Tool permission denied');
+  });
+
+  test('logs secret detection warnings with aggregate details', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    registerToolMetricsLoggingListener(bus, {
+      logger: testLogger,
+      debugEnabled: () => debugEnabled,
+      truncate,
+    });
+
+    await bus.emit('tool.secret.detected', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      action: 'warn',
+      matches: [
+        { type: 'AWS Access Key', redactedValue: '<redacted type="AWS Access Key" />' },
+        { type: 'GitHub Token', redactedValue: '<redacted type="GitHub Token" />' },
+      ],
+      detectedAtMs: 130,
+    });
+
+    expect(warnCalls).toHaveLength(1);
+    expect(warnCalls[0][1]).toBe('Secrets detected in tool output');
+    const payload = warnCalls[0][0] as Record<string, unknown>;
+    expect(payload.matchCount).toBe(2);
+    expect(payload.types as string[]).toEqual(['AWS Access Key', 'GitHub Token']);
+  });
+
+  test('logs execution failures as errors', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    registerToolMetricsLoggingListener(bus, {
+      logger: testLogger,
+      debugEnabled: () => debugEnabled,
+      truncate,
+    });
+
+    await bus.emit('tool.execution.failed', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'bash',
+      decision: 'error',
+      riskLevel: 'high',
+      durationMs: 42,
+      error: 'boom',
+      isExpected: false,
+      errorName: 'Error',
+      errorStack: 'Error: boom\n    at test',
+      failedAtMs: 142,
+    });
+
+    expect(errorCalls).toHaveLength(1);
+    expect(warnCalls).toHaveLength(0);
+    expect(errorCalls[0][1]).toBe('Tool execution error');
+    const payload = errorCalls[0][0] as Record<string, unknown>;
+    expect(payload.tool).toBe('bash');
+    expect(payload.error).toBe('boom');
+    expect(payload.errorStack).toBe('Error: boom\n    at test');
+    expect(payload.execDurationMs).toBe(42);
+  });
+
+  test('logs expected execution failures as warnings', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    registerToolMetricsLoggingListener(bus, {
+      logger: testLogger,
+      debugEnabled: () => debugEnabled,
+      truncate,
+    });
+
+    await bus.emit('tool.execution.failed', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'bash',
+      decision: 'error',
+      riskLevel: 'medium',
+      durationMs: 14,
+      error: 'Permission denied by user',
+      isExpected: true,
+      errorName: 'PermissionDeniedError',
+      errorStack: 'PermissionDeniedError: Permission denied by user\n    at test',
+      failedAtMs: 201,
+    });
+
+    expect(warnCalls).toHaveLength(1);
+    expect(errorCalls).toHaveLength(0);
+    expect(warnCalls[0][1]).toBe('Tool execution failed (expected)');
+    const payload = warnCalls[0][0] as Record<string, unknown>;
+    expect(payload.tool).toBe('bash');
+    expect(payload.isExpected).toBe(true);
+    expect(payload.errorName).toBe('PermissionDeniedError');
+  });
+});

package/src/__tests__/tool-notification-listener.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from 'bun:test';
+import { EventBus } from '../events/bus.js';
+import type { AssistantDomainEvents } from '../events/domain-events.js';
+import { registerToolNotificationListener } from '../events/tool-notification-listener.js';
+import type { ServerMessage } from '../daemon/ipc-protocol.js';
+
+describe('registerToolNotificationListener', () => {
+  test('forwards tool.secret.detected events to IPC secret_detected messages', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    const messages: ServerMessage[] = [];
+    registerToolNotificationListener(bus, (msg) => messages.push(msg));
+
+    await bus.emit('tool.secret.detected', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      action: 'warn',
+      matches: [{ type: 'AWS Access Key', redactedValue: '<redacted type="AWS Access Key" />' }],
+      detectedAtMs: 123,
+    });
+
+    expect(messages).toEqual([
+      {
+        type: 'secret_detected',
+        toolName: 'file_read',
+        action: 'warn',
+        matches: [{ type: 'AWS Access Key', redactedValue: '<redacted type="AWS Access Key" />' }],
+      },
+    ]);
+  });
+
+  test('stops forwarding after subscription is disposed', async () => {
