fix(agent-core): honor [tools].disabled config in v1 engine

.changeset/fix-tools-disabled-v1.md

@@ -0,0 +1,17 @@
+---
+"@moonshot-ai/kimi-code": patch
+"@moonshot-ai/kimi-code-sdk": patch
+---
+
+fix(agent-core): honor [tools].disabled config in v1 engine
+
+The `[tools].disabled` array in config.toml was silently ignored by the
+v1 engine (v2 has a dedicated toolPolicy service for this). Read the
+section from config.raw in bootstrapAgentProfile and merge it into the
+profile's disallowedTools so disabled tools are filtered from both the
+top-level tool list and the subagent Agent tool description.
+
+agent-core is bundled into the SDK artifact (node-sdk `alwaysBundle`), so
+in-process SDK consumers (createKimiHarness/SDKRpcClient v1 sessions)
+that set `[tools].disabled` need the SDK version bumped to receive the
+fix.

packages/agent-core/src/agent/index.ts

@@ -450,7 +450,33 @@ export class Agent {
   ): void {
     this.setActiveProfile(profile, brandHome);
     this.updateSystemPromptFromProfile(profile, context, subagentNames);
+    // Persist only the profile's own denylist via setActiveTools (it is
+    // replayed on resume). The global [tools].disabled denylist is applied
+    // separately via addDisallowedTools, which mutates the deny set without
+    // logging a set_active_tools record - otherwise a config deny added at
+    // startup would be written into the wire record and survive a later
+    // config removal on cold resume. #2534.
     this.tools.setActiveTools(profile.tools, profile.disallowedTools);
+    const toolsDisabled = this.configDisabledTools();
+    if (toolsDisabled.length > 0) {
+      this.tools.addDisallowedTools(toolsDisabled);
+    }
+  }
+
+  /** Global [tools].disabled from options.config.raw, if provided. #2534. */
+  private configDisabledTools(): string[] {
+    const tools = this.kimiConfig?.raw?.['tools'];
+    if (
+      tools === undefined ||
+      typeof tools !== 'object' ||
+      tools === null ||
+      !Array.isArray((tools as Record<string, unknown>)['disabled'])
+    ) {
+      return [];
+    }
+    return ((tools as Record<string, unknown>)['disabled'] as string[]).filter(
+      (v): v is string => typeof v === 'string',
+    );
   }
 
   /** Push a refreshed session config snapshot and rebuild config-dependent builtin tools. */
@@ -532,6 +558,15 @@ export class Agent {
 
   async resume(options?: AgentRecordsReplayOptions): Promise<{ warning?: string }> {
     const result = await this.records.replay(options);
+    // A standalone Agent (no Session) replays persisted tool state here but
+    // never routes through Session.restoreAgentProfileHandle, so re-apply the
+    // global [tools].disabled denylist non-persistently (mirrors useProfile).
+    // Without this a config deny added before resuming an existing Agent has
+    // no effect until the next useProfile / setActiveTools RPC. #2534.
+    const toolsDisabled = this.configDisabledTools();
+    if (toolsDisabled.length > 0) {
+      this.tools.addDisallowedTools(toolsDisabled);
+    }
     this.flushPendingAnthropicThinkingEffortWarnings();
     try {
       this.replayBuilder.postRestoring = true;
@@ -648,7 +683,16 @@ export class Agent {
         this.tools.unregisterUserTool(payload.name);
       },
       setActiveTools: (payload) => {
+        // Persist the runtime selection only. The global [tools].disabled
+        // denylist is re-applied via addDisallowedTools (no record) so a
+        // runtime selection cannot reactivate a disabled tool, while keeping
+        // config-only denies out of the persisted set_active_tools record.
+        // #2534.
         this.tools.setActiveTools(payload.names);
+        const toolsDisabled = this.configDisabledTools();
+        if (toolsDisabled.length > 0) {
+          this.tools.addDisallowedTools(toolsDisabled);
+        }
       },
       stopBackground: (payload) => {
         void this.background.stop(payload.taskId, payload.reason);

