car_engine/

flow.rs

//! Information-flow admission gate + tool-label loading (EPIC A / A3+A4).
//!
//! `car_verify::check_information_flow` is a verified static check for data
//! exfiltration and forbidden tool orderings, but it was never called by
//! the runtime, and it needs per-tool *labels* (capability, confidentiality,
//! trust, sink) that nothing produced. This module supplies both halves:
//!
//! - **A3 — labels**: a built-in default label table for CAR's commodity
//!   tools, plus a `.car/tool-labels.json` loader so a project can declare
//!   which tools are sinks, which produce confidential data, and what tool
//!   orderings are forbidden.
//! - **A4 — the gate**: [`InformationFlowGate`], an [`crate::admission::AdmissionGate`]
//!   that runs `check_information_flow` → `gate_flow` on every admitted
//!   proposal, blocking exfiltration and escalating forbidden orderings to
//!   approval (which fails closed until A7 wires the approval transport).

use crate::admission::{AdmissionGate, GateContext, GateOutcome};
use car_ir::ActionProposal;
use car_verify::infoflow::{
    check_information_flow, gate_flow, Confidentiality, FlowAction, FlowGatePolicy, FlowPolicy,
    ToolLabels, TrustLevel,
};
use serde::{Deserialize, Serialize};
use std::collections::{HashMap, HashSet};
use std::fmt;
use std::path::Path;

/// The deserialized `.car/tool-labels.json` document: per-tool labels plus
/// the flow policy (what counts as a hazard) and the gate policy (what to
/// do about each hazard class). Every field defaults, so a partial file is
/// valid.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
pub struct ToolLabelConfig {
    /// Tool name → information-flow labels.
    #[serde(default)]
    pub labels: HashMap<String, ToolLabels>,
    /// What confidentiality reaching a sink is a violation, and which tool
    /// orderings are forbidden.
    #[serde(default)]
    pub flow_policy: FlowPolicy,
    /// How each hazard class is enforced (block / approve / allow).
    #[serde(default)]
    pub gate_policy: FlowGatePolicy,
}

/// The capability that marks a tool as reaching the network.
pub const NET_SEND: &str = "net_send";

/// Whether a tool's output should be treated as coming from **outside** the
/// trust boundary (car#723).
///
/// Derived from the information-flow labels a tool already has to carry rather
/// than from a second, parallel list. That is the whole point: a new
/// network-reaching tool needs a `net_send` label anyway — without one it is
/// invisible to the exfiltration gate — so deriving provenance from the same
/// label means there is one place to forget instead of two. A second list would
/// drift, and the drift would be silent and security-relevant.
///
/// Two signals count:
///
/// - `capability == "net_send"` — the tool talks to the network, so what it
///   returns is shaped by something outside this host. That includes the
///   generator tools, which submit a prompt to a third-party service and return
///   what it produced; treating those as external is the conservative reading.
/// - `trust == Untrusted` — an explicit declaration in `.car/tool-labels.json`,
///   for a project's own tools that read from somewhere untrusted without
///   themselves being network sinks.
///
/// An unlabeled tool is `false`. That is the same blind spot the flow gate
/// already has, deliberately shared rather than papered over with a heuristic
/// on tool names — a name-matching guess here would produce confident-looking
/// marks that are wrong in both directions.
pub fn tool_output_is_external(tool: &str, labels: &HashMap<String, ToolLabels>) -> bool {
    labels.get(tool).is_some_and(|l| {
        l.capability.as_deref() == Some(NET_SEND) || l.trust == TrustLevel::Untrusted
    })
}

