Wire exec tool_search promotion into the call gate

Exec installed the same advertised-set call gate as the TUI but left tool_search's promoter as a no-op, so MCP names the model was told to call were refused.

Author: TheGreatAxios

src/agent/tool-search.ts

@@ -7,14 +7,14 @@ import type { SessionMode } from "../config/session-mode.js";
 import { sessionModeEnablesSubAgents } from "../config/session-mode.js";
 
 // Tools whose full schema is always advertised to the model. Everything else is
-// registered and dispatchable but discovered on demand via tool_search, keeping
-// the per-turn context small. Shared by the system prompt and the advertised-set
-// gate so the two never drift.
+// registered but discovered on demand via tool_search, which promotes matches
+// onto the advertised set and the call gate. Shared by the system prompt and
+// the advertised-set gate so the two never drift.
 //
 // `present` is deliberately absent: most sessions never render a view, and at
-// 2,793 chars it is the second-largest schema on the wire. It stays fully
-// dispatchable — the model finds it via tool_search when a session actually
-// needs it.
+// 2,793 chars it is the second-largest schema on the wire. It stays off the
+// advertised prefix — the model finds it via tool_search when a session
+// actually needs it.
 //
 // Product mutation tools (write_file / edit_file / delete_file) sit in CORE so
 // the primary Skywalker session can DIY tiny/bounded edits without a
@@ -197,7 +197,7 @@ export function createActivatedToolTracker(): ActivatedToolTracker {
 export const toolSearchDefinition: ToolDefinition = {
   name: "tool_search",
   description:
-    "Discover callable tools by capability. Most tools — MCP servers, present, and other integrations — are dispatchable but not advertised in the tools list. Core tools (read_file, run_shell, web_fetch, web_search, spawn_agent, wait_agents, …) are already on the wire — do not tool_search for them. Call this with a short description of what you need (e.g. 'issue tracker', 'render layout', 'granola notes') to get matching tools' names, descriptions, and input schemas. The returned tools are already callable — invoke them directly, no separate load step.",
+    "Discover callable tools by capability. Most tools — MCP servers, present, and other integrations — are not advertised until this search promotes them onto the wire. Core tools (read_file, run_shell, web_fetch, web_search, spawn_agent, wait_agents, …) are already on the wire — do not tool_search for them. Call this with a short description of what you need (e.g. 'issue tracker', 'render layout', 'granola notes') to get matching tools' names, descriptions, and input schemas. Matched tools are promoted and callable on return — invoke them directly, no separate load step.",
   inputSchema: {
     type: "object",
     properties: {
@@ -267,9 +267,9 @@ export function createToolIndex(
 export interface ToolSearchDeps {
   search: (query: string) => string[];
   lookup: (name: string) => ToolDefinition | undefined;
-  // Make the matched tools' names part of the advertised wire set on the next
-  // inference. Every registered tool is already dispatchable via `run`, so this
-  // only affects what the model can see without an intervening tool_search.
+  // Promote matches onto the advertised set and the call gate so the model can
+  // invoke them this turn. The next inference also declares them on the wire
+  // for strict providers.
   promote: (names: string[]) => void;
 }
 

src/exec/runner.ts

@@ -44,6 +44,7 @@ import type {
   ContextStore,
   InferenceSource,
   InboundMessage,
+  ToolDefinition,
 } from "@intx/types/runtime";
 import { OPERATOR_ORIGINATED_FLAG } from "../agent/message-provenance.js";
 import { loadAgentProfiles } from "../agent/profiles.js";
@@ -336,6 +337,33 @@ export interface ExecResult {
   model?: string;
 }
 
