fix(tool): use call-scoped group activation

agentscope-core/src/main/java/io/agentscope/core/tool/ToolExecutor.java

@@ -16,10 +16,12 @@
 package io.agentscope.core.tool;
 
 import io.agentscope.core.agent.Agent;
+import io.agentscope.core.agent.RuntimeContext;
 import io.agentscope.core.message.ToolResultBlock;
 import io.agentscope.core.message.ToolUseBlock;
 import io.agentscope.core.model.ExecutionConfig;
 import io.agentscope.core.shutdown.GracefulShutdownManager;
+import io.agentscope.core.state.AgentState;
 import io.agentscope.core.tracing.TracerRegistry;
 import io.agentscope.core.util.ExceptionUtils;
 import java.time.Duration;
@@ -198,7 +200,15 @@ private Mono<ToolResultBlock> executeCore(ToolCallParam param) {
 
         // Check tool activation
         RegisteredToolFunction registered = toolRegistry.getRegisteredTool(toolCall.getName());
-        if (registered != null && !groupManager.isActiveTool(toolCall.getName())) {
+        AgentState agentState =
+                RuntimeContext.resolveAgentState(param.getRuntimeContext(), param.getAgent());
+        boolean active =
+                agentState != null
+                        ? groupManager.isActiveTool(
+                                toolCall.getName(),
+                                agentState.getToolContext().getActivatedGroups())
+                        : groupManager.isActiveTool(toolCall.getName());
+        if (registered != null && !active) {
             String errorMsg =
                     String.format(
                             "Unauthorized tool call: '%s' is not available", toolCall.getName());

agentscope-core/src/main/java/io/agentscope/core/tool/ToolGroupManager.java

@@ -335,6 +335,30 @@ public boolean isActiveTool(String toolName) {
         return false;
     }
 
+    /**
+     * Check if a tool belongs to any of the explicitly active groups.
+     *
+     * <p>If the tool is not in any group, it is considered active by default. Unlike {@link
+     * #isActiveTool(String)}, this method does not read the manager's shared activation flags.
+     *
+     * @param toolName Tool name
+     * @param activeGroupNames Group names to treat as active
+     * @return true if ungrouped or in at least one explicitly active group
+     */
+    public boolean isActiveTool(String toolName, Collection<String> activeGroupNames) {
+        if (toolName == null) {
+            return false;
+        }
+        Set<String> groups = tools.get(toolName);
+        if (groups == null || groups.isEmpty()) {
+            return true;
+        }
+        if (activeGroupNames == null || activeGroupNames.isEmpty()) {
+            return false;
+        }
+        return groups.stream().anyMatch(activeGroupNames::contains);
+    }
+
     /**
      * Check whether a tool belongs to any group.
      *

agentscope-core/src/test/java/io/agentscope/core/tool/ToolGroupManagerTest.java

@@ -234,6 +234,23 @@ void testIsActiveToolInactive() {
         assertFalse(manager.isActiveTool("tool1"));
     }
 
+    @Test
+    void testIsActiveToolWithExplicitGroups() {
+        // Arrange
+        manager.createToolGroup("group1", "Group 1", false);
+        manager.createToolGroup("group2", "Group 2", false);
+        manager.addToolToGroup("group1", "tool1");
+        manager.addToolToGroup("group2", "tool1");
+
+        // Act & Assert
+        assertFalse(manager.isActiveTool(null, List.of()));
+        assertTrue(manager.isActiveTool("ungroupedTool", null));
+        assertFalse(manager.isActiveTool("tool1", null));
+        assertFalse(manager.isActiveTool("tool1", List.of()));
+        assertTrue(manager.isActiveTool("tool1", List.of("group2")));
+        assertFalse(manager.isActiveTool("tool1", List.of("otherGroup")));
+    }
+
     @Test
     void testIsInActiveGroupToolNotAnyTool() {
         // Arrange

agentscope-core/src/test/java/io/agentscope/core/tool/ToolkitTest.java

@@ -26,10 +26,13 @@
 import static org.mockito.Mockito.when;
 
 import io.agentscope.core.agent.Agent;
+import io.agentscope.core.agent.RuntimeContext;
 import io.agentscope.core.message.TextBlock;
 import io.agentscope.core.message.ToolResultBlock;
 import io.agentscope.core.message.ToolUseBlock;
 import io.agentscope.core.model.ToolSchema;
+import io.agentscope.core.state.AgentState;
+import io.agentscope.core.state.ToolContextState;
 import io.agentscope.core.tool.mcp.McpClientWrapper;
 import io.agentscope.core.tool.test.SampleTools;
 import io.agentscope.core.tool.test.ToolTestUtils;
@@ -460,6 +463,61 @@ void testUnauthorizedToolCallShouldBeRejected() {
                 "Error message should indicate unauthorized access: " + errorText);
     }
 
+    @Test
+    @DisplayName("Should authorize grouped tool from call-scoped active groups")
+    void testCallScopedActiveGroupShouldAuthorizeTool() {
+        toolkit.createToolGroup("sessionGroup", "Session tools", false);
+        toolkit.registration().tool(sampleTools).group("sessionGroup").apply();
+
+        RuntimeContext runtimeContext = runtimeContextWithActiveGroups("sessionGroup");
+        ToolResultBlock result = callAddTool(runtimeContext);
+
+        assertFalse(
+                isErrorResult(result),
+                "Call-scoped activation should authorize the tool: " + getResultText(result));
+    }
+
+    @Test
+    @DisplayName("Should reject grouped tool absent from call-scoped active groups")
+    void testCallScopedInactiveGroupShouldRejectTool() {
+        toolkit.createToolGroup("sharedGroup", "Shared tools", true);
+        toolkit.registration().tool(sampleTools).group("sharedGroup").apply();
+
+        RuntimeContext runtimeContext = runtimeContextWithActiveGroups();
+        ToolResultBlock result = callAddTool(runtimeContext);
+
+        assertTrue(
+                isErrorResult(result),
+                "Call-scoped state should override shared activation: " + getResultText(result));
+        assertTrue(getResultText(result).contains("Unauthorized"));
+    }
+
+    private RuntimeContext runtimeContextWithActiveGroups(String... groupNames) {
+        ToolContextState.Builder toolContext = ToolContextState.builder();
+        for (String groupName : groupNames) {
+            toolContext.addActivatedGroup(groupName);
+        }
+        AgentState state = AgentState.builder().toolContext(toolContext.build()).build();
+        return RuntimeContext.builder().agentState(state).build();
+    }
+
+    private ToolResultBlock callAddTool(RuntimeContext runtimeContext) {
+        Map<String, Object> input = Map.of("a", 1, "b", 2);
+        ToolUseBlock toolCall =
+                ToolUseBlock.builder()
+                        .id("call-session-add")
+                        .name("add")
+                        .input(input)
+                        .content(JsonUtils.getJsonCodec().toJson(input))
+                        .build();
+        return toolkit.callTool(
+                        ToolCallParam.builder()
+                                .toolUseBlock(toolCall)
+                                .runtimeContext(runtimeContext)
+                                .build())
+                .block();
+    }
+
     @Test
     @DisplayName("Should allow ungrouped tools to be called regardless of groups")
     void testUngroupedToolsAlwaysCallable() {