/// Default information-flow labels for CAR's built-in commodity tools.
///
/// Conservative and capability-only: the network-reaching tools are marked
/// as exfiltration sinks (so any confidential data flowing into them is
/// caught), and the file/process tools get capability tags so forbidden
/// orderings can be expressed against them. Nothing is marked confidential
/// by default — a project declares which of *its* tools/sources produce
/// sensitive data in `.car/tool-labels.json`.
pub fn builtin_tool_labels() -> HashMap<String, ToolLabels> {
    fn sink(capability: &str) -> ToolLabels {
        ToolLabels {
            capability: Some(capability.to_string()),
            sink: true,
            ..Default::default()
        }
    }
    fn cap(capability: &str) -> ToolLabels {
        ToolLabels {
            capability: Some(capability.to_string()),
            ..Default::default()
        }
    }
    fn source(capability: &str, confidentiality: Confidentiality) -> ToolLabels {
        ToolLabels {
            capability: Some(capability.to_string()),
            confidentiality,
            ..Default::default()
        }
    }
    let mut m = HashMap::new();
    // Network-reaching tools are exfiltration sinks.
    m.insert("http_request".to_string(), sink("net_send"));
    m.insert("web_search".to_string(), sink("net_send"));
    // Keep the established generic browser classification and label every
    // concrete `browse_*` / `browser_*` name the browser executor exposes.
    // Otherwise page content from either surface comes back as trusted Internal
    // text even though it crossed the network boundary.
    m.insert("browser".to_string(), sink("net_send"));
    for tool in [
        "browse_navigate",
        "browse_click",
        "browse_type",
        "browse_scroll",
        "browse_keypress",
        "browse_wait",
        "browse_observe",
        "browser_await_answer",
        "browser_await_signin",
        "browser_record_start",
        "browser_record_stop",
    ] {
        m.insert(tool.to_string(), sink("net_send"));
    }
    m.insert("search".to_string(), sink("net_send"));
    // Host-side Studio generators submit prompts to external services.
    m.insert("generate_music".to_string(), sink("net_send"));
    m.insert("generate_jingle".to_string(), sink("net_send"));
    m.insert("generate_studio_image".to_string(), sink("net_send"));
    m.insert("generate_song".to_string(), sink("net_send"));
    // Host automation can drive apps, clipboard, browsers, and messaging.
    m.insert("run_applescript".to_string(), sink("host_automation"));
    // Durable assistant memory persists across sessions and process restarts.
    m.insert("remember".to_string(), sink("persistent_memory"));
    m.insert(
        "recall".to_string(),
        source(
            "persistent_memory_read",
            car_verify::infoflow::Confidentiality::Internal,
        ),
    );
    // Vision tools read user/workspace images. OCR and classification output can
    // expose private screenshots, scans, photos, or generated artifacts.
    m.insert(
        "read_image_text".to_string(),
        source(
            "vision_read",
            car_verify::infoflow::Confidentiality::Internal,
        ),
    );
    m.insert(
        "classify_image".to_string(),
        source(
            "vision_read",
            car_verify::infoflow::Confidentiality::Internal,
        ),
    );
    // Filesystem + process tools: capability-tagged, not sinks.
    m.insert("read_file".to_string(), cap("fs_read"));
    m.insert("write_file".to_string(), cap("fs_write"));
    m.insert("edit_file".to_string(), cap("fs_write"));
    m.insert("list_dir".to_string(), cap("fs_read"));
    m.insert("find_files".to_string(), cap("fs_read"));
    m.insert("grep_files".to_string(), cap("fs_read"));
    m.insert("shell".to_string(), cap("process_exec"));
    m
}

fn merge_builtin_label(builtin: ToolLabels, project: ToolLabels) -> ToolLabels {
    let capability = builtin.capability.clone().or(project.capability);
    let confidentiality = std::cmp::max(builtin.confidentiality, project.confidentiality);
    let trust = if matches!(builtin.trust, TrustLevel::Untrusted)
        || matches!(project.trust, TrustLevel::Untrusted)
    {
        TrustLevel::Untrusted
    } else {
        TrustLevel::Trusted
    };