packages/agent-core/src/agent/tool/index.ts

@@ -530,10 +530,15 @@ export class ToolManager {
   }
 
   setActiveTools(names: readonly string[], disallowedNames?: readonly string[]): void {
+    // Callers compose [tools].disabled into an array, but an empty denylist
+    // carries no information; normalize to undefined so the serialized record
+    // omits it (matching the pre-config behavior) instead of changing every
+    // set_active_tools record with an empty disallowedNames. #2534.
     this.agent.records.logRecord({
       type: 'tools.set_active_tools',
       names,
-      disallowedNames,
+      disallowedNames:
+        disallowedNames && disallowedNames.length > 0 ? disallowedNames : undefined,
     });
     // MCP entries are glob patterns gated separately; the rest are exact
     // builtin/user tool names. The split keeps every caller on one string[].
@@ -552,6 +557,33 @@ export class ToolManager {
     }
   }
 
+  /**
+   * Add to the denied set without replacing the replayed enabled set. Used by
+   * the resume path so applying [tools].disabled to a restored agent does not
+   * drop unrelated replayed host/user tools or a previous runtime selection.
+   * #2534.
+   */
+  addDisallowedTools(names: readonly string[]): void {
+    if (names.length === 0) return;
+    const denials = names.filter((name) => !isMcpToolName(name));
+    const mcpDenies = names.filter((name) => isMcpToolName(name));
+    if (denials.length > 0) {
+      this.disabledTools = new Set([...this.disabledTools, ...denials]);
+    }
+    if (mcpDenies.length > 0) {
+      this.mcpDenyPatterns = [...this.mcpDenyPatterns, ...mcpDenies];
+    }
+    // Builtin construction bakes `allowBackground` from the Task* trio into
+    // Bash/Agent (see setActiveTools). The resume path already rebuilt the
+    // builtins during wire replay, before these denies were applied, so a
+    // newly-denied Task* tool would leave allowBackground stuck on until the
+    // next setActiveTools. Rebuild here so the denylist takes effect on the
+    // already-constructed builtins. #2534.
+    if (this.agent.config.hasProvider) {
+      this.initializeBuiltinTools();
+    }
+  }
+
   copyLoopToolsFrom(source: ToolManager): void {
     this.loopToolsOverride = source.loopTools;
   }

packages/agent-core/src/session/index.ts

@@ -778,7 +778,17 @@ export class Session {
       { additionalDirs: this.additionalDirs },
     );
     const subagentNames = Object.keys(this.agentCatalog.delegatableSubagents(profile.name));
+
+    // Apply global [tools].disabled without persisting it into the agent's
+    // profile/wire record. useProfile persists only profile.disallowedTools
+    // (replayed on resume); config denies are added via addDisallowedTools,
+    // which mutates the deny set without logging a record, so removing the
+    // config later does not leave a stale persisted deny. #2534.
+    const toolsDisabled = this.readToolsDisabled();
     agent.useProfile(profile, context, this.options.kimiHomeDir, subagentNames);
+    if (toolsDisabled.length > 0) {
+      agent.tools.addDisallowedTools(toolsDisabled);
+    }
     const { agentsMdWarning } = context;
     if (agentsMdWarning !== undefined) {
       this.agentsMdWarning = agentsMdWarning;
@@ -791,6 +801,22 @@ export class Session {
     }
   }
 
