fix(grants): the broker call refuses a seat that cannot confine it (TASK-175) (#1971)

Author: lilyshen0722

backend/__tests__/unit/routes/mcpGrants.listScope.test.js

@@ -31,6 +31,14 @@ jest.mock('../../../services/approvalActionService', () => ({
   proposeAction: jest.fn().mockResolvedValue({ ok: true, approvalId: 'approval-test' }),
 }));
 jest.mock('../../../services/dmService', () => ({ getOrCreateAgentRoom: jest.fn() }));
+// The seat's own declaration is judged inside the broker call (TASK-175). This
+// suite is about what the URL's grant exposes, so the resolution is mocked; the
+// resolution is witnessed on memory Mongo in
+// __tests__/unit/services/seatGrantConfinement.test.js.
+const mockSeatConfinement = jest.fn();
+jest.mock('../../../services/seatGrantConfinement', () => ({
+  judgeSeatConfinement: (...args) => mockSeatConfinement(...args),
+}));
 jest.mock('../../../middleware/agentRuntimeAuth', () => (req, _res, next) => {
   req.agentUser = {
     _id: 'agent-a',
@@ -104,6 +112,7 @@ const { getToolDefinitions } = require('../../../services/toolBrokerService');
 
 beforeEach(() => {
   jest.clearAllMocks();
+  mockSeatConfinement.mockResolvedValue({ refusal: null, scope: 'unbound' });
   mockRoomGrant.findOne.mockResolvedValue(seatGrant());
   mockIntegration.findOne.mockResolvedValue({
     type: 'github-app',

backend/__tests__/unit/routes/mcpGrants.test.js

@@ -71,6 +71,10 @@ describe('MCP grant transport', () => {
     expect(mockListToolsForGrant).toHaveBeenCalledWith({
       grantId: 'grant-1',
       agentUserId: 'agent-a',
+      // The seat's identity, so the list is judged for the same caller the call
+      // is (TASK-175).
+      agentName: 'openclaw',
+      instanceId: 'aria',
     });
 
     const called = await request(app)

backend/__tests__/unit/services/grantBrokerConfinement.test.js

@@ -121,6 +121,19 @@ describe('grant broker confinement predicate', () => {
     ['a padded adapter name', undefined, { adapter: ' pi ' }, 'adapter_cannot_confine'],
     ['a padded upper-case adapter name', undefined, { adapter: 'PI ' }, 'adapter_cannot_confine'],
     ['a normalised name that is not pi', undefined, { adapter: ' claude ' }, null],
+    // TASK-175: the adapter is `runtime.adapter` OR `runtime.runtimeType`. A
+    // hand-attached pi seat writes {runtimeType: 'pi', host: 'byo'} and no
+    // adapter key (cli/src/commands/agent.js:664, :688), so reading `adapter`
+    // alone admitted exactly the seat this rule exists to refuse.
+    ['a pi seat tagged only by runtimeType (the hand-attached shape)', undefined, { runtimeType: 'pi', host: 'byo' }, 'adapter_cannot_confine'],
+    ['a pi runtimeType in another case', undefined, { runtimeType: 'PI' }, 'adapter_cannot_confine'],
+    ['a declared adapter wins over a pi runtimeType, as it does in the daemon', undefined, { adapter: 'claude', runtimeType: 'pi', host: 'byo' }, null],
+    ['a claude-code runtimeType', undefined, { runtimeType: 'claude-code', host: 'byo' }, null],
+    ['a webhook connect-page seat', undefined, { runtimeType: 'webhook', host: 'byo' }, null],
+    // The arm that rejects "refuse anything without an adapter": undeclared, the
+    // daemon resolves only claude or codex (cli/src/commands/daemon.js:142), so
+    // failing closed here would refuse working claude seats.
+    ['a row naming neither adapter nor runtimeType', undefined, { host: 'byo' }, null],
   ])('decides %s', (_label, environment, runtime, expected) => {
     const refusal = grantBrokerRefusal(environment, runtime);
     if (expected === null) {

backend/__tests__/unit/services/grantBrokerProjectionService.test.js

@@ -208,6 +208,9 @@ describe('dispatchHostedBrokerTool', () => {
       agentUserId: SEAT,
       agentName: 'kai',
       instanceId: 'default',
+      // Set only here: a hosted turn has no shell, web or file tools to confine,
+      // so the seat-confinement refusal does not apply to it (Wren, TASK-175).
+      hosted: true,
       tool: 'github.list_issues',
       args: { grantId: 'grant-someone-else', agentUserId: OTHER_SEAT, state: 'open' },
     });

backend/__tests__/unit/services/nativeRuntimeService.hostedBroker.test.js

@@ -202,6 +202,9 @@ describe('a hosted run in a granted pod', () => {
       agentUserId: SEAT,
       agentName: 'scout',
       instanceId: 'default',
+      // A hosted turn has no shell, web or file tools, so the
+      // seat-confinement refusal is out of scope for it (Wren, TASK-175).
+      hosted: true,
       tool: 'github.list_issues',
       args: { state: 'open' },
     });