    ToolLabels {
        capability,
        confidentiality,
        trust,
        sink: builtin.sink || project.sink,
        declassifier: builtin.declassifier,
    }
}

fn merge_flow_policy(builtin: FlowPolicy, project: FlowPolicy) -> FlowPolicy {
    let mut forbidden_sequences = builtin.forbidden_sequences;
    forbidden_sequences.extend(project.forbidden_sequences);
    forbidden_sequences.sort();
    forbidden_sequences.dedup();

    FlowPolicy {
        min_confidential: std::cmp::min(builtin.min_confidential, project.min_confidential),
        forbidden_sequences,
    }
}

fn merge_gate_policy(builtin: FlowGatePolicy, project: FlowGatePolicy) -> FlowGatePolicy {
    FlowGatePolicy {
        on_sensitive_to_sink: std::cmp::max(
            builtin.on_sensitive_to_sink,
            project.on_sensitive_to_sink,
        ),
        on_forbidden_sequence: std::cmp::max(
            builtin.on_forbidden_sequence,
            project.on_forbidden_sequence,
        ),
    }
}

/// Load tool labels for a project, merging `.car/tool-labels.json` with the
/// built-in defaults.
///
/// `car_dir` is the project's `.car` directory; this reads
/// `car_dir/tool-labels.json` if present. Built-in labels are the base;
/// project labels can add new tools or strengthen built-ins, but cannot weaken
/// built-in sinks, capabilities, taint sources, trust labels, or enforcement
/// defaults. A missing file is not an error (returns builtins + default
/// policies); a malformed file *is* an error.
pub fn load_tool_labels(car_dir: impl AsRef<Path>) -> Result<ToolLabelConfig, FlowLoadError> {
    let mut config = ToolLabelConfig {
        labels: builtin_tool_labels(),
        flow_policy: FlowPolicy::default(),
        gate_policy: FlowGatePolicy::default(),
    };
    let path = car_dir.as_ref().join("tool-labels.json");
    if !path.exists() {
        return Ok(config);
    }
    let src = std::fs::read_to_string(&path).map_err(|e| FlowLoadError {
        message: format!("reading {}: {e}", path.display()),
    })?;
    let file: ToolLabelConfig = serde_json::from_str(&src).map_err(|e| FlowLoadError {
        message: format!("parsing {}: {e}", path.display()),
    })?;
    for (name, project_label) in file.labels {
        match config.labels.remove(&name) {
            Some(builtin_label) => {
                config
                    .labels
                    .insert(name, merge_builtin_label(builtin_label, project_label));
            }
            None => {
                config.labels.insert(name, project_label);
            }
        }
    }
    config.flow_policy = merge_flow_policy(config.flow_policy, file.flow_policy);
    config.gate_policy = merge_gate_policy(config.gate_policy, file.gate_policy);
    Ok(config)
}

/// An [`AdmissionGate`] that enforces information-flow safety: confidential
/// data must not reach an exfiltration sink, and forbidden tool orderings
/// are escalated to human approval.
pub struct InformationFlowGate {
    labels: HashMap<String, ToolLabels>,
    flow_policy: FlowPolicy,
    gate_policy: FlowGatePolicy,
}

impl InformationFlowGate {
    /// Build a gate from a resolved [`ToolLabelConfig`].
    pub fn new(config: ToolLabelConfig) -> Self {
        Self {
            labels: config.labels,
            flow_policy: config.flow_policy,
            gate_policy: config.gate_policy,
        }
    }

    /// Build a gate from the built-in defaults only.
    pub fn with_builtin_labels() -> Self {
        Self::new(ToolLabelConfig {
            labels: builtin_tool_labels(),
            ..Default::default()
        })
    }
}

