fix(anthropic_sdk): match blocked_tools against raw + namespaced names

Reviewer was correct that blocked_tools was effectively a no-op in the
anthropic_sdk backend: taskflow YAML supplies raw tool names like
'read_file', but list_tools_unfiltered() returns namespace-prefixed
names like '{hash}read_file'. The old 'tool.name not in blocked' check
never matched, silently letting every blocked tool through. This is
the security bug the reviewer flagged on PR #265.

Fix: match the raw name against the un-prefixed portion of each tool's
namespaced name, in addition to the literal name. The mcp_server_map
keys stay namespaced because that's what Anthropic sends in tool_use.

Regression tests:
- raw 'read_file' filters out '{hash}read_file' (the bug case)
- already-namespaced names still match (backwards compat)

doc/GRAMMAR.md: also fix an inaccuracy the reviewer flagged in the
same review pass -- the docs claimed copilot_sdk 'silently ignores'
unsupported model_settings keys, but it actually raises
BackendCapabilityError on 'temperature' and 'parallel_tool_calls' at
validate() time. Updated wording to distinguish 'ignored' (anthropic_sdk)
from 'rejected' (copilot_sdk) so users aren't surprised by a hard fail
when they expected a silent drop.

281 tests pass, hatch fmt clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: anticomputer

doc/GRAMMAR.md

@@ -550,10 +550,4 @@ passed to the underlying model provider:
 | `endpoint` | API base URL for this model | The global `AI_API_ENDPOINT` env var |
 | `token` | Name of an environment variable containing the API key | Uses `AI_API_TOKEN` / `COPILOT_TOKEN` |
 
-All other keys (e.g. `temperature`, `top_p`, `reasoning`) are forwarded to
-the selected SDK backend. Which keys are actually honored depends on the
-backend: `openai_agents` accepts the standard OpenAI parameter set;
-`anthropic_sdk` forwards a curated subset (currently `temperature`,
-`top_p`, `reasoning`, `max_tokens`, `stream_thinking`); `copilot_sdk`
-consumes only the keys its SDK exposes (e.g. `reasoning_effort`) and
-silently ignores the rest. Consult the backend-specific docs if in doubt.
+All other keys (e.g. `temperature`, `top_p`, `reasoning`) are forwarded to the selected SDK backend. Each backend decides what to do with each key: `openai_agents` accepts the standard OpenAI parameter set; `anthropic_sdk` forwards a curated subset (currently `temperature`, `top_p`, `reasoning`, `max_tokens`, `stream_thinking`, `prompt_caching`) and silently ignores keys outside that set; `copilot_sdk` consumes the keys its SDK exposes (e.g. `reasoning_effort`) and **rejects** unsupported keys at validate time with `BackendCapabilityError` (currently `temperature` and `parallel_tool_calls`) rather than silently dropping them. Consult the backend-specific docs if in doubt.

src/seclab_taskflow_agent/sdk/anthropic_sdk/backend.py

@@ -131,23 +131,35 @@ async def build(
         # list_tools(), which would require run_context/agent args to
         # invoke the openai-agents tool_filter -- args we don't have
         # outside the openai-agents run loop.
+        #
+        # blocked_tools in taskflow YAML are raw (un-namespaced) names,
+        # consistent with how openai_agents and copilot_sdk consume them.
+        # list_tools_unfiltered() returns namespace-prefixed names (the
+        # MCP server wrapper applies the prefix). Match against both
+        # forms so blocking works regardless of which name the taskflow
+        # author used; key mcp_server_map by the namespaced name because
+        # that's what Anthropic will send back in tool_use blocks.
         all_tools: list[dict[str, Any]] = []
         mcp_server_map: dict[str, Any] = {}
         blocked = set(spec.blocked_tools or [])
 
+        def _is_blocked(tool: Any, namespace: str) -> bool:
+            name = tool.name
+            if name in blocked:
+                return True
+            return name.startswith(namespace) and name[len(namespace):] in blocked
+
         for mcp_spec in spec.mcp_servers:
             native_server = mcp_spec.params.get("_native")
             if native_server is None:
                 continue
             try:
                 mcp_tools = await native_server.list_tools_unfiltered()
-                for tool in mcp_tools:
-                    if tool.name not in blocked:
-                        mcp_server_map[tool.name] = native_server
-                anthropic_tools = _mcp_tools_to_anthropic(
-                    [t for t in mcp_tools if t.name not in blocked]
-                )
-                all_tools.extend(anthropic_tools)
+                namespace = getattr(native_server, "namespace", "")
+                kept = [t for t in mcp_tools if not _is_blocked(t, namespace)]
+                for tool in kept:
+                    mcp_server_map[tool.name] = native_server
+                all_tools.extend(_mcp_tools_to_anthropic(kept))
             except Exception:
                 logger.exception("Failed to list tools from MCP server %s", mcp_spec.name)
 

