feat(tasks): warn when allowedTools match no reachable tool - #1607

QA Review: feat/1601-task-tool-warnings

Scope: 5 files, +155/−11 · worktree: .claude/worktrees/feat-1601-task-tool-warnings · reviewed: 855f07c0
Risk: LOW
Why this exists: a typo or renamed connector in a task's allowedTools now surfaces when the task is written, not as a failed first run (#1601).

Critical (must fix)

None.

Fix in-PR

None.

Suggestions (optional)

• r1s1 [src/platform/tasks/source.ts:566-570] The catch { return []; } around listToolsForWorkspace is right not to fail the write, but it leaves no trace when discovery breaks, so a missing warning can't be told apart from a clean list. A one-line log.warn/debug with the workspace id would fix that. Optional.

What Looks Good

• The warning uses the same reachable set (listToolsForWorkspace(ws, ownerId)) and the same matcher (unmatchedAllowedTools) as assertDeclaredToolsReachable at run start (src/runtime/runtime.ts:2186). That means wildcards, the RUN_DISCOVERY_TOOLS exemption, and granted my_ connectors give the same answer at write time and at run time. No second matcher can drift.
• "Runs fail until…" is accurate for every task path: the run-start check is skipped only for trigger === "chat" (runtime.ts:1587), and a task run is never a chat run.
• Judge and tool warnings resolve concurrently and merge through the existing withWarnings. The tasks UI renders w.message generically (TasksUI.tsx:296), so the new code needs no UI case.
• Mutation-checked: with allowedToolWarnings replaced by [], 5 of the 13 tests in task-allowed-tools.test.ts fail (create, update, inline run, saved run, batches). The tests guard the behavior.

Body claims

• ✅ The three named integration files give 26 passing tests (re-ran at 855f07c0). The wider test/unit/platform/tasks run plus those files gives 638 pass, 0 fail. bun run check is clean.
• ✅ Uses the same matcher and reachable set as run-start validation (see above).
• ✅ Covers saved and inline tasks__run / tasks__run_batch.
• ✅ Generated tasks.d.ts matches the source union.

Verdict: ready to merge. Handoff: pr-adjudicate if the author wants to answer r1s1. Nothing blocks.

{
  "kind": "review", "pr": 1607, "round": 1,
  "reviewed": "855f07c030071010ffe7cdea90a020c5bf29f538", "delta_base": null,
  "risk": "LOW", "stop_gate": "n/a",
  "verdict": "Clean core; warning matches run-start validation exactly; tests mutation-verified. Ship.",
  "findings": [
    {"id": "r1s1", "bucket": "suggestion", "file": "src/platform/tasks/source.ts", "line": 568,
     "claim": "Tool-discovery failure in allowedToolWarnings is swallowed with no log, so a missing warning is indistinguishable from a clean list.",
     "evidence": "reproduced", "receipt": "read source.ts:563-579", "preconditions": null,
     "fix": "log the caught error at warn/debug before returning []", "scope": "peripheral"}
  ]
}

Thanks for the contribution @Coding-Professional