#[async_trait::async_trait]
impl AdmissionGate for InformationFlowGate {
    fn name(&self) -> &str {
        "information_flow"
    }

    async fn check(&self, proposal: &ActionProposal, _ctx: &GateContext<'_>) -> GateOutcome {
        let report = check_information_flow(proposal, &self.labels, &self.flow_policy);
        if report.safe {
            return GateOutcome::Allow;
        }
        let decision = gate_flow(&report, &self.gate_policy);
        match decision.action {
            FlowAction::Allow => GateOutcome::Allow,
            FlowAction::Block => {
                let blocked: HashSet<String> = decision
                    .blocked
                    .iter()
                    .flat_map(|v| v.actions.iter().cloned())
                    .collect();
                GateOutcome::Reject {
                    blocked,
                    reason: decision.reason,
                }
            }
            FlowAction::RequireApproval => {
                let actions: HashSet<String> = decision
                    .needs_approval
                    .iter()
                    .flat_map(|v| v.actions.iter().cloned())
                    .collect();
                // Stable fingerprint over EVERY hazard (linus review C-8):
                // fingerprinting only the first hazard let one approval
                // admit hazards 2..n. Sorted for order independence, then
                // HASHED — the components carry model-chosen action ids
                // and state keys, so a delimiter-joined ledger key would
                // be forgeable by embedding the separator (same fix as
                // the intent gate; a ledger key is a security identity).
                let mut fps: Vec<String> = decision
                    .needs_approval
                    .iter()
                    .map(car_policy::flow_fingerprint)
                    .collect();
                fps.sort();
                fps.dedup();
                let fingerprint = if fps.is_empty() {
                    "flow:unknown".to_string()
                } else {
                    use sha2::Digest;
                    let canonical = serde_json::to_string(&fps).unwrap_or_default();
                    format!(
                        "flow:sha256:{:x}",
                        sha2::Sha256::digest(canonical.as_bytes())
                    )
                };
                GateOutcome::NeedsApproval {
                    actions,
                    fingerprint,
                    reason: decision.reason,
                }
            }
        }
    }
}

/// Error raised while loading `.car/tool-labels.json`.
#[derive(Debug, Clone)]
pub struct FlowLoadError {
    pub message: String,
}

impl fmt::Display for FlowLoadError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "tool-labels load error: {}", self.message)
    }
}

impl std::error::Error for FlowLoadError {}

#[cfg(test)]
mod tests {
    use super::*;
    use car_ir::{Action, ActionType};

    fn tool_action(id: &str, tool: &str) -> Action {
        {
            let mut a = Action::new(ActionType::ToolCall);
            a.id = id.to_string();
            a.tool = Some(tool.to_string());
            a.max_retries = 0;
            a
        }
    }

    fn proposal(actions: Vec<Action>) -> ActionProposal {
        ActionProposal {
            id: "p".to_string(),
            source: "test".to_string(),
            actions,
            timestamp: chrono::Utc::now(),
            context: HashMap::new(),
        }
    }

    #[test]
    fn builtins_mark_network_tools_as_sinks() {
        let labels = builtin_tool_labels();
        assert!(labels.get("http_request").unwrap().sink);
        assert!(labels.get("web_search").unwrap().sink);
        assert!(labels.get("generate_music").unwrap().sink);
        assert!(labels.get("generate_jingle").unwrap().sink);
        assert!(labels.get("generate_studio_image").unwrap().sink);
        assert!(labels.get("generate_song").unwrap().sink);
        assert!(labels.get("run_applescript").unwrap().sink);
        assert!(labels.get("remember").unwrap().sink);
        assert!(labels.get("browser").unwrap().sink);
        assert!(!labels.get("read_file").unwrap().sink);
    }

    #[test]
    fn builtins_mark_recall_as_internal_source() {
        let labels = builtin_tool_labels();
        let recall = labels.get("recall").unwrap();
        assert_eq!(
            recall.confidentiality,
            car_verify::infoflow::Confidentiality::Internal
        );
        assert!(!recall.sink);
    }

