-- lmcp-tools tools.d-room/zz-scope.lua — HARD-SCOPE this room endpoint to room tools only.
--
-- lmcp's core server.lua registers shell/read_file/write_file/edit_file/list_dir/search_files/
-- shell_bg/list_jobs/kill_job/fetch/web_search as BUILT-IN tools on EVERY instance. LMCP_TOOLS_DIR
-- only ADDS plugins on top — it cannot remove built-ins. So a "scoped" room set up by tools-dir
-- alone still exposed a ROOT shell (uid=0) to any client holding the room token, incl. the
-- untrusted-input @foreman. This is the server-side removal the @foreman sandbox always needed.
--
-- Named zz-* so it loads AFTER the room plugins (bullpen.lua, recall.lua); it then deletes every
-- tool except the allowlist from the live registry — so both tools/list and tools/call lose them.
-- Allowlist (not denylist) so any future built-in is stripped automatically too.
local server = ...
local KEEP = { room_say = true, room_read = true, recall = true }
if server and server.tools then
    for name in pairs(server.tools) do
        if not KEEP[name] then server.tools[name] = nil end
    end
end