+    const bus = new EventBus<AssistantDomainEvents>();
+    const messages: ServerMessage[] = [];
+    const subscription = registerToolNotificationListener(bus, (msg) => messages.push(msg));
+
+    subscription.dispose();
+    await bus.emit('tool.secret.detected', {
+      conversationId: 'conversation-1',
+      sessionId: 'session-1',
+      toolName: 'file_read',
+      action: 'warn',
+      matches: [{ type: 'AWS Access Key', redactedValue: '<redacted type="AWS Access Key" />' }],
+      detectedAtMs: 123,
+    });
+
+    expect(messages).toHaveLength(0);
+  });
+});

package/src/__tests__/tool-permission-simulate-handler.test.ts

@@ -0,0 +1,336 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { describe, test, expect, beforeEach, mock } from 'bun:test';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import * as net from 'node:net';
+
+const testDir = mkdtempSync(join(tmpdir(), 'permsim-handler-test-'));
+
+mock.module('../util/platform.js', () => ({
+  getRootDir: () => testDir,
+  getDataDir: () => join(testDir, 'data'),
+  getWorkspaceSkillsDir: () => join(testDir, 'skills'),
+  isMacOS: () => process.platform === 'darwin',
+  isLinux: () => process.platform === 'linux',
+  isWindows: () => process.platform === 'win32',
+  getSocketPath: () => join(testDir, 'test.sock'),
+  getPidPath: () => join(testDir, 'test.pid'),
+  getDbPath: () => join(testDir, 'test.db'),
+  getLogPath: () => join(testDir, 'test.log'),
+  ensureDataDir: () => {},
+  getIpcBlobDir: () => join(testDir, 'ipc-blobs'),
+}));
+
+mock.module('../util/logger.js', () => ({
+  getLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+    trace: () => {},
+    fatal: () => {},
+    child: () => ({
+      info: () => {},
+      warn: () => {},
+      error: () => {},
+      debug: () => {},
+    }),
+  }),
+}));
+
+const testConfig: Record<string, any> = {
+  permissions: { mode: 'legacy' as 'legacy' | 'strict' | 'workspace' },
+  skills: { load: { extraDirs: [] as string[] } },
+  sandbox: { enabled: true },
+};
+
+mock.module('../config/loader.js', () => ({
+  getConfig: () => testConfig,
+  loadConfig: () => testConfig,
+  invalidateConfigCache: () => {},
+  saveConfig: () => {},
+  loadRawConfig: () => ({}),
+  saveRawConfig: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+}));
+
+import { handleToolPermissionSimulate } from '../daemon/handlers/config.js';
+import { addRule, clearAllRules, clearCache } from '../permissions/trust-store.js';
+import type { ToolPermissionSimulateRequest, ToolPermissionSimulateResponse, ServerMessage } from '../daemon/ipc-contract.js';
+import type { HandlerContext } from '../daemon/handlers.js';
+import { DebouncerMap } from '../util/debounce.js';
+
+function createTestContext(): { ctx: HandlerContext; sent: ServerMessage[] } {
+  const sent: ServerMessage[] = [];
+  const ctx: HandlerContext = {
+    sessions: new Map(),
+    socketToSession: new Map(),
+    cuSessions: new Map(),
+    socketToCuSession: new Map(),
+    cuObservationParseSequence: new Map(),
+    socketSandboxOverride: new Map(),
+    sharedRequestTimestamps: [],
+    debounceTimers: new DebouncerMap({ defaultDelayMs: 200 }),
+    suppressConfigReload: false,
+    setSuppressConfigReload: () => {},
+    updateConfigFingerprint: () => {},
+    send: (_socket, msg) => { sent.push(msg); },
+    broadcast: () => {},
+    clearAllSessions: () => 0,
+    getOrCreateSession: () => { throw new Error('not implemented'); },
+    touchSession: () => {},
+  };
+  return { ctx, sent };
+}
+
+function getResponse(sent: ServerMessage[]): ToolPermissionSimulateResponse {
+  const msg = sent.find((m) => (m as any).type === 'tool_permission_simulate_response');
+  if (!msg) throw new Error('No tool_permission_simulate_response found in sent messages');
+  return msg as unknown as ToolPermissionSimulateResponse;
+}
+
+describe('tool_permission_simulate handler', () => {
+  beforeEach(() => {
+    clearAllRules();
+    clearCache();
+    testConfig.permissions.mode = 'legacy';
+  });
+
+  test('validation: returns error when toolName is missing', async () => {
+    const { ctx, sent } = createTestContext();
+    const msg = { type: 'tool_permission_simulate' } as any as ToolPermissionSimulateRequest;