    #[test]
    fn builtins_mark_vision_tools_as_internal_sources() {
        let labels = builtin_tool_labels();
        for name in ["read_image_text", "classify_image"] {
            let label = labels.get(name).unwrap();
            assert_eq!(
                label.confidentiality,
                car_verify::infoflow::Confidentiality::Internal,
                "{name} should carry internal taint"
            );
            assert!(!label.sink, "{name} is a source, not a sink");
        }
    }

    #[tokio::test]
    async fn clean_proposal_is_allowed() {
        let gate = InformationFlowGate::with_builtin_labels();
        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        // read_file then http_request with no declared confidential data:
        // nothing sensitive flows, so it's safe.
        let p = proposal(vec![
            tool_action("a1", "read_file"),
            tool_action("a2", "http_request"),
        ]);
        assert!(matches!(gate.check(&p, &ctx).await, GateOutcome::Allow));
    }

    #[tokio::test]
    async fn confidential_to_sink_is_blocked() {
        // Label a custom source as Secret; it flows into http_request (a
        // sink) via a shared state key.
        let mut labels = builtin_tool_labels();
        labels.insert(
            "read_secret".to_string(),
            ToolLabels {
                capability: Some("fs_read".to_string()),
                confidentiality: car_verify::infoflow::Confidentiality::Secret,
                ..Default::default()
            },
        );
        let gate = InformationFlowGate::new(ToolLabelConfig {
            labels,
            ..Default::default()
        });

        // a1 reads a secret into key "data"; a2 (http_request sink) reads it.
        let mut a1 = tool_action("a1", "read_secret");
        a1.expected_effects = [("data".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "http_request");
        a2.state_dependencies = vec!["data".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "secret reaching a sink must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn confidential_to_web_search_is_blocked() {
        let mut labels = builtin_tool_labels();
        labels.insert(
            "read_secret".to_string(),
            ToolLabels {
                capability: Some("fs_read".to_string()),
                confidentiality: car_verify::infoflow::Confidentiality::Secret,
                ..Default::default()
            },
        );
        let gate = InformationFlowGate::new(ToolLabelConfig {
            labels,
            ..Default::default()
        });

        let mut a1 = tool_action("a1", "read_secret");
        a1.expected_effects = [("query".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "web_search");
        a2.state_dependencies = vec!["query".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "secret reaching web_search must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn recalled_memory_to_web_search_is_blocked_by_default() {
        let gate = InformationFlowGate::with_builtin_labels();
        let mut a1 = tool_action("a1", "recall");
        a1.expected_effects = [("memory_context".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "web_search");
        a2.state_dependencies = vec!["memory_context".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "recalled durable memory reaching web_search must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn image_text_to_web_search_is_blocked_by_default() {
        let gate = InformationFlowGate::with_builtin_labels();
        let mut a1 = tool_action("a1", "read_image_text");
        a1.expected_effects = [("ocr_text".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "web_search");
        a2.state_dependencies = vec!["ocr_text".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "OCR output reaching web_search must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn image_classification_to_persistent_memory_is_blocked_by_default() {
        let gate = InformationFlowGate::with_builtin_labels();
        let mut a1 = tool_action("a1", "classify_image");
        a1.expected_effects = [("image_labels".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "remember");
        a2.state_dependencies = vec!["image_labels".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "image classification output reaching persistent memory must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn confidential_to_studio_generator_is_blocked() {
        let mut labels = builtin_tool_labels();
        labels.insert(
            "read_secret".to_string(),
            ToolLabels {
                capability: Some("fs_read".to_string()),
                confidentiality: car_verify::infoflow::Confidentiality::Secret,
                ..Default::default()
            },
        );
        let gate = InformationFlowGate::new(ToolLabelConfig {
            labels,
            ..Default::default()
        });

