From 148623f07ed04d0775203c96e1f1ada0e74b71e5 Mon Sep 17 00:00:00 2001
From: Leandro Barbosa <leandrobar93@gmail.com>
Date: Wed, 18 Feb 2026 15:45:29 -0300
Subject: [PATCH] feat: add tool group definitions for policy-based filtering

Define DefaultToolGroups mapping group references (e.g. "group:fs",
"group:web") to concrete tool names, and ResolveToolNames to expand
group refs into deduplicated tool name lists. This is the foundation
for per-agent tool policies in Phase 2.
---
 pkg/tools/groups.go | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkg/tools/groups.go

diff --git a/pkg/tools/groups.go b/pkg/tools/groups.go
new file mode 100644
index 000000000..247cc7850
--- /dev/null
+++ b/pkg/tools/groups.go
@@ -0,0 +1,39 @@
+package tools
+
+// DefaultToolGroups maps group references (e.g. "group:fs") to tool names.
+// Groups provide a convenient shorthand for tool policies so operators
+// can allow/deny entire categories without listing every tool name.
+var DefaultToolGroups = map[string][]string{
+	"group:fs":     {"read_file", "write_file", "edit_file", "append_file", "list_dir"},
+	"group:web":    {"web_search", "web_fetch"},
+	"group:exec":   {"exec"},
+	"group:hw":     {"i2c", "spi"},
+	"group:comms":  {"message", "spawn"},
+	"group:agents": {"blackboard", "handoff", "list_agents"},
+}
+
+// ResolveToolNames expands group refs (e.g. "group:fs") and individual tool
+// names into a deduplicated list of concrete tool names.
+// Unknown group refs are treated as individual tool names (pass-through).
+func ResolveToolNames(refs []string) []string {
+	seen := make(map[string]struct{}, len(refs))
+	result := make([]string, 0, len(refs))
+
+	for _, ref := range refs {
+		if tools, ok := DefaultToolGroups[ref]; ok {
+			for _, name := range tools {
+				if _, dup := seen[name]; !dup {
+					seen[name] = struct{}{}
+					result = append(result, name)
+				}
+			}
+		} else {
+			if _, dup := seen[ref]; !dup {
+				seen[ref] = struct{}{}
+				result = append(result, ref)
+			}
+		}
+	}
+
+	return result
+}