fix: govern acall in the sync LlamaIndex wrapper — async agents bypassed the gate

govern_llamaindex_tool replaced only `tool.call` and returned. LlamaIndex agents
invoke `acall` for async execution, so a tool wrapped by the sync governor ran
with no evaluate, no approval and no audit trace on that path. Unlike the
denylist work in 1476fcd/54b2899, this one was a live bypass rather than a
latent one — nothing upstream guarded it, and no warning was emitted.

The async sibling (govern_llamaindex_tool_async) already wrapped both methods;
only the sync wrapper was incomplete.

The client here is synchronous, so its blocking HTTP calls run via
anyio.to_thread.run_sync rather than stalling the caller's event loop. anyio is
already a hard dependency. Tools that do not expose `acall` are unaffected —
getattr guards the wrap.

4 new tests: acall denied does not execute and does reach the policy engine;
acall allowed executes; sync call still governed; a tool without acall still
works. Mutation-checked — removing the wrap fails 2 of them.

204 tests pass, ruff clean. Still unpublished at 0.2.1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: VladUZH

src/sidclaw/middleware/llamaindex.py

@@ -21,8 +21,11 @@
 """
 from __future__ import annotations
 
+import functools
 from typing import Any
 
+import anyio.to_thread
+
 from .._client import AsyncSidClaw, SidClaw
 from .._types import DataClassification
 from ._base import (
@@ -59,7 +62,9 @@ def govern_llamaindex_tool(
         data_classification: Data classification level (default: "internal").
 
     Returns:
-        The same tool with its ``call`` method wrapped.
+        The same tool with both ``call`` and ``acall`` wrapped. ``acall`` is
+        governed too because LlamaIndex agents use it for async execution;
+        wrapping only ``call`` left that path ungoverned.
     """
     integration = target_integration or tool.metadata.name
     original_call = tool.call
@@ -86,6 +91,45 @@ def governed_call(*args: Any, **kwargs: Any) -> Any:
             raise
 
     tool.call = governed_call
+
+    # LlamaIndex agents invoke `acall` for async execution. This wrapper used to
+    # replace only `call`, so an async agent bypassed governance entirely — the
+    # tool ran with no evaluate, no approval, and no audit trace. The client here
+    # is synchronous, so its blocking HTTP calls run in a worker thread rather
+    # than stalling the event loop.
+    original_acall = getattr(tool, "acall", None)
+    if original_acall is not None:
+
+        async def governed_acall(*args: Any, **kwargs: Any) -> Any:
+            decision = await anyio.to_thread.run_sync(
+                functools.partial(
+                    evaluate_governance_sync,
+                    client,
+                    tool.metadata.name,
+                    target_integration=integration,
+                    resource_scope=resource_scope,
+                    data_classification=data_classification,
+                    context={
+                        "input": args[0] if args else kwargs,
+                        "tool_description": tool.metadata.description,
+                    },
+                )
+            )
+
+            try:
+                result = await original_acall(*args, **kwargs)
+                await anyio.to_thread.run_sync(
+                    functools.partial(record_outcome_sync, client, decision.trace_id)
+                )
+                return result
+            except Exception as e:
+                await anyio.to_thread.run_sync(
+                    functools.partial(record_outcome_sync, client, decision.trace_id, e)
+                )
+                raise
+
+        tool.acall = governed_acall
+
     return tool
 
 

tests/test_llamaindex_middleware.py

@@ -320,3 +320,97 @@ async def test_wraps_all_tools(self, async_client: AsyncSidClaw, mock_api: respx
     async def test_empty_list(self, async_client: AsyncSidClaw, mock_api: respx.MockRouter):
         governed = govern_llamaindex_tools_async(async_client, [])
         assert governed == []
+
+
+class TestSyncWrapperGovernsAcall:
+    """`govern_llamaindex_tool` wrapped only `call`, leaving `acall` ungoverned.
+
+    LlamaIndex agents invoke `acall` for async execution, so a tool governed by
+    the sync wrapper ran with no evaluate, no approval and no audit trace on
+    that path — a real bypass, not a latent one.
+    """
+
+    class _Meta:
+        name = "search_docs"
+        description = "search"
+
+    class _Tool:
+        def __init__(self):
+            self.metadata = TestSyncWrapperGovernsAcall._Meta()
+            self.sync_ran = False
+            self.async_ran = False
+
+        def call(self, *a, **k):
+            self.sync_ran = True
+            return "sync-result"
+
+        async def acall(self, *a, **k):
+            self.async_ran = True
+            return "async-result"
+
+    def _client(self, decision: str):
+        from unittest.mock import MagicMock
+
+        from sidclaw._types import EvaluateResponse
+
+        c = MagicMock()
+        c.evaluate.return_value = EvaluateResponse(
+            decision=decision,
+            trace_id="t-1",
+            approval_request_id=None,
+            reason="r",
+            policy_rule_id=None,
+        )
+        c.record_outcome.return_value = None
+        return c
+
+    async def test_acall_is_governed_and_denied(self):
+        from sidclaw._errors import ActionDeniedError
+        from sidclaw.middleware.llamaindex import govern_llamaindex_tool
+
+        tool = self._Tool()
+        client = self._client("deny")
+        governed = govern_llamaindex_tool(client, tool)
+
+        with pytest.raises(ActionDeniedError):
+            await governed.acall("query")
+
+        assert tool.async_ran is False, "acall executed despite a deny decision"
+        assert client.evaluate.called, "acall did not reach the policy engine at all"
+
+    async def test_acall_is_governed_and_allowed(self):
+        from sidclaw.middleware.llamaindex import govern_llamaindex_tool
+
+        tool = self._Tool()
+        client = self._client("allow")
+        governed = govern_llamaindex_tool(client, tool)
+
+        assert await governed.acall("query") == "async-result"
+        assert tool.async_ran is True
+        assert client.evaluate.called
+
+    def test_sync_call_still_governed(self):
+        from sidclaw._errors import ActionDeniedError
+        from sidclaw.middleware.llamaindex import govern_llamaindex_tool
+
+        tool = self._Tool()
+        client = self._client("deny")
+        governed = govern_llamaindex_tool(client, tool)
+
+        with pytest.raises(ActionDeniedError):
+            governed.call("query")
+        assert tool.sync_ran is False
+
+    def test_tool_without_acall_still_works(self):
+        """Not every LlamaIndex tool exposes acall — must not crash."""
+        from sidclaw.middleware.llamaindex import govern_llamaindex_tool
+
+        class NoAcall:
+            metadata = TestSyncWrapperGovernsAcall._Meta()
+
+            def call(self, *a, **k):
+                return "ok"
+
+        client = self._client("allow")
+        governed = govern_llamaindex_tool(client, NoAcall())
+        assert governed.call("q") == "ok"