        let mut a1 = tool_action("a1", "read_secret");
        a1.expected_effects = [("prompt".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "generate_studio_image");
        a2.state_dependencies = vec!["prompt".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "secret reaching a Studio generator must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn confidential_to_host_automation_is_blocked() {
        let mut labels = builtin_tool_labels();
        labels.insert(
            "read_secret".to_string(),
            ToolLabels {
                capability: Some("fs_read".to_string()),
                confidentiality: car_verify::infoflow::Confidentiality::Secret,
                ..Default::default()
            },
        );
        let gate = InformationFlowGate::new(ToolLabelConfig {
            labels,
            ..Default::default()
        });

        let mut a1 = tool_action("a1", "read_secret");
        a1.expected_effects = [("script".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "run_applescript");
        a2.state_dependencies = vec!["script".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "secret reaching host automation must be blocked, got {outcome:?}"
        );
    }

    #[tokio::test]
    async fn confidential_to_persistent_memory_is_blocked() {
        let mut labels = builtin_tool_labels();
        labels.insert(
            "read_secret".to_string(),
            ToolLabels {
                capability: Some("fs_read".to_string()),
                confidentiality: car_verify::infoflow::Confidentiality::Secret,
                ..Default::default()
            },
        );
        let gate = InformationFlowGate::new(ToolLabelConfig {
            labels,
            ..Default::default()
        });

        let mut a1 = tool_action("a1", "read_secret");
        a1.expected_effects = [("fact".to_string(), serde_json::Value::from(1))].into();
        let mut a2 = tool_action("a2", "remember");
        a2.state_dependencies = vec!["fact".to_string()];

        let ctx_state = HashMap::new();
        let ctx_versions = HashMap::new();
        let ctx = GateContext {
            session_id: None,
            scope: None,
            state: &ctx_state,
            versions: &ctx_versions,
        };
        let outcome = gate.check(&proposal(vec![a1, a2]), &ctx).await;
        assert!(
            matches!(outcome, GateOutcome::Reject { .. }),
            "secret reaching persistent memory must be blocked, got {outcome:?}"
        );
    }

    #[test]
    fn load_missing_file_returns_builtins() {
        let cfg = load_tool_labels("/nonexistent/.car").unwrap();
        assert!(cfg.labels.contains_key("http_request"));
        assert!(cfg.labels.contains_key("web_search"));
        assert!(cfg.labels.contains_key("generate_studio_image"));
        assert!(cfg.labels.contains_key("run_applescript"));
        assert!(cfg.labels.contains_key("remember"));
        assert!(cfg.labels.contains_key("recall"));
        assert!(cfg.labels.contains_key("read_image_text"));
        assert!(cfg.labels.contains_key("classify_image"));
    }

    #[test]
    fn load_merges_file_without_weakening_builtins() {
        let dir = std::env::temp_dir().join(format!("car_flow_{}", std::process::id()));
        std::fs::create_dir_all(&dir).unwrap();
        std::fs::write(
            dir.join("tool-labels.json"),
            r#"{
                "labels": {
                    "my_tool": {"confidentiality": "secret"},
                    "http_request": {"capability": "not_net", "sink": false},
                    "recall": {"confidentiality": "public"},
                    "remember": {"sink": false, "declassifier": true}
                },
                "flow_policy": {
                    "min_confidential": "secret",
                    "forbidden_sequences": [["fs_read", "net_send"]]
                },
                "gate_policy": {
                    "on_sensitive_to_sink": "allow",
                    "on_forbidden_sequence": "block"
                }
            }"#,
        )
        .unwrap();
        let cfg = load_tool_labels(&dir).unwrap();
        // New tool added.
        assert_eq!(
            cfg.labels.get("my_tool").unwrap().confidentiality,
            car_verify::infoflow::Confidentiality::Secret
        );
        // Built-in sinks/capabilities and internal sources cannot be weakened by
        // project-local policy files.
        let http = cfg.labels.get("http_request").unwrap();
        assert!(http.sink);
        assert_eq!(http.capability.as_deref(), Some("net_send"));
        assert_eq!(
            cfg.labels.get("recall").unwrap().confidentiality,
            car_verify::infoflow::Confidentiality::Internal
        );
        let remember = cfg.labels.get("remember").unwrap();
        assert!(remember.sink);
        assert!(!remember.declassifier);
        assert_eq!(
            cfg.flow_policy.min_confidential,
            car_verify::infoflow::Confidentiality::Internal
        );
        assert_eq!(
            cfg.flow_policy.forbidden_sequences,
            vec![("fs_read".to_string(), "net_send".to_string())]
        );
        assert_eq!(
            cfg.gate_policy.on_sensitive_to_sink,
            car_verify::infoflow::FlowAction::Block
        );
        assert_eq!(
            cfg.gate_policy.on_forbidden_sequence,
            car_verify::infoflow::FlowAction::Block
        );
        // Untouched built-in preserved.
        assert!(cfg.labels.contains_key("read_file"));
        std::fs::remove_dir_all(&dir).ok();
    }