+  /**
+   * Read the `[tools].disabled` array from the raw config. v1's
+   * KimiConfigSchema does not have a typed `tools` section (v2 uses a
+   * dedicated toolPolicy service), so unknown sections land in
+   * `config.raw`. This extracts the disabled tool names safely. #2534.
+   */
+  readToolsDisabled(): string[] {
+    const raw = this.kimiConfig?.raw;
+    if (!raw) return [];
+    const toolsSection = raw['tools'];
+    if (typeof toolsSection !== 'object' || toolsSection === null) return [];
+    const disabled = (toolsSection as Record<string, unknown>)['disabled'];
+    if (!Array.isArray(disabled)) return [];
+    return disabled.filter((v): v is string => typeof v === 'string');
+  }
+
   async getSessionWarnings(): Promise<readonly SessionWarning[]> {
     const warnings: SessionWarning[] = [];
     const agentsMdWarning = await this.computeAgentsMdWarning();
@@ -1315,7 +1341,18 @@ export class Session {
     if (agent.config.systemPrompt === '') return;
     const profile = this.resolvePersistedProfile(agent, meta, parentAgent);
     if (profile === undefined) return;
+    // Apply global [tools].disabled to resumed/reloaded agents too. The
+    // bootstrap path (bootstrapAgentProfile) merges it at session start, but
+    // restoreAgentProfileHandle only calls setActiveProfile - which does not
+    // re-apply the tool denylist. agent.resume() has already replayed
+    // persisted tool state, so add the denylist without replacing the
+    // replayed enabled set (which would drop unrelated runtime selections).
+    // #2534.
     agent.setActiveProfile(profile, this.options.kimiHomeDir);
+    const toolsDisabled = this.readToolsDisabled();
+    if (toolsDisabled.length > 0) {
+      agent.tools.addDisallowedTools(toolsDisabled);
+    }
   }
 
   private resolvePersistedProfile(

packages/agent-core/src/session/subagent-host.ts

@@ -339,7 +339,21 @@ export class SessionSubagentHost {
    */
   delegatableSubagents(callerProfileName?: string): Record<string, ResolvedAgentProfile> {
     const owner = this.getOwnerAgent?.() ?? this.session.getReadyAgent(this.ownerAgentId);
-    return this.resolveDelegatableSubagents(callerProfileName, owner?.config.subagentNames);
+    const profiles = this.resolveDelegatableSubagents(callerProfileName, owner?.config.subagentNames);
+    // Apply global [tools].disabled to the profiles exposed to the parent
+    // agent's Agent tool description, so the model does not advertise a
+    // subagent as having a tool the spawned child will not receive. #2534.
+    const toolsDisabled = this.session.readToolsDisabled();
+    if (toolsDisabled.length === 0) return profiles;
+    return Object.fromEntries(
+      Object.entries(profiles).map(([name, profile]) => [
+        name,
+        {
+          ...profile,
+          disallowedTools: [...(profile.disallowedTools ?? []), ...toolsDisabled],
+        },
+      ]),
+    );
   }
 
   private resolveDelegatableSubagents(
@@ -457,7 +471,17 @@ export class SessionSubagentHost {
     const subagentNames = Object.keys(
       this.session.agentCatalog.delegatableSubagents(profile.name),
     );
+
+    // Apply global [tools].disabled to subagents without persisting it into
+    // the child's profile/wire record. useProfile persists only
+    // profile.disallowedTools; config denies are added via addDisallowedTools,
+    // which mutates the deny set without logging a record, so a config deny
+    // does not survive a later config removal on resume. #2534.
+    const toolsDisabled = this.session.readToolsDisabled();
     child.useProfile(profile, context, this.session.options.kimiHomeDir, subagentNames);
+    if (toolsDisabled.length > 0) {
+      child.tools.addDisallowedTools(toolsDisabled);
+    }
     child.tools.inheritUserTools(parent.tools);
   }
 

packages/agent-core/test/session/subagent-host.test.ts

@@ -1856,6 +1856,7 @@ function fakeSession(
       custom: {},
     },
     writeMetadata: vi.fn(async () => {}),
+    readToolsDisabled: vi.fn((): string[] => []),
     systemContextKaos: vi.fn((cwd: string) => parent.kaos.withCwd(cwd)),
     getReadyAgent: vi.fn((id: string) => agents.get(id)),
     ensureAgentResumed: vi.fn(async (id: string) => {