+export function createExecToolCallGate(
+  isAdvertised: (name: string) => boolean,
+  options: { isCodex: boolean },
+): (name: string) => boolean {
+  const unadvertisedCallable = new Set<string>([
+    submitOutputDefinition.name,
+    ...(options.isCodex
+      ? [shellDefinition.name, updatePlanDefinition.name]
+      : []),
+  ]);
+  return (name) => unadvertisedCallable.has(name) || isAdvertised(name);
+}
+
+export function createExecToolPromoter(args: {
+  activate: (names: readonly string[]) => boolean;
+  currentDefinitions: () => readonly ToolDefinition[];
+  computeAdvertised: (all: readonly ToolDefinition[]) => ToolDefinition[];
+  updateDirectorTools: (defs: ToolDefinition[]) => void;
+  persist?: () => void;
+}): (names: string[]) => void {
+  return (names) => {
+    if (!args.activate(names)) return;
+    args.updateDirectorTools(args.computeAdvertised(args.currentDefinitions()));
+    args.persist?.();
+  };
+}
+
 /**
  * Product non-TUI agent path (`corbits exec "prompt"`).
  *
@@ -713,14 +741,10 @@ export async function runExec(config: Config): Promise<ExecResult> {
     activatedToolsRef.current = activatedToolNames;
     // Same wire contract as the TUI: a registered tool the model was never
     // shown errors toward tool_search instead of dispatching blind.
-    const unadvertisedCallable = new Set<string>([
-      submitOutputDefinition.name,
-      ...(isCodexProviderName(config.providerName)
-        ? [shellDefinition.name, updatePlanDefinition.name]
-        : []),
-    ]);
     agentToolset.dynamicRunner.setCallGate(
-      (name) => unadvertisedCallable.has(name) || isAdvertised(name),
+      createExecToolCallGate(isAdvertised, {
+        isCodex: isCodexProviderName(config.providerName),
+      }),
     );
 
     const { directorHolder, buildAgent } = assembleChatAgent({
@@ -774,6 +798,23 @@ export async function runExec(config: Config): Promise<ExecResult> {
       evidenceArchiveHolder,
     });
 
+    // tool_search starts as a no-op promoter; without this, the call gate
+    // refuses MCP/present/plugin names the result just told the model to
+    // invoke.
+    agentToolset.setToolPromoter(
+      createExecToolPromoter({
+        activate: (names) => activatedToolNames.activate(names),
+        currentDefinitions: () =>
+          agentToolset.dynamicRunner.currentDefinitions(),
+        computeAdvertised,
+        updateDirectorTools: (defs) =>
+          directorHolder.instance?.updateToolDefinitions(defs),
+        persist: () => {
+          void persist("running");
+        },
+      }),
+    );
+
     const workflowHost = new WorkflowHost({
       cwd: config.cwd,
       getSessionId: () => sessionId,

src/session/summarizer.ts

@@ -30,10 +30,9 @@ export interface SummaryContext {
     stepIndex?: number;
     total?: number;
   };
-  // Tool names activated via tool_search (or pinned) and still on the wire.
-  // Carried into the folded handoff so the summary and the post-compact
-  // advertised set agree — the transcript's "these tools are available"
-  // record survives the fold.
+  // Tool names activated via tool_search and still on the wire. Pinned names
+  // live in the advertised prefix, not this list — callers pass
+  // activatedToolNames.list() only.
   activatedTools?: string[];
 }
 

