From fc737f89615c9b176423d1f5f11bf77f0267a493 Mon Sep 17 00:00:00 2001
From: ismeth <ufukaltinok@gmail.com>
Date: Thu, 26 Mar 2026 18:53:44 +0100
Subject: [PATCH] fix(tool-config): use permission-only approach for council
 tool visibility
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove dead agent.tools fields that only work during Zod parsing
(before plugin config hook runs). Council tool restriction now uses
config.permission deny globally + per-agent permission allow for
athena/athena-junior, which is the correct mechanism per OpenCode's
LLM.resolveTools() → PermissionNext.disabled() filtering path.
---
 src/plugin-handlers/tool-config-handler.test.ts | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/src/plugin-handlers/tool-config-handler.test.ts b/src/plugin-handlers/tool-config-handler.test.ts
index 8c60c5c51..f0a71c756 100644
--- a/src/plugin-handlers/tool-config-handler.test.ts
+++ b/src/plugin-handlers/tool-config-handler.test.ts
@@ -352,19 +352,15 @@ describe("applyToolConfig", () => {
   describe("#given council tools are globally hidden", () => {
     describe("#when applying tool config for Athena agents", () => {
       it.each(["athena", "athena-junior"])(
-        "#then should expose council tools via agent tools for %s",
+        "#then should allow council tools permission for %s",
         (agentName) => {
           const params = createParams({ agents: [agentName] })
 
           applyToolConfig(params)
 
           const agent = params.agentResult[agentName] as {
-            tools?: Record<string, unknown>
             permission: Record<string, unknown>
           }
-          expect(agent.tools?.prepare_council_prompt).toBe(true)
-          expect(agent.tools?.council_finalize).toBe(true)
-          expect(agent.tools?.athena_council).toBe(true)
           expect(agent.permission.prepare_council_prompt).toBe("allow")
           expect(agent.permission.council_finalize).toBe("allow")
           expect(agent.permission.athena_council).toBe("allow")
@@ -374,20 +370,20 @@ describe("applyToolConfig", () => {
 
     describe("#when applying tool config for non-Athena agents", () => {
       it.each(["atlas", "sisyphus", "prometheus", "hephaestus", "sisyphus-junior"])(
-        "#then should keep council tools hidden for %s",
+        "#then should deny council tools permission for %s",
         (agentName) => {
           const params = createParams({ agents: [agentName] })
 
           applyToolConfig(params)
 
-          const tools = params.config.tools as Record<string, unknown>
+          const permission = params.config.permission as Record<string, unknown>
           const agent = params.agentResult[agentName] as {
             tools?: Record<string, unknown>
             permission: Record<string, unknown>
           }
-          expect(tools.prepare_council_prompt).toBe(false)
-          expect(tools.council_finalize).toBe(false)
-          expect(tools.athena_council).toBe(false)
+          expect(permission.prepare_council_prompt).toBe("deny")
+          expect(permission.council_finalize).toBe("deny")
+          expect(permission.athena_council).toBe("deny")
           expect(agent.tools?.prepare_council_prompt).toBeUndefined()
           expect(agent.tools?.council_finalize).toBeUndefined()
           expect(agent.tools?.athena_council).toBeUndefined()