feat(agent-runner): enforce 4.x host-owned execution

tests/unit_tests/pipeline/test_chat_handler.py

@@ -30,23 +30,9 @@ def mock_circular_import_chain():
         make_pipeline_handler_import_mocks,
         get_handler_modules_to_clear,
     )
-    from langbot_plugin.api.entities.builtin.provider.message import Message
 
     mocks = make_pipeline_handler_import_mocks()
 
-    # Create a default runner that yields a simple response
-    class DefaultRunner:
-        name = 'local-agent'
-
-        def __init__(self, app, config):
-            self.app = app
-            self.config = config
-
-        async def run(self, query):
-            yield Message(role='assistant', content='fake response')
-
-    mocks['langbot.pkg.provider.runner'].preregistered_runners = [DefaultRunner]
-
     clear = get_handler_modules_to_clear('chat')
 
     with isolated_sys_modules(mocks=mocks, clear=clear):
@@ -56,22 +42,27 @@ def mock_circular_import_chain():
 @pytest.fixture
 def fake_app():
     """Create FakeApp instance."""
-    import sys
+    from langbot_plugin.api.entities.builtin.provider.message import Message
 
     app = FakeApp()
 
     class FakeAgentRunOrchestrator:
+        runner_class = None
+
         async def try_claim_steering_from_query(self, query):
             return False
 
         async def run_from_query(self, query):
-            runner_cls = sys.modules['langbot.pkg.provider.runner'].preregistered_runners[0]
-            runner = runner_cls(app, {})
+            if self.runner_class is None:
+                yield Message(role='assistant', content='fake response')
+                return
+
+            runner = self.runner_class(app, {})
             async for result in runner.run(query):
                 yield result
 
         def resolve_runner_id_for_telemetry(self, query):
-            return 'local-agent'
+            return 'plugin:langbot-team/LocalAgent/default'
 
     app.agent_run_orchestrator = FakeAgentRunOrchestrator()
     return app
@@ -89,13 +80,11 @@ def mock_event_ctx():
 
 
 @pytest.fixture
-def set_runner():
-    """Factory fixture to set a custom runner for tests."""
+def set_runner(fake_app):
+    """Configure the orchestrator test double for one test."""
 
     def _set_runner(runner_class):
-        import sys
-
-        sys.modules['langbot.pkg.provider.runner'].preregistered_runners = [runner_class]
+        fake_app.agent_run_orchestrator.runner_class = runner_class
 
     return _set_runner
 

tests/unit_tests/pipeline/test_pipelinemgr.py

@@ -178,7 +178,7 @@ def test_runtime_pipeline_prefers_runner_mcp_resources(mock_app):
                     'mcp-resources': [{'server_uuid': 'srv-new', 'uri': 'file:///new.md'}],
                     'mcp-resource-agent-read-enabled': False,
                 },
-            }
+            },
         }
     }
     pipeline_entity.extensions_preferences = {
@@ -213,3 +213,95 @@ def test_runtime_pipeline_falls_back_to_extension_mcp_resources(mock_app):
 
