Enforce director allowlist inside the exec tool promoter

The promoter filtered outside-allow names only because its one call site pre-filtered in the activate closure; a second caller wiring activate raw would get no gate. The promoter now takes isAllowed and filters itself, with the exec call site passing the overlay check and the product-default test path passing allow-all.

An allow list that deny empties now throws at overlay resolution, matching the deny-without-allow behavior, instead of locking the director out silently.

Author: TheGreatAxios

src/exec/runner.test.ts

@@ -44,6 +44,14 @@ describe("exec director allowlist", () => {
     ]);
   });
 
+  test("an allow that deny empties is rejected loudly", () => {
+    const pkg = {
+      ...DIRECTOR_REGISTRY.explorer,
+      tools: { allow: ["run_shell"], deny: ["run_shell"] },
+    };
+    expect(() => resolveExecDirectorOverlayForPackage(pkg)).toThrow(/empty/);
+  });
+
   test("a deny-only package config is rejected loudly", () => {
     const pkg = {
       ...DIRECTOR_REGISTRY.explorer,
@@ -63,10 +71,8 @@ describe("exec director allowlist", () => {
         builtInPrefix: overlay.advertisedAllow,
       });
     const promote = createExecToolPromoter({
-      activate: (names) =>
-        activated.activate(
-          names.filter((name) => isExecOverlayToolAllowed(overlay, name)),
-        ),
+      activate: (names) => activated.activate(names),
+      isAllowed: (name) => isExecOverlayToolAllowed(overlay, name),
       currentDefinitions: () => [],
       computeAdvertised,
       updateDirectorTools: () => undefined,
@@ -79,6 +85,30 @@ describe("exec director allowlist", () => {
     ).toBe(false);
   });
 
+  test("the promoter gates allow itself — a raw activate caller gets no bypass", () => {
+    const overlay = resolveExecDirectorOverlay("explorer");
+    const { activated, computeAdvertised } = createAdvertisedToolset({
+      sessionMode: "orchestrator",
+      toolAvailability: { languageServerAvailable: true },
+      getProvider: () => ({ providerName: "test", model: "test-model" }),
+      builtInPrefix: overlay.advertisedAllow,
+    });
+    let advertisedCount = 0;
+    const promote = createExecToolPromoter({
+      activate: (names) => activated.activate(names),
+      isAllowed: (name) => isExecOverlayToolAllowed(overlay, name),
+      currentDefinitions: () => [],
+      computeAdvertised,
+      updateDirectorTools: () => {
+        advertisedCount += 1;
+      },
+    });
+    promote([OUTSIDE_ALLOW, "read_file"]);
+    expect(activated.has(OUTSIDE_ALLOW)).toBe(false);
+    expect(activated.has("read_file")).toBe(true);
+    expect(advertisedCount).toBe(1);
+  });
+
   test("skywalker overlay leaves every tool allowed", () => {
     const overlay = resolveExecDirectorOverlay("skywalker");
     expect(isExecOverlayToolAllowed(overlay, OUTSIDE_ALLOW)).toBe(true);

src/exec/runner.ts

@@ -299,6 +299,13 @@ export function resolveExecDirectorOverlayForPackage(
     allow !== undefined && allow.length > 0
       ? allow.filter((name) => !deny.includes(name))
       : undefined;
+  if (allowed !== undefined && allowed.length === 0) {
+    throw new Error(
+      `Director package "${pkg.id}" tools.allow minus tools.deny is empty — ` +
+        "exec overlays enforce a closed allow list, so no tool would be " +
+        "advertised. Keep an allow entry outside tools.deny.",
+    );
+  }
   const advertisedAllow =
     allowed !== undefined
       ? pkg.spawn.maySpawn
@@ -391,13 +398,14 @@ export function createExecToolCallGate(
 
 export function createExecToolPromoter(args: {
   activate: (names: readonly string[]) => boolean;
+  isAllowed: (name: string) => boolean;
   currentDefinitions: () => readonly ToolDefinition[];
   computeAdvertised: (all: readonly ToolDefinition[]) => ToolDefinition[];
   updateDirectorTools: (defs: ToolDefinition[]) => void;
   persist?: () => void;
 }): (names: string[]) => void {
   return (names) => {
-    if (!args.activate(names)) return;
+    if (!args.activate(names.filter((name) => args.isAllowed(name)))) return;
     args.updateDirectorTools(args.computeAdvertised(args.currentDefinitions()));
     args.persist?.();
   };
@@ -880,10 +888,8 @@ export async function runExec(config: Config): Promise<ExecResult> {
     // names, so outside-allow tools can never become advertised or callable.
     agentToolset.setToolPromoter(
       createExecToolPromoter({
-        activate: (names) =>
-          activatedToolNames.activate(
-            names.filter((name) => isExecOverlayToolAllowed(overlay, name)),
-          ),
+        activate: (names) => activatedToolNames.activate(names),
+        isAllowed: (name) => isExecOverlayToolAllowed(overlay, name),
         currentDefinitions: () =>
           agentToolset.dynamicRunner.currentDefinitions(),
         computeAdvertised,

tests/unit/exec/runner.test.ts

@@ -784,6 +784,7 @@ describe("exec tool call gate and promoter", () => {
     const directorNames: string[][] = [];
     const promote = createExecToolPromoter({
       activate: (names) => activated.activate(names),
+      isAllowed: () => true,
       currentDefinitions: () => runner.currentDefinitions(),
       computeAdvertised,
       updateDirectorTools: (defs) => {