diff --git a/src/agents/pi-tools.test.ts b/src/agents/pi-tools.test.ts
index 4f5b83fce..268a5bd98 100644
--- a/src/agents/pi-tools.test.ts
+++ b/src/agents/pi-tools.test.ts
@@ -631,6 +631,17 @@ describe("createClawdbotCodingTools", () => {
     expect(names.has("browser")).toBe(false);
   });
 
+  it("expands group shorthands in global tool deny policy", () => {
+    const tools = createClawdbotCodingTools({
+      config: { tools: { deny: ["group:fs"] } },
+    });
+    const names = new Set(tools.map((tool) => tool.name));
+    expect(names.has("read")).toBe(false);
+    expect(names.has("write")).toBe(false);
+    expect(names.has("edit")).toBe(false);
+    expect(names.has("exec")).toBe(true);
+  });
+
   it("lets agent profiles override global profiles", () => {
     const tools = createClawdbotCodingTools({
       sessionKey: "agent:work:main",
diff --git a/src/agents/tool-policy.test.ts b/src/agents/tool-policy.test.ts
new file mode 100644
index 000000000..385075afb
--- /dev/null
+++ b/src/agents/tool-policy.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import {
+  expandToolGroups,
+  resolveToolProfilePolicy,
+  TOOL_GROUPS,
+} from "./tool-policy.js";
+
+describe("tool-policy", () => {
+  it("expands groups and normalizes aliases", () => {
+    const expanded = expandToolGroups([
+      "group:runtime",
+      "BASH",
+      "apply-patch",
+      "group:fs",
+    ]);
+    const set = new Set(expanded);
+    expect(set.has("exec")).toBe(true);
+    expect(set.has("bash")).toBe(true);
+    expect(set.has("process")).toBe(true);
+    expect(set.has("apply_patch")).toBe(true);
+    expect(set.has("read")).toBe(true);
+    expect(set.has("write")).toBe(true);
+    expect(set.has("edit")).toBe(true);
+  });
+
+  it("resolves known profiles and ignores unknown ones", () => {
+    const coding = resolveToolProfilePolicy("coding");
+    expect(coding?.allow).toContain("group:fs");
+    expect(resolveToolProfilePolicy("nope")).toBeUndefined();
+  });
+
+  it("includes core tool groups in group:clawdbot", () => {
+    const group = TOOL_GROUPS["group:clawdbot"];
+    expect(group).toContain("browser");
+    expect(group).toContain("message");
+    expect(group).toContain("session_status");
+  });
+});