     assert runtime_pipeline.mcp_resource_attachments == [{'server_uuid': 'srv-old', 'uri': 'file:///old.md'}]
     assert runtime_pipeline.mcp_resource_agent_read_enabled is False
+
+
+@pytest.mark.parametrize('invalid_value', [0, None, 'false', [], {}])
+def test_runtime_pipeline_mcp_resource_read_flag_fails_closed(mock_app, invalid_value):
+    pipelinemgr = get_pipelinemgr_module()
+    persistence_pipeline = get_persistence_pipeline_module()
+
+    pipeline_entity = Mock(spec=persistence_pipeline.LegacyPipeline)
+    pipeline_entity.config = {
+        'ai': {
+            'runner': {'id': 'plugin:test/runner/default'},
+            'runner_config': {
+                'plugin:test/runner/default': {
+                    'mcp-resource-agent-read-enabled': invalid_value,
+                }
+            },
+        }
+    }
+    pipeline_entity.extensions_preferences = {'mcp_resource_agent_read_enabled': True}
+
+    runtime_pipeline = pipelinemgr.RuntimePipeline(mock_app, pipeline_entity, [])
+
+    assert runtime_pipeline.mcp_resource_agent_read_enabled is False
+
+
+@pytest.mark.parametrize('invalid_value', [0, None, 'false', [], {}])
+def test_runtime_pipeline_extension_enable_all_flags_fail_closed(mock_app, invalid_value):
+    pipelinemgr = get_pipelinemgr_module()
+    persistence_pipeline = get_persistence_pipeline_module()
+
+    pipeline_entity = Mock(spec=persistence_pipeline.LegacyPipeline)
+    pipeline_entity.config = {}
+    pipeline_entity.extensions_preferences = {
+        'enable_all_plugins': invalid_value,
+        'plugins': [{'author': 'allowed', 'name': 'plugin'}],
+        'enable_all_mcp_servers': invalid_value,
+        'mcp_servers': ['bound-mcp'],
+    }
+
+    runtime_pipeline = pipelinemgr.RuntimePipeline(mock_app, pipeline_entity, [])
+
+    assert runtime_pipeline.enable_all_plugins is False
+    assert runtime_pipeline.bound_plugins == ['allowed/plugin']
+    assert runtime_pipeline.enable_all_mcp_servers is False
+    assert runtime_pipeline.bound_mcp_servers == ['bound-mcp']
+
+
+@pytest.mark.parametrize('invalid_preferences', [None, [], '', 0, False])
+def test_runtime_pipeline_malformed_extension_root_disables_all_extensions(
+    mock_app,
+    invalid_preferences,
+):
+    pipelinemgr = get_pipelinemgr_module()
+    persistence_pipeline = get_persistence_pipeline_module()
+
+    pipeline_entity = Mock(spec=persistence_pipeline.LegacyPipeline)
+    pipeline_entity.config = {}
+    pipeline_entity.extensions_preferences = invalid_preferences
+
+    runtime_pipeline = pipelinemgr.RuntimePipeline(mock_app, pipeline_entity, [])
+
+    assert runtime_pipeline.enable_all_plugins is False
+    assert runtime_pipeline.bound_plugins == []
+    assert runtime_pipeline.enable_all_mcp_servers is False
+    assert runtime_pipeline.bound_mcp_servers == []
+    assert runtime_pipeline.mcp_resource_attachments == []
+    assert runtime_pipeline.mcp_resource_agent_read_enabled is False
+
+
+def test_runtime_pipeline_malformed_extension_lists_are_empty_allowlists(mock_app):
+    pipelinemgr = get_pipelinemgr_module()
+    persistence_pipeline = get_persistence_pipeline_module()
+
+    pipeline_entity = Mock(spec=persistence_pipeline.LegacyPipeline)
+    pipeline_entity.config = {}
+    pipeline_entity.extensions_preferences = {
+        'enable_all_plugins': True,
+        'plugins': 'allowed/plugin',
+        'enable_all_mcp_servers': True,
+        'mcp_servers': 'bound-mcp',
+        'mcp_resources': 'file:///README.md',
+        'mcp_resource_agent_read_enabled': True,
+    }
+
+    runtime_pipeline = pipelinemgr.RuntimePipeline(mock_app, pipeline_entity, [])
+
+    assert runtime_pipeline.enable_all_plugins is False
+    assert runtime_pipeline.bound_plugins == []
+    assert runtime_pipeline.enable_all_mcp_servers is False
+    assert runtime_pipeline.bound_mcp_servers == []
+    assert runtime_pipeline.mcp_resource_attachments == []
+    assert runtime_pipeline.mcp_resource_agent_read_enabled is False

tests/unit_tests/pipeline/test_preproc.py

@@ -14,7 +14,6 @@ from __future__ import annotations
 import pytest
 from unittest.mock import AsyncMock, Mock
 from importlib import import_module
-from types import SimpleNamespace
 
 from tests.factories import (
     FakeApp,
@@ -113,7 +112,7 @@ class TestPreProcessorNormalText:
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
 