tests/unit/exec/runner.test.ts

@@ -3,16 +3,30 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { describe, expect, test } from "bun:test";
+import type { AgentTool } from "@intx/agent";
 import type { InferenceSource } from "@intx/types/runtime";
 import type { Config } from "../../../src/config/index.js";
 import {
+  createExecToolCallGate,
+  createExecToolPromoter,
   disposeExecRuntime,
   execUserFailureMessage,
   formatCaughtError,
   refreshSelectedProviderCredential,
   resolveExecDirectorOverlay,
   runExec,
 } from "../../../src/exec/runner.js";
+import { submitOutputDefinition } from "../../../src/agent/director.js";
+import {
+  shellDefinition,
+  updatePlanDefinition,
+} from "../../../src/agent/codex-tool-proxies.js";
+import {
+  createToolIndex,
+  createToolSearchTool,
+} from "../../../src/agent/tool-search.js";
+import { createAdvertisedToolset } from "../../../src/session/assemble-runtime.js";
+import { createDynamicToolRunner } from "../../../src/tui/dynamic-tool-runner.js";
 import {
   BUILD_TOOLS,
   SKYWALKER_TOOLS,
@@ -270,6 +284,7 @@ describe("runExec", () => {
                     ({
                       dispose: () => Promise.resolve(),
                       dynamicRunner: { setCallGate: () => undefined },
+                      setToolPromoter: () => undefined,
                     }) as unknown as AgentToolset,
                 }),
                 async () => {
@@ -656,3 +671,138 @@ describe("resolveExecDirectorOverlay", () => {
     ).toBeUndefined();
   });
 });
+
+describe("exec tool call gate and promoter", () => {
+  const stringTool = (
+    name: string,
+    reply: string,
+    description: string,
+  ): AgentTool => ({
+    kind: "string",
+    definition: {
+      name,
+      description,
+      inputSchema: { type: "object", properties: {}, required: [] },
+    },
+    handler: async () => reply,
+  });
+
+  function wireExecDiscovery(isCodex: boolean) {
+    const runner = createDynamicToolRunner([
+      stringTool("read_file", "core", "read a file"),
+      stringTool(
+        "mcp__linear__save_issue",
+        "saved",
+        "Save an issue in the Linear tracker",
+      ),
+      stringTool(
+        "present",
+        "view",
+        "search and render layout primitives for pages",
+      ),
+      stringTool("plugin__notes__save", "noted", "Save granola notes"),
+      stringTool(submitOutputDefinition.name, "submitted", "submit output"),
+      stringTool(shellDefinition.name, "sh", "run a shell command"),
+      stringTool(updatePlanDefinition.name, "planned", "update the plan"),
+    ]);
+    const { activated, isAdvertised, computeAdvertised } =
+      createAdvertisedToolset({
+        sessionMode: "orchestrator",
+        toolAvailability: { languageServerAvailable: false },
+        getProvider: () => ({ providerName: "test", model: "test" }),
+      });
+    runner.setCallGate(createExecToolCallGate(isAdvertised, { isCodex }));
+    let persistCount = 0;
+    const directorNames: string[][] = [];
+    const promote = createExecToolPromoter({
+      activate: (names) => activated.activate(names),
+      currentDefinitions: () => runner.currentDefinitions(),
+      computeAdvertised,
+      updateDirectorTools: (defs) => {
+        directorNames.push(defs.map((d) => d.name));
+      },
+      persist: () => {
+        persistCount += 1;
+      },
+    });
+    const search = createToolSearchTool({
+      search: (query) =>
+        createToolIndex(() => runner.currentDefinitions()).search(query),
+      lookup: (name) =>
+        runner.currentDefinitions().find((d) => d.name === name),
+      promote,
+    });
+    return { runner, persistCount: () => persistCount, directorNames, search };
+  }
+
+  async function dispatch(
+    runner: ReturnType<typeof createDynamicToolRunner>,
+    name: string,
+  ) {
+    return runner.run(
+      { id: name, name, arguments: {} },
+      new AbortController().signal,
+    );
+  }
+
+  test("tool_search then MCP dispatch with the gate on", async () => {
+    const { runner, search, persistCount, directorNames } =
+      wireExecDiscovery(false);
+    const blocked = await dispatch(runner, "mcp__linear__save_issue");
+    expect(blocked.isError).toBe(true);
+    expect(blocked.content).toContain("tool_search");
+
+    if (search.kind !== "string") throw new Error("expected string tool");
+    await search.handler({ query: "linear" }, new AbortController().signal);
+    expect(persistCount()).toBe(1);
+    expect(directorNames.at(-1)).toContain("mcp__linear__save_issue");
+
+    const allowed = await dispatch(runner, "mcp__linear__save_issue");
+    expect(allowed.content).toBe("saved");
+    expect(allowed.isError).toBeUndefined();
+  });
+
+  test("present and plugin names pass the gate after tool_search promote", async () => {
+    const { runner, search } = wireExecDiscovery(false);
+    expect((await dispatch(runner, "present")).isError).toBe(true);
+    expect((await dispatch(runner, "plugin__notes__save")).isError).toBe(true);
+
+    if (search.kind !== "string") throw new Error("expected string tool");
+    await search.handler(
+      { query: "render layout" },
+      new AbortController().signal,
+    );
+    await search.handler(
+      { query: "granola notes" },
+      new AbortController().signal,
+    );
+
+    expect((await dispatch(runner, "present")).content).toBe("view");
+    expect((await dispatch(runner, "plugin__notes__save")).content).toBe(
+      "noted",
+    );
+  });
+
+  test("gate admits submit_output without activation", async () => {
+    const { runner } = wireExecDiscovery(false);
+    const result = await dispatch(runner, submitOutputDefinition.name);
+    expect(result.content).toBe("submitted");
+    expect(result.isError).toBeUndefined();
+  });
+
+  test("Codex gate admits shell and update_plan without activation", async () => {
+    const { runner } = wireExecDiscovery(true);
+    const shell = await dispatch(runner, shellDefinition.name);
+    expect(shell.content).toBe("sh");
+    expect(shell.isError).toBeUndefined();
+    const plan = await dispatch(runner, updatePlanDefinition.name);
+    expect(plan.content).toBe("planned");
+    expect(plan.isError).toBeUndefined();
+  });
+
+  test("non-Codex gate refuses shell until it is advertised", async () => {
+    const { runner } = wireExecDiscovery(false);
+    const blocked = await dispatch(runner, shellDefinition.name);
+    expect(blocked.isError).toBe(true);
+  });
+});