fix(langchain): enforce the tool allowlist in handleToolStart

[aymandakirgh]

Why

aegisCallbackHandler({ allowedTools: [...] }) accepted an allowlist but never enforced it. handleToolStart only ran an OUTPUT-scope content scan of the tool input, while the LLM08 tool-call-OOB allowlist guard and the tool-only SSRF patterns run only under TOOL scope. A user who set allowedTools on the LangChain handler reasonably expected tool gating, but every out-of-allowlist tool call passed through silently.

Reproduction on main (before): aegisCallbackHandler({ allowedTools: ['search'] }).handleToolStart({}, 'delete_db') resolved without blocking — allowlist ignored.

What

When an allowlist is configured (via options.allowedTools, policy.allowedTools, or the ALLOWED_TOOLS env var), handleToolStart now runs a TOOL-scope scan of the tool identity and throws AegisBlockedError("tool", ...) on a violation.

• Tool identity is resolved from LangChain's serialized tool descriptor (.name, or the last segment of .id), falling back to the input string when the descriptor has no name.
• The allowlist is only enforced when one is configured — an empty list fails closed and would otherwise block every tool, so unguarded chains are unaffected (no regression).
• The existing OUTPUT-scope scan of tool arguments (dangerous commands / secrets) is preserved.
• No new dependencies; the adapter stays a zero-@langchain/*-dependency structural shim.

Verification

• npm run typecheck — clean
• npm run lint — clean
• npm test — 319 passed / 1 skipped (added 10 regression tests in tests/langchain.test.ts)
• Probe (node/tsx) before vs after:
  • handleToolStart({}, "delete_db") → BLOCKED (tool) TOOL_CALL_OOB
  • handleToolStart({}, "search") → passes
  • handleToolStart({ name: "delete_db" }, args) → BLOCKED
  • handleToolStart({ name: "search" }, args) → passes
  • no allowlist configured → tool calls pass; dangerous args still blocked under output scope

🤖 Generated with Claude Code