         # Mock tool manager
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         # Mock plugin connector
         mock_event_ctx = Mock()
@@ -151,7 +150,7 @@ class TestPreProcessorNormalText:
         mock_model = Mock()
         mock_model.model_entity = Mock(uuid='test-model', abilities=['func_call'])
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         mock_event_ctx = Mock()
         mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
@@ -189,7 +188,7 @@ class TestPreProcessorEmptyMessage:
         app.sess_mgr.get_conversation = AsyncMock(return_value=mock_conversation)
 
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=None)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         mock_event_ctx = Mock()
         mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
@@ -231,7 +230,7 @@ class TestPreProcessorImageSegment:
         mock_model = Mock()
         mock_model.model_entity = Mock(uuid='vision-model', abilities=['func_call', 'vision'])
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         mock_event_ctx = Mock()
         mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
@@ -279,7 +278,7 @@ class TestPreProcessorImageSegment:
         mock_model = Mock()
         mock_model.model_entity = Mock(uuid='text-only-model', abilities=['func_call'])
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         mock_event_ctx = Mock()
         mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
@@ -317,7 +316,7 @@ class TestPreProcessorModelSelection:
         mock_model = Mock()
         mock_model.model_entity = Mock(uuid='primary-model-uuid', abilities=['func_call'])
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
         attach_agent_runner_descriptor(app)
 
         mock_event_ctx = Mock()
@@ -369,7 +368,7 @@ class TestPreProcessorModelSelection:
             raise ValueError(f'Model {uuid} not found')
 
         app.model_mgr.get_model_by_uuid = AsyncMock(side_effect=mock_get_model)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
         attach_agent_runner_descriptor(app)
 
         mock_event_ctx = Mock()
@@ -411,7 +410,7 @@ class TestPreProcessorVariables:
         app.sess_mgr.get_conversation = AsyncMock(return_value=mock_conversation)
 
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=None)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         mock_event_ctx = Mock()
         mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
@@ -448,7 +447,7 @@ class TestPreProcessorVariables:
         app.sess_mgr.get_conversation = AsyncMock(return_value=mock_conversation)
 
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=None)
-        app.tool_mgr.get_all_tools = AsyncMock(return_value=[])
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
 
         mock_event_ctx = Mock()
         mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
@@ -463,12 +462,62 @@ class TestPreProcessorVariables:
         assert 'group_name' in variables
         assert 'sender_name' in variables
 
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize('invalid_value', [0, None, 'false'])
+    @pytest.mark.parametrize(
+        ('configured_skills', 'expected_skills'),
+        [
+            (['bound-skill'], ['bound-skill']),
+            (None, []),
+            ('bound-skill', []),
+        ],
+    )
+    async def test_malformed_enable_all_skills_flag_uses_bound_skills(
+        self,
+        invalid_value,
+        configured_skills,
+        expected_skills,
+    ):
+        preproc = get_preproc_module()
+
+        app = FakeApp()
+        mock_session = Mock()
+        mock_session.launcher_type = Mock(value='person')
+        mock_session.launcher_id = 12345
+        app.sess_mgr.get_session = AsyncMock(return_value=mock_session)
+
+        mock_conversation = Mock()
+        mock_conversation.prompt = Mock(messages=[])
+        mock_conversation.prompt.copy = Mock(return_value=Mock(messages=[]))
+        mock_conversation.messages = []
+        mock_conversation.uuid = None
+        app.sess_mgr.get_conversation = AsyncMock(return_value=mock_conversation)
+
+        app.model_mgr.get_model_by_uuid = AsyncMock(return_value=None)
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(return_value=[])
+        app.pipeline_service.get_pipeline = AsyncMock(
+            return_value={
+                'extensions_preferences': {
+                    'enable_all_skills': invalid_value,
+                    'skills': configured_skills,
+                }
+            }
+        )
+
+        mock_event_ctx = Mock()
+        mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
+        app.plugin_connector.emit_event = AsyncMock(return_value=mock_event_ctx)
+
+        result = await preproc.PreProcessor(app).process(text_query('hello'), 'PreProcessor')
+
+        assert result.new_query.variables['_pipeline_bound_skills'] == expected_skills
+
 
 class TestPreProcessorToolSelection:
-    """Tests for Local Agent tool selection."""
+    """Tests for generic AgentRunner tool selection."""
 