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(false);
+    expect(res.error).toContain('toolName is required');
+  });
+
+  test('validation: returns error when input is missing', async () => {
+    const { ctx, sent } = createTestContext();
+    const msg = {
+      type: 'tool_permission_simulate',
+      toolName: 'bash',
+    } as any as ToolPermissionSimulateRequest;
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(false);
+    expect(res.error).toContain('input is required');
+  });
+
+  test('low-risk auto-allow: file_read is auto-allowed', async () => {
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_read',
+      input: { path: '/tmp/test.txt' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('allow');
+    expect(res.riskLevel).toBe('low');
+  });
+
+  test('deny rule produces deny decision', async () => {
+    // file_write deny rule — no default allow-all rule competes
+    addRule('file_write', 'file_write:/tmp/**', 'everywhere', 'deny');
+
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_write',
+      input: { path: '/tmp/test.txt', content: 'hello' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('deny');
+    expect(res.matchedRuleId).toBeDefined();
+  });
+
+  test('prompt decision includes allowlist and scope options', async () => {
+    const { ctx, sent } = createTestContext();
+    // file_write is medium risk and will prompt without a trust rule
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_write',
+      input: { path: '/tmp/test.txt', content: 'hello' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('prompt');
+    expect(res.promptPayload).toBeDefined();
+    expect(res.promptPayload!.allowlistOptions.length).toBeGreaterThan(0);
+    expect(res.promptPayload!.scopeOptions.length).toBeGreaterThan(0);
+    expect(res.promptPayload!.persistentDecisionsAllowed).toBe(true);
+  });
+
+  test('proxied bash disables persistent decisions', async () => {
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'bash',
+      input: { command: 'curl https://example.com', network_mode: 'proxied' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('prompt');
+    expect(res.promptPayload).toBeDefined();
+    expect(res.promptPayload!.persistentDecisionsAllowed).toBe(false);
+  });
+
+  test('forcePromptSideEffects promotes allow to prompt for side-effect tools', async () => {
+    // file_read is low-risk, auto-allowed, and NOT a side-effect tool
+    // so we use bash with an allow rule to test the promotion
+    addRule('bash', 'bash:ls*', 'everywhere', 'allow');
+
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'bash',
+      input: { command: 'ls' },
+      forcePromptSideEffects: true,
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    // bash is a side-effect tool, so allow gets promoted to prompt
+    expect(res.decision).toBe('prompt');
+    expect(res.reason).toContain('Private thread');
+  });
+
+  test('forcePromptSideEffects does not affect non-side-effect tools', async () => {
+    const { ctx, sent } = createTestContext();
+    // file_read is low-risk and not a side-effect tool
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_read',
+      input: { path: '/tmp/test.txt' },
+      forcePromptSideEffects: true,
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('allow');
+  });
+
+  test('non-interactive converts prompt to deny', async () => {
+    const { ctx, sent } = createTestContext();
+    // file_write is medium risk → prompt without a rule
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_write',
+      input: { path: '/tmp/test.txt', content: 'hello' },
+      isInteractive: false,
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('deny');
+    expect(res.reason).toContain('Non-interactive');
+    // No prompt payload when decision is deny
+    expect(res.promptPayload).toBeUndefined();
+  });
+
+  test('non-interactive does not affect allow decisions', async () => {
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_read',
+      input: { path: '/tmp/test.txt' },
+      isInteractive: false,
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('allow');
+  });
+
+  test('allow rule with matching pattern returns allow', async () => {
