stacklok / toolhive / 31125910419

70%

Build Type

push

github

Committed by web-flow

Commit Message

Reject tools/call for tools hidden from tools/list (#6216)

* Reject tools/call for tools hidden from tools/list

The aggregator keeps every backend tool in the routing table, including
ones withheld from tools/list by excludeAllTools, per-workload excludeAll,
or filter, so composite-tool workflow steps can still reach them (#3636).
core.CallTool resolved a direct call against that same table, so a hidden
tool was callable by name -- documented as returning ErrNotFound for an
unadvertised name, but never enforced.

On the Modern (2026-07-28) path, where tools/call goes straight to
core.CallTool, this was reachable off the wire whenever no Cedar policy
was configured. Legacy was incidentally protected: the SDK only registers
advertised names on the session.

Hold the call to the advertised view in the core, so every consumer gets
the contract, and classify the refusal as -32602 on the Modern path to
match what Legacy already answers for an unregistered tool.

Composite tools are unaffected: a workflow enters CallTool once under its
own advertised name, and its steps then bypass the core entirely.

* Address review: dedupe advertised-view lookup, cover alias

Resolve the advertised view and composite set once in CallTool and
thread both through admission, the not-found guard and composite
dispatch. Each of accessibleComposites/advertisedTools re-runs workflow
filtering and conversion, so the previous code did that work three times
per call and allocated the concatenated slice twice.

Add the leg that drives RouteTool's dot-alias fallback: rejecting the
alias for direct calls otherwise left it with no coverage, since
TestCallTool_CompositeWorkflow registers the aliased name as an exact
routing-table key and never reaches the fallback.

Assert the Legacy refusal on the decoded error.code rather than a
substring of the response body, matching the Modern leg.

Correct three comments: the guard checks the aggregation view ListTools
filters (admission narrows... (continued)

Coverage Stats

42 of 42 new or added lines in 4 files covered. (100.0%)

91 existing lines in 6 files now uncovered.

83166 of 118939 relevant lines covered (69.92%)

98.25 hits per line