     @pytest.mark.asyncio
-    async def test_local_agent_filters_selected_tools(self):
+    async def test_agent_runner_filters_selected_tools(self):
         """Only selected tools should be exposed when all-tools mode is off."""
         preproc = get_preproc_module()
 
@@ -488,11 +537,28 @@ class TestPreProcessorToolSelection:
         mock_model = Mock()
         mock_model.model_entity = Mock(uuid='primary-model-uuid', abilities=['func_call'])
         app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
-        app.tool_mgr.get_all_tools = AsyncMock(
+        app.tool_mgr.get_resolved_tool_catalog = AsyncMock(
             return_value=[
-                SimpleNamespace(name='exec'),
-                SimpleNamespace(name='plugin_tool'),
-                SimpleNamespace(name='mcp_tool'),
+                {
+                    'name': 'exec',
+                    'source': 'builtin',
+                    'description': 'Execute',
+                    'parameters': {},
+                },
+                {
+                    'name': 'plugin_tool',
+                    'source': 'plugin',
+                    'source_id': 'test/plugin',
+                    'description': 'Plugin tool',
+                    'parameters': {},
+                },
+                {
+                    'name': 'mcp_tool',
+                    'source': 'mcp',
+                    'source_id': 'mcp-server',
+                    'description': 'MCP tool',
+                    'parameters': {},
+                },
             ]
         )
 
@@ -516,3 +582,53 @@ class TestPreProcessorToolSelection:
         result = await stage.process(query, 'PreProcessor')
 
         assert [tool.name for tool in result.new_query.use_funcs] == ['plugin_tool']
+        assert result.new_query.variables['_host_tool_source_refs'] == {
+            'plugin_tool': {'source': 'plugin', 'source_id': 'test/plugin'},
+        }
+
+
+class TestPreProcessorMCPResourceContext:
+    """Tests for deferring MCP context until the run-scoped execution input."""
+
+    @pytest.mark.asyncio
+    async def test_pinned_context_does_not_mutate_preprocessed_input(self):
+        preproc = get_preproc_module()
+        from langbot.pkg.agent.runner.query_entry_adapter import QueryEntryAdapter
+
+        app = FakeApp()
+        mock_session = Mock()
+        mock_session.launcher_type = Mock(value='person')
+        mock_session.launcher_id = 12345
+        app.sess_mgr.get_session = AsyncMock(return_value=mock_session)
+
+        mock_conversation = Mock()
+        mock_conversation.prompt = Mock(messages=[])
+        mock_conversation.prompt.copy = Mock(return_value=Mock(messages=[]))
+        mock_conversation.messages = []
+        mock_conversation.uuid = 'conversation-1'
+        app.sess_mgr.get_conversation = AsyncMock(return_value=mock_conversation)
+
+        mock_model = Mock()
+        mock_model.model_entity = Mock(uuid='primary-model-uuid', abilities=[])
+        app.model_mgr.get_model_by_uuid = AsyncMock(return_value=mock_model)
+        mcp_loader = Mock()
+        mcp_loader.build_resource_context_for_query = AsyncMock(return_value='Pinned documentation')
+        app.tool_mgr.mcp_tool_loader = mcp_loader
+
+        mock_event_ctx = Mock()
+        mock_event_ctx.event = Mock(default_prompt=[], prompt=[])
+        app.plugin_connector.emit_event = AsyncMock(return_value=mock_event_ctx)
+        attach_agent_runner_descriptor(app, tool_calling=False)
+
+        query = text_query('hello')
+        query.launcher_id = '12345'
+        query.pipeline_config = agent_runner_pipeline_config(
+            {'primary': 'primary-model-uuid', 'fallbacks': []},
+        )
+
+        result = await preproc.PreProcessor(app).process(query, 'PreProcessor')
+        event = QueryEntryAdapter.query_to_event(result.new_query)
+
+        assert event.input.text == 'hello'
+        assert 'Pinned documentation' not in str(event.input.contents)
+        mcp_loader.build_resource_context_for_query.assert_not_awaited()