fix(agent-permissions): restrict council_session access

src/agents/index.test.ts

@@ -129,6 +129,14 @@ describe('orchestrator agent', () => {
     expect((orchestrator?.config.permission as any).question).toBe('allow');
   });
 
+  test('orchestrator is allowed to invoke council_session', () => {
+    const agents = createAgents();
+    const orchestrator = agents.find((a) => a.name === 'orchestrator');
+    expect((orchestrator?.config.permission as any).council_session).toBe(
+      'allow',
+    );
+  });
+
   test('orchestrator accepts overrides', () => {
     const config: PluginConfig = {
       agents: {
@@ -260,6 +268,26 @@ describe('skill permissions', () => {
   });
 });
 
+describe('tool permissions', () => {
+  test('council agent is allowed to invoke council_session', () => {
+    const agents = createAgents();
+    const council = agents.find((a) => a.name === 'council');
+    expect((council?.config.permission as any).council_session).toBe('allow');
+  });
+
+  test('oracle is denied access to council_session', () => {
+    const agents = createAgents();
+    const oracle = agents.find((a) => a.name === 'oracle');
+    expect((oracle?.config.permission as any).council_session).toBe('deny');
+  });
+
+  test('explorer is denied access to council_session', () => {
+    const agents = createAgents();
+    const explorer = agents.find((a) => a.name === 'explorer');
+    expect((explorer?.config.permission as any).council_session).toBe('deny');
+  });
+});
+
 describe('isSubagent type guard', () => {
   test('returns true for valid subagent names', () => {
     expect(isSubagent('explorer')).toBe(true);

src/agents/index.ts

@@ -31,6 +31,8 @@ type AgentFactory = (
   customAppendPrompt?: string,
 ) => AgentDefinition;
 
+const COUNCIL_TOOL_ALLOWED_AGENTS = new Set(['orchestrator', 'council']);
+
 function normalizeDisplayName(displayName: string): string {
   const trimmed = displayName.trim();
   return trimmed.startsWith('@') ? trimmed.slice(1) : trimmed;
@@ -115,10 +117,14 @@ function applyDefaultPermissions(
 
   // Respect explicit deny on question (councillor)
   const questionPerm = existing.question === 'deny' ? 'deny' : 'allow';
+  const councilSessionPerm =
+    existing.council_session ??
+    (COUNCIL_TOOL_ALLOWED_AGENTS.has(agent.name) ? 'allow' : 'deny');
 
   agent.config.permission = {
     ...existing,
     question: questionPerm,
+    council_session: councilSessionPerm,
     // Apply skill permissions as nested object under 'skill' key
     skill: {
       ...(typeof existing.skill === 'object' ? existing.skill : {}),