    #[test]
    fn load_malformed_file_is_error() {
        let dir = std::env::temp_dir().join(format!("car_flow_bad_{}", std::process::id()));
        std::fs::create_dir_all(&dir).unwrap();
        std::fs::write(dir.join("tool-labels.json"), "{not json").unwrap();
        assert!(load_tool_labels(&dir).is_err());
        std::fs::remove_dir_all(&dir).ok();
    }
}

#[cfg(test)]
mod provenance_classification_tests {
    use super::*;

    #[test]
    fn network_reaching_builtins_are_external() {
        let labels = builtin_tool_labels();
        for tool in ["web_search", "http_request", "browser", "search"] {
            assert!(
                tool_output_is_external(tool, &labels),
                "{tool} reaches the network — its output is outside the trust boundary"
            );
        }
    }

    #[test]
    fn coder_browser_builtins_are_external() {
        let labels = builtin_tool_labels();
        for tool in [
            "browse_navigate",
            "browse_click",
            "browse_type",
            "browse_scroll",
            "browse_keypress",
            "browse_wait",
            "browse_observe",
            "browser_await_answer",
            "browser_await_signin",
            "browser_record_start",
            "browser_record_stop",
        ] {
            assert!(
                tool_output_is_external(tool, &labels),
                "{tool} reaches a network-backed browser — its output is outside the trust boundary"
            );
        }
    }

    #[test]
    fn local_tools_are_not_external() {
        let labels = builtin_tool_labels();
        // run_applescript is a sink (host automation) but not a network source;
        // recall reads local persistent memory. Neither returns fetched bytes.
        for tool in ["run_applescript", "recall", "read_image_text"] {
            assert!(
                !tool_output_is_external(tool, &labels),
                "{tool} does not fetch from outside the trust boundary"
            );
        }
    }

    #[test]
    fn unlabeled_tool_is_not_external() {
        // Documents the known blind spot rather than pretending it away: an
        // unlabeled tool is invisible here exactly as it is to the flow gate.
        let labels = builtin_tool_labels();
        assert!(!tool_output_is_external("some_new_tool", &labels));
    }

    #[test]
    fn explicit_untrusted_label_is_honoured() {
        // A project's own tool that reads from somewhere untrusted without
        // being a network sink.
        let mut labels = builtin_tool_labels();
        labels.insert(
            "scrape_intranet".to_string(),
            ToolLabels {
                trust: TrustLevel::Untrusted,
                ..Default::default()
            },
        );
        assert!(tool_output_is_external("scrape_intranet", &labels));
    }

    #[test]
    fn a_new_net_send_tool_is_classified_without_touching_this_function() {
        // The reason classification derives from the labels: labeling a new
        // network tool for the flow gate also classifies its output here.
        let mut labels = builtin_tool_labels();
        labels.insert(
            "fetch_rss".to_string(),
            ToolLabels {
                capability: Some(NET_SEND.to_string()),
                sink: true,
                ..Default::default()
            },
        );
        assert!(tool_output_is_external("fetch_rss", &labels));
    }
}