+    addRule('file_write', 'file_write:/tmp/**', 'everywhere', 'allow');
+
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_write',
+      input: { path: '/tmp/test.txt', content: 'hello' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('allow');
+    expect(res.matchedRuleId).toBeDefined();
+  });
+
+  test('executionTarget: sandbox-scoped rule matches when tool resolves to sandbox', async () => {
+    // file_write resolves to 'sandbox' (no host_ prefix)
+    addRule('file_write', 'file_write:/tmp/**', 'everywhere', 'allow', 100, {
+      executionTarget: 'sandbox',
+    });
+
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'file_write',
+      input: { path: '/tmp/test.txt', content: 'hello' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.decision).toBe('allow');
+    expect(res.matchedRuleId).toBeDefined();
+    expect(res.executionTarget).toBe('sandbox');
+  });
+
+  test('executionTarget: sandbox-scoped rule does NOT match when tool resolves to host', async () => {
+    // host_file_write resolves to 'host' (host_ prefix)
+    addRule('host_file_write', 'host_file_write:/tmp/**', 'everywhere', 'allow', 100, {
+      executionTarget: 'sandbox',
+    });
+
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'host_file_write',
+      input: { path: '/tmp/test.txt', content: 'hello' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    // The sandbox-scoped rule should not match a host tool
+    expect(res.decision).toBe('prompt');
+    expect(res.matchedRuleId).toBeUndefined();
+    expect(res.executionTarget).toBe('host');
+  });
+
+  test('executionTarget: response includes resolved execution target', async () => {
+    const { ctx, sent } = createTestContext();
+    const msg: ToolPermissionSimulateRequest = {
+      type: 'tool_permission_simulate',
+      toolName: 'host_bash',
+      input: { command: 'echo hi' },
+    };
+    await handleToolPermissionSimulate(msg, {} as net.Socket, ctx);
+
+    const res = getResponse(sent);
+    expect(res.success).toBe(true);
+    expect(res.executionTarget).toBe('host');
+  });
+});

package/src/__tests__/tool-policy.test.ts

@@ -0,0 +1,54 @@
+import { describe, test, expect } from 'bun:test';
+import { isToolAllowed } from '../tools/credentials/tool-policy.js';
+
+describe('isToolAllowed', () => {
+  // ── Allow cases ─────────────────────────────────────────────────────
+
+  test('allows tool listed in allowedTools', () => {
+    expect(isToolAllowed('browser_fill_credential', ['browser_fill_credential'])).toBe(true);
+  });
+
+  test('allows tool when multiple tools are listed', () => {
+    expect(isToolAllowed('bash', ['browser_fill_credential', 'bash', 'web_fetch'])).toBe(true);
+  });
+
+  // ── Deny cases ──────────────────────────────────────────────────────
+
+  test('denies tool not in allowedTools', () => {
+    expect(isToolAllowed('bash', ['browser_fill_credential'])).toBe(false);
+  });
+
+  test('denies when allowedTools is empty', () => {
+    expect(isToolAllowed('browser_fill_credential', [])).toBe(false);
+  });
+
+  test('denies when allowedTools is undefined', () => {
+    expect(isToolAllowed('browser_fill_credential', undefined as unknown as string[])).toBe(false);
+  });
+
+  test('denies when allowedTools is a string (not an array)', () => {
+    expect(isToolAllowed('b', 'browser_fill_credential' as unknown as string[])).toBe(false);
+  });
+
+  test('denies when toolName is empty', () => {
+    expect(isToolAllowed('', ['browser_fill_credential'])).toBe(false);
+  });
+
+  test('denies when toolName is not a string', () => {
+    expect(isToolAllowed(null as unknown as string, ['browser_fill_credential'])).toBe(false);
+  });
+
+  // ── Exact match (no wildcards) ──────────────────────────────────────
+
+  test('requires exact match — no prefix matching', () => {
+    expect(isToolAllowed('browser_fill', ['browser_fill_credential'])).toBe(false);
+  });
+
+  test('requires exact match — no suffix matching', () => {
+    expect(isToolAllowed('browser_fill_credential_v2', ['browser_fill_credential'])).toBe(false);
+  });
+
+  test('match is case-sensitive', () => {
+    expect(isToolAllowed('Browser_Fill_Credential', ['browser_fill_credential'])).toBe(false);
+  });
+});