Add sidecar-bundle loader test

Instantiate the gmail bundle with a real BaseEnv, as the Interchange
tools-mail bundle test does, and check that its static declaration
matches the emitted tool names and gates exactly the mailbox mutations.
The approval check moves here from create-tools.test.ts.

Author: TheGreatAxios

bun.lock

@@ -69,6 +69,7 @@
   },
   "devDependencies": {
     "@intx/agent": "0.4.0",
+    "@intx/storage-isogit": "0.4.0",
     "@intx/types": "0.4.0",
     "@types/bun": "1.3.14",
     "@types/node": "22.10.5",

package.json

@@ -0,0 +1,72 @@
+// The deploy-time capability walk reads `gmail.definitions` without
+// invoking the factory, so the static declaration must match what the
+// instantiated bundle emits.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { createDefaultDirectorRegistry } from "@intx/agent";
+import { noopAuditStore, permissiveAuthorize } from "@intx/agent/testing";
+import { createIsogitStore } from "@intx/storage-isogit/node";
+import type { InferenceSource } from "@intx/types/runtime";
+import { createRuntimeCapabilities } from "@intx/types/runtime-capabilities";
+
+import { gmail, type GmailToolEnv } from "./sidecar-bundle.js";
+
+const SOURCE: InferenceSource = {
+  id: "anthropic:mock-model",
+  provider: "anthropic",
+  baseURL: "https://api.anthropic.com",
+  credentialId: "test-credential",
+  model: "mock-model",
+};
+
+const GATED_TOOL_NAMES = new Set([
+  "gmail_create_draft",
+  "gmail_label_message",
+  "gmail_unlabel_message",
+  "gmail_label_thread",
+  "gmail_unlabel_thread",
+]);
+
+let tmpDir: string;
+let env: GmailToolEnv;
+
+beforeAll(async () => {
+  tmpDir = await mkdtemp(join(tmpdir(), "google-tools-sidecar-bundle-test-"));
+  env = {
+    sources: [SOURCE],
+    defaultSource: SOURCE.id,
+    storage: await createIsogitStore(tmpDir),
+    workdir: tmpDir,
+    audit: noopAuditStore(),
+    authorize: permissiveAuthorize(),
+    directors: createDefaultDirectorRegistry(),
+    capabilities: createRuntimeCapabilities({}),
+  };
+});
+
+afterAll(async () => {
+  await rm(tmpDir, { recursive: true, force: true });
+});
+
+describe("gmail sidecar-bundle static declaration", () => {
+  test("declared definition names match the instantiated bundle's names", async () => {
+    const bundle = gmail(env);
+    const declared = new Set(gmail.definitions.map((definition) => definition.name));
+    const emitted = new Set(bundle.definitions.map((definition) => definition.name));
+    expect(emitted).toEqual(declared);
+    await bundle.dispose?.();
+  });
+
+  test("gates exactly the mailbox mutations behind approval", () => {
+    expect(gmail.definitions.length).toBeGreaterThan(0);
+    for (const definition of gmail.definitions) {
+      expect(definition.approval).toBe(
+        GATED_TOOL_NAMES.has(definition.name) ? "ask" : undefined,
+      );
+    }
+  });
+});

src/sidecar-bundle.test.ts

@@ -5,7 +5,6 @@ import type { GmailFetch } from "../client/index.js";
 import { GMAIL_CREDENTIAL_HANDLE, TOOL_DEFINITIONS } from "./definitions.js";
 import { createGmailTools } from "./create-tools.js";
 import { createRawDraft } from "./drafts.js";
-import { gmail } from "../sidecar-bundle.js";
 
 function testCapabilities(fetchImpl: GmailFetch, handle = GMAIL_CREDENTIAL_HANDLE) {
   return createRuntimeCapabilities({
@@ -92,21 +91,6 @@ describe("Gmail tool definitions", () => {
       },
     });
   });
-
-  test("requires approval for every mailbox mutation", () => {
-    const approvals = new Map(
-      gmail.definitions.map((definition) => [definition.name, definition.approval]),
-    );
-    for (const name of [
-      "gmail_create_draft",
-      "gmail_label_message",
-      "gmail_unlabel_message",
-      "gmail_label_thread",
-      "gmail_unlabel_thread",
-    ]) {
-      expect(approvals.get(name)).toBe("ask");
-    }
-  });
 });
 
 describe("createGmailTools", () => {