🛂 fix: Re-Check execute_code Authorization on Event-Driven Tool Loads

[danny-avila]

Summary

• Gate event-driven bash_tool loading on the same per-agent execute_code authorization used by initial tool definition loading.
• Require direct code execution tool requests to be present in the run toolRegistry before loading them.
• Add a regression test for an agent without execute_code attempting to load code execution tools through ON_TOOL_EXECUTE.

Root Cause

loadToolDefinitionsWrapper filtered initial tool definitions against the agent's configured tools, but loadToolsForExecution trusted runtime tool names from ON_TOOL_EXECUTE too much. A model/tool-call path could request bash_tool even when the agent did not have execute_code registered.

Validation

• cd api && npx jest server/services/__tests__/ToolService.spec.js --runInBand --silent
• cd api && npx jest server/services/Endpoints/agents/initialize.spec.js --runInBand --silent
• git diff --check -- api/server/services/ToolService.js api/server/services/__tests__/ToolService.spec.js

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: db25798a00

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".