Add M7.6 provider tool access control and M7.7 agent delegation for ToolStep

tests/test_providers.py

@@ -784,3 +784,29 @@ class TestProviderDiscovery:
         assert len({item["name"] for item in models}) == 2
         assert models[0]["name"] == "ollama-hermes4-3-latest"
         assert models[1]["name"] == "ollama-hermes4-3-q4-k-m"
+
+
+class TestProviderAccessControl:
+    def test_tools_allowlist_defaults_to_none(self):
+        provider = Provider("test", "cmd")
+        assert provider.tools is None
+        assert provider.mcp_servers is None
+
+    def test_tools_allowlist_roundtrip(self):
+        provider = Provider("test", "cmd", tools=["tool-a", "tool-b"])
+        d = provider.to_dict()
+        assert d["tools"] == ["tool-a", "tool-b"]
+        restored = Provider.from_dict(d)
+        assert restored.tools == ["tool-a", "tool-b"]
+
+    def test_mcp_servers_roundtrip(self):
+        provider = Provider("test", "cmd", mcp_servers=["filesystem"])
+        d = provider.to_dict()
+        assert d["mcp_servers"] == ["filesystem"]
+        restored = Provider.from_dict(d)
+        assert restored.mcp_servers == ["filesystem"]
+
+    def test_tools_not_in_dict_when_none(self):
+        provider = Provider("test", "cmd")
+        assert "tools" not in provider.to_dict()
+        assert "mcp_servers" not in provider.to_dict()