let5see/clawdbot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(tools): honor agent tool denylist without sandbox

Browse Source
This commit is contained in:
Peter Steinberger
2026-01-04 23:59:45 +01:00
parent d9a9f6db7d
commit 4dd515b65f
4 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/agents/pi-tools.test.ts
View File

@@ -195,4 +195,12 @@ describe("createClawdbotCodingTools", () => {
expect(tools.some((tool) => tool.name === "read")).toBe(false);
expect(tools.some((tool) => tool.name === "browser")).toBe(false);
});
it("filters tools by agent tool policy even without sandbox", () => {
const tools = createClawdbotCodingTools({
config: { agent: { tools: { deny: ["browser"] } } },
});
expect(tools.some((tool) => tool.name === "bash")).toBe(true);
expect(tools.some((tool) => tool.name === "browser")).toBe(false);
});
});

10
src/agents/pi-tools.ts
View File

@@ -509,8 +509,14 @@ export function createClawdbotCodingTools(options?: {
if (tool.name === "slack") return allowSlack;
return true;
});
const globallyFiltered =
options?.config?.agent?.tools &&
(options.config.agent.tools.allow?.length ||
options.config.agent.tools.deny?.length)
? filterToolsByPolicy(filtered, options.config.agent.tools)
: filtered;
const sandboxed = sandbox
? filterToolsByPolicy(filtered, sandbox.tools)
: filtered;
? filterToolsByPolicy(globallyFiltered, sandbox.tools)
: globallyFiltered;
return sandboxed.map(normalizeToolParameters);
}