fix(agent): respect permitted web retrieval guidance

[yinkev]

Summary

• Replace OpenAI/Grok execution guidance that hard-mandated web_search for current facts with permitted retrieval/search wording.
• Qualify browser and browser_cdp schema suggestions so web_search/web_extract are only examples when permitted or available.
• Add regression tests covering the assembled SOUL.md + model guidance prompt and the tool schema wording.

Fixes #39797.

Verification

• .venv/bin/python -m py_compile agent/prompt_builder.py agent/system_prompt.py tools/browser_tool.py tools/browser_cdp_tool.py tests/agent/test_prompt_builder.py tests/agent/test_system_prompt.py tests/tools/test_browser_hardening.py tests/tools/test_browser_cdp_tool.py
• .venv/bin/python -m pytest tests/agent/test_prompt_builder.py tests/agent/test_system_prompt.py tests/tools/test_browser_hardening.py tests/tools/test_browser_cdp_tool.py -q -o addopts= --tb=short
• /opt/homebrew/bin/ruff check agent/prompt_builder.py agent/system_prompt.py tools/browser_tool.py tools/browser_cdp_tool.py tests/agent/test_prompt_builder.py tests/agent/test_system_prompt.py tests/tools/test_browser_hardening.py tests/tools/test_browser_cdp_tool.py
• git diff --check
• rg -n 'prefer web_search|use web_search|use web_extract|prefer web_extract|prefer web_search or web_extract' agent tools -g '*.py'

[teknium1]

Thanks for tracing this to the model-specific execution guidance. The core premise is confirmed on current main: agent/prompt_builder.py:403 mandates web_search, and agent/system_prompt.py:182-190,263-290 combines that later guidance with SOUL.md in GPT/Codex/Grok prompts.

Problems

• The changed browser descriptions still hard-code web_search/web_extract as static schema examples. AGENTS.md:1234-1235 explicitly prohibits cross-tool references in static schemas and names this exact browser_navigate pattern; model_tools.py:495-512 is the required dynamic layer.
• The current dynamic cleanup at model_tools.py:505-508 replaces the old exact browser sentence. With the proposed new wording it no longer matches, so that handling becomes ineffective.

Suggested changes

• Make the static browser and CDP schema wording toolset-neutral, then inject named retrieval hints dynamically only when those tools are actually available.
• Add coverage for both available and unavailable web-tool schema variants, alongside the useful SOUL/prompt regression test.

This is an automated hermes-sweeper review.

[yinkev]

Refreshed onto current main and reworked the fix around the current dynamic tool-schema layer.

• GPT/Codex/Grok execution guidance now requires an appropriate permitted retrieval/search tool instead of mandating web_search.
• Static browser and CDP schemas are toolset-neutral and contain no cross-tool names.
• model_tools.get_tool_definitions() now injects concrete web_search / web_extract hints only after runtime availability filtering, and names only the tools actually present.
• Added coverage for available, partially available, and unavailable web-tool sets.

Fresh verification: 257 passed, 1 skipped across the four touched suites; Ruff, py_compile, Windows-footgun, and whitespace checks passed.

[yinkev]

Rebased onto current main (760112a) to clear a stale-test CI failure.

Root cause: identical to the #71184 drift seen elsewhere — the branch
predated the change that upgraded TUI build-failure delivery to a terminal
message.complete frame and updated
tests/test_tui_gateway_server.py::test_agent_build_failure_surfaces_error_and_drops_turn.
This branch does not touch that file, so the failure was pure staleness; the
rebase pulls in the current test. The PR diff (permitted web-retrieval
guidance) is unchanged.

Verification (clean-HOME, CI-equivalent env):

• test_agent_build_failure_surfaces_error_and_drops_turn → passes
• changed-file tests (test_prompt_builder.py, test_model_tools.py, test_browser_cdp_tool.py, test_browser_hardening.py) → 257 passed, 1 skipped
• ruff check (changed files) → clean · py_compile → OK
• footgun scan --diff main → no branch-added footguns · git diff --check → clean

Net diff vs main is identical to the pre-rebase change (8 files, +100/-25).