git-blinder/features/01_tools.feature at main · Math1987/git-blinder · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
@core
Feature: Tool visibility per perimeter
  Each agent sees only the tools declared in its perimeter, minus
  branch-discovery tools which are never exposed on perimeter MCP.
  Tools outside the grant do not exist — unknown, not forbidden.

  Background:
    Given the repository "acme/platform" with the standard fixture
    And perimeter "infra" grants tools [get_tree, get_file, push_files, list_commits, get_commit, list_branches]
    And perimeter "landing" grants tools [get_tree, get_file, push_files, list_commits]

  Scenario: Agent lists only its granted content tools
    Given agent A is connected to perimeter "infra" on branch "main"
    When agent A calls tools/list
    Then agent A sees exactly [get_tree, get_file, push_files, list_commits, get_commit]
    And agent A does not see "list_branches"
    And agent A does not see "compare"

  Scenario: Other perimeter's tools are absent
    Given agent B is connected to perimeter "landing" on branch "main"
    When agent B calls tools/list
    Then agent B does not see "get_commit"

  Scenario: Calling an out-of-perimeter tool returns unknown
    Given agent B is connected to perimeter "landing" on branch "main"
    When agent B calls tool "get_commit"
    Then the error says "unknown tool"
    And the error does not say "forbidden"

  Scenario: Branch discovery tools stay hidden even when granted
    Given agent A is connected to perimeter "infra" on branch "main"
    When agent A calls tools/list
    Then agent A does not see "list_branches"
    And agent A does not see "compare"