[luv-293] fix: canonicalize tool names across all agent CLIs so builtin policies fire

[NiveditJain]

Summary

• Builtin policies (["Bash"], ["Read","Glob","Grep","Bash"], …) match on tool names with case-sensitive Array.includes at policy-registry.ts:93-95, but Copilot's tool registry emits lowercase IDs (bash, read, …) — every Bash/Read/Write/Edit builtin silently no-ops under Copilot.
• Adds COPILOT_TOOL_MAP (handler-side) plus OPENCODE_TOOL_MAP / PI_TOOL_MAP (shim-side; the OpenCode and Pi shims embed identical maps inline since they're loaded in-process by their host CLI). Replaces Pi's naive charAt(0).toUpperCase() heuristic that would have mis-canonicalized future multi-word tool IDs.
• E2e fixture for Copilot now uses the real lowercase shape so the suite catches future regressions in this layer.

User-reported regression

Under GitHub Copilot CLI, an out-of-cwd ls piped through sed ran successfully despite an enabled block-read-outside-cwd policy. The same flow blocks correctly under Claude Code today.

Test plan

• bun run test:run — 1457/1457 pass (added 4 unit tests covering the new Copilot canonicalization).
• bun run test:e2e — 290/290 pass (added a pinned regression test in __tests__/e2e/hooks/copilot-integration.e2e.test.ts).
• bunx tsc --noEmit — clean.
• bun run lint — clean (only the pre-existing app/components/log-viewer/tool-input-output.tsx warning unrelated to this PR).
• Manual repro pre-fix vs post-fix via the binary directly: payload with tool_name: bash and an out-of-cwd ls now returns permissionDecision: deny (pre-fix: allow).
• Empirical capture of real-CLI stdin under Codex / Cursor / OpenCode / Pi to confirm tool-name shapes assumed in OPENCODE_TOOL_MAP / PI_TOOL_MAP (bash, read, write, edit, glob, grep, plus OpenCode's list, webfetch, todowrite, todoread). The handler/shim's ?? raw fallback keeps unknown tools functional even if the assumed set is incomplete; the regression test pins behaviour for bash specifically. Codex and Cursor remain passthrough until empirical evidence shows otherwise (per docs they're already PascalCase).

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes

• Enhanced compatibility across Copilot, OpenCode, and Pi agents with improved tool handling, ensuring built-in policies function consistently
• Corrected session log viewer vertical positioning to prevent list items from displaying at stale offsets after layout changes
• Added installation diagnostics to detect shadowed or conflicting installs, providing version information and copy-pasteable cleanup commands

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 547d5bbf-5263-499c-a466-0bd03ce1a839

📥 Commits

Reviewing files that changed from the base of the PR and between 2497f5d and 0e87eaf.

📒 Files selected for processing (9)

• CHANGELOG.md
• __tests__/e2e/helpers/payloads.ts
• __tests__/e2e/hooks/copilot-integration.e2e.test.ts
• __tests__/hooks/handler.test.ts
• __tests__/hooks/opencode-plugin-shim.test.ts
• pi-extension/index.ts
• src/hooks/handler.ts
• src/hooks/integrations.ts
• src/hooks/types.ts

---

📝 Walkthrough

Walkthrough

Tool-name canonicalization is introduced across Copilot, OpenCode, and Pi agent CLIs via new tool-name mapping constants (COPILOT_TOOL_MAP, OPENCODE_TOOL_MAP, PI_TOOL_MAP). These maps normalize lowercase tool IDs to Claude PascalCase names before policy evaluation. The handler, OpenCode shim, and Pi extension are updated to canonicalize incoming tool names. Comprehensive unit and end-to-end tests verify the canonicalization behavior.

Changes

Tool-Name Canonicalization Across Agent CLIs

Layer / File(s)	Summary
Tool Mapping Constants src/hooks/types.ts	Defines three new exported constants: COPILOT_TOOL_MAP, OPENCODE_TOOL_MAP, and PI_TOOL_MAP, each mapping lowercase/snake_case tool IDs to PascalCase canonical names (e.g., bash → Bash, str_replace_editor → StrReplaceEditor).
Handler Canonicalization src/hooks/handler.ts	Handler imports COPILOT_TOOL_MAP and extends canonicalizeToolName to canonicalize Copilot tool IDs via map lookup before policy evaluation and activity logging.
OpenCode Shim Integration src/hooks/integrations.ts	OpenCode plugin shim template adds inline TOOL_NAME_MAP and canonicalizeTool helper; shim now canonicalizes tool IDs from input.tool before passing to PreToolUse, PostToolUse, and PermissionRequest hooks.
Pi Extension Integration pi-extension/index.ts	Pi extension replaces generic first-character capitalization with explicit PI_TOOL_MAP lookup in canonicalizeToolName, supporting {bash, read, write, edit, glob, grep} tool IDs.
Test Fixtures __tests__/e2e/helpers/payloads.ts	Copilot payload factories are updated to emit lowercase tool IDs (bash, write, read) in tool_name fields, reflecting the actual Copilot event structure.
Canonicalization Unit Tests __tests__/hooks/handler.test.ts	Three new test cases verify Copilot tool canonicalization: (1) bash maps to Bash before policy evaluation, (2) all entries in COPILOT_TOOL_MAP are canonicalized correctly, (3) unknown Copilot tool names pass through unchanged.
Shim Canonicalization Tests __tests__/hooks/opencode-plugin-shim.test.ts	Updated tool.execute.before assertion from "bash" to "Bash"; added two new tests verifying unknown tools pass through unchanged and all OPENCODE_TOOL_MAP entries canonicalize correctly.
E2E Integration Test __tests__/e2e/hooks/copilot-integration.e2e.test.ts	New regression test verifies Copilot PreToolUse hook correctly blocks Bash commands targeting paths outside cwd under the block-read-outside-cwd policy.
Changelog CHANGELOG.md	Documents tool-name canonicalization feature along with unrelated fixes for session log viewer vertical positioning and PATH shadow detection for failproofai.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰✨ Tool names canonicalized, now they're all the same,
Copilot, OpenCode, and Pi—each speaks Claude's name!
Maps and maps and maps galore, from lowercase to tall,
Policy denials sing so clear, when Bash answers the call.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: canonicalizing tool names across agent CLIs to fix builtin policy matching.
Description check	✅ Passed	The PR description covers the problem statement, solution, user-reported regression, and test plan with comprehensive details matching the template's requirements.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}