tests/test_sdk_anthropic_adapter.py

@@ -381,3 +381,112 @@ async def _run():
     assert captured.get("cache_control") == {"type": "ephemeral", "ttl": "1h"}, (
         f"expected cache_control with 1h ttl, got {captured.get('cache_control')!r}"
     )
+
+
+# -- blocked_tools filtering --
+
+
+def test_blocked_tools_matches_raw_name_against_namespaced_tool(monkeypatch):
+    """Regression: taskflow YAML blocked_tools uses raw (un-namespaced)
+    names like 'read_file', but list_tools_unfiltered() returns
+    namespace-prefixed names like '{hash}read_file'. The filter must
+    match the raw name against the un-prefixed portion of the
+    namespaced tool, otherwise blocking is silently bypassed.
+
+    See PR #265 review thread and openai_agents/copilot_sdk for
+    how blocked_tools are consumed elsewhere (both use raw names).
+    """
+    monkeypatch.setenv("AI_API_TOKEN", "test-token")
+    import asyncio
+    from unittest.mock import AsyncMock, MagicMock
+
+    from seclab_taskflow_agent.mcp_utils import MCPNamespaceWrap, compress_name
+    from seclab_taskflow_agent.sdk.base import MCPServerSpec
+
+    class _FakeTool:
+        def __init__(self, name):
+            self.name = name
+            self.description = ""
+            self.inputSchema = {}
+
+        def copy(self):
+            t = _FakeTool(self.name)
+            return t
+
+    # Build a wrapper whose session.list_tools returns two raw tools.
+    # list_tools_unfiltered() will return them with namespace prefix.
+    obj = MagicMock()
+    obj.name = "RepoContext"
+    ns = compress_name("RepoContext")
+    obj.session = MagicMock()
+    obj.session.list_tools = AsyncMock(
+        return_value=type("R", (), {"tools": [_FakeTool("read_file"), _FakeTool("safe_helper")]})()
+    )
+    wrap = MCPNamespaceWrap(confirms=[], obj=obj)
+
+    spec = AgentSpec(
+        name="t",
+        instructions="",
+        model="claude-mythos-preview",
+        mcp_servers=[MCPServerSpec(name="rc", kind="stdio", params={"_native": wrap})],
+        blocked_tools=["read_file"],  # raw name from YAML
+    )
+    backend = AnthropicSDKBackend()
+    handle = asyncio.run(backend.build(spec))
+
+    # The blocked tool must be absent from both the tool list AND the
+    # server map keys (which use the namespaced form).
+    tool_names = [t["name"] for t in handle.tools]
+    assert f"{ns}read_file" not in tool_names, (
+        f"blocked raw name 'read_file' should have filtered out '{ns}read_file'; "
+        f"got tools: {tool_names}"
+    )
+    assert f"{ns}safe_helper" in tool_names, (
+        f"non-blocked tool 'safe_helper' should still be present; got: {tool_names}"
+    )
+    assert f"{ns}read_file" not in handle.mcp_server_map
+    assert f"{ns}safe_helper" in handle.mcp_server_map
+
+
+def test_blocked_tools_also_matches_already_namespaced_name(monkeypatch):
+    """Backwards-compat: if a caller already passes the namespaced name
+    in blocked_tools (e.g. they computed it externally), it should still
+    match. The filter checks both forms."""
+    monkeypatch.setenv("AI_API_TOKEN", "test-token")
+    import asyncio
+    from unittest.mock import AsyncMock, MagicMock
+
+    from seclab_taskflow_agent.mcp_utils import MCPNamespaceWrap, compress_name
+    from seclab_taskflow_agent.sdk.base import MCPServerSpec
+
+    class _FakeTool:
+        def __init__(self, name):
+            self.name = name
+            self.description = ""
+            self.inputSchema = {}
+
+        def copy(self):
+            return _FakeTool(self.name)
+
+    obj = MagicMock()
+    obj.name = "RepoContext"
+    ns = compress_name("RepoContext")
+    obj.session = MagicMock()
+    obj.session.list_tools = AsyncMock(
+        return_value=type("R", (), {"tools": [_FakeTool("read_file")]})()
+    )
+    wrap = MCPNamespaceWrap(confirms=[], obj=obj)
+
+    spec = AgentSpec(
+        name="t",
+        instructions="",
+        model="claude-mythos-preview",
+        mcp_servers=[MCPServerSpec(name="rc", kind="stdio", params={"_native": wrap})],
+        blocked_tools=[f"{ns}read_file"],  # already namespaced
+    )
+    backend = AnthropicSDKBackend()
+    handle = asyncio.run(backend.build(spec))
+
+    assert handle.tools == [], (
+        f"blocked namespaced name should filter out the tool; got: {handle.tools}"
+    )