[WRONG BRANCH] fix(responses): honor namespace tool_choice when restoring routed namespace aliases

[luvs01]

Motivation

• The routed namespace compatibility layer exposed a bug where flattened namespace aliases were restored for the client without checking the per-turn tool_choice, allowing a noncanonical upstream to cause restoration of tools the caller did not authorize.
• The intent of the change is to keep response restoration inside the caller's per-turn authorization boundary so upstream output cannot escalate a disallowed namespace child into an executable client call.

Description

• Add an authorizedAliases helper in src/responses/namespace-tool-compat.ts that filters the request-local alias map to only those wire names authorized by the turn's tool_choice.
• Use authorizedAliases(plan.aliases, toolChoice) when returning the upstream-rewritten body so downstream restoration only ever sees authorized aliases.
• Add a focused regression test in tests/namespace-tool-compat.test.ts that asserts excluded namespace aliases are not armed or restored for allowed_tools, forced selectors, and the "none" case.

Testing

• Ran the focused unit test: bun test tests/namespace-tool-compat.test.ts and it passed.
• Ran static checks and larger test set: bun run typecheck, bun run test, and bun run privacy:scan, and all completed successfully in the environment used for verification.

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1a9f4da1-cf42-41f5-b74c-205671a66c06

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.