fix(core): enforce V2 tool permissions (#31061)

packages/core/test/tool-question.test.ts

@@ -11,11 +11,15 @@ const sessionID = SessionV2.ID.make("ses_question_tool_test")
 const assertions: PermissionV2.AssertInput[] = []
 let captured: QuestionV2.AskInput | undefined
 let reject = false
+let deny = false
 const capturedInput = () => captured
 const permission = Layer.succeed(
   PermissionV2.Service,
   PermissionV2.Service.of({
-    assert: (input) => Effect.sync(() => assertions.push(input)),
+    assert: (input) =>
+      Effect.sync(() => assertions.push(input)).pipe(
+        Effect.andThen(deny ? Effect.fail(new PermissionV2.DeniedError({ rules: [] })) : Effect.void),
+      ),
     ask: () => Effect.die("unused"),
     reply: () => Effect.die("unused"),
     get: () => Effect.die("unused"),
@@ -40,11 +44,30 @@ const tool = QuestionTool.layer.pipe(Layer.provide(registry), Layer.provide(ques
 const it = testEffect(Layer.mergeAll(permission, registry, question, tool))
 
 describe("QuestionTool", () => {
+  it.effect("omits a denied built-in question and terminally settles a stale call", () =>
+    Effect.gen(function* () {
+      captured = undefined
+      deny = true
+      const registry = yield* ToolRegistry.Service
+
+      expect(yield* registry.definitions([{ action: "question", resource: "*", effect: "deny" }])).toEqual([])
+      expect(
+        yield* registry.settle({
+          sessionID,
+          call: { type: "tool-call", id: "call-question-denied", name: "question", input: { questions: [] } },
+        }),
+      ).toEqual({ result: { type: "error", value: "Permission denied: question" } })
+      expect(capturedInput()).toBeUndefined()
+      deny = false
+    }),
+  )
+
   it.effect("registers question and projects user answers without a permission assertion", () =>
     Effect.gen(function* () {
       assertions.length = 0
       captured = undefined
       reject = false
+      deny = false
       const registry = yield* ToolRegistry.Service
       const questions = [
         {
@@ -81,7 +104,7 @@ describe("QuestionTool", () => {
           ],
         },
       })
-      expect(assertions).toEqual([])
+      expect(assertions).toEqual([{ sessionID, action: "question", resources: ["*"] }])
       expect(capturedInput()).toEqual({ sessionID, questions, tool: undefined })
     }),
   )
@@ -90,6 +113,7 @@ describe("QuestionTool", () => {
     Effect.gen(function* () {
       captured = undefined
       reject = false
+      deny = false
       const registryService = yield* ToolRegistry.Service
 
       yield* registryService.execute({
@@ -104,6 +128,7 @@ describe("QuestionTool", () => {
     Effect.gen(function* () {
       captured = undefined
       reject = true
+      deny = false
       const registryService = yield* ToolRegistry.Service
       const fiber = yield* registryService
         .execute({