fix(pi): load T3 tool schemas for completion gateways

[StiensWout]

Pi's deferred T3 tools can leave OpenAI-compatible completion requests without schemas for tools named in the conversation. Some gateways silently discard those calls and return a clean stop, so a thread finishes without doing the announced work.

Load permitted T3 tools into Pi's active loadout before openai-completions requests. Reconcile on session start, model selection, tree navigation, and turn start. Keep Pi's deferred registrations, hidden aliases, and selector rules intact.

This sends the full permitted T3 catalog on that transport, increasing request size and input tokens. Pi retains loaded tools across model switches, as it does with tools loaded through search. Use --tools / --exclude-tools to restrict them; permitted T3 tools are reactivated before each prompt.

Closes #17500.

Verified with 32 focused bridge/injection tests, provider package typecheck, targeted lint, and formatting. Native Pi 1.1.0 against an isolated strict local gateway reproduced the missing-schema clean stop before the fix and executed t3_thread_read afterward. Live checks also cover restored loadouts, exclusions, and a --tools read,bash,tool_search allowlist.

_{Prepared for Wout by gpt-6.1-sol in T3 Code through the Codex harness.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This production change automatically loads the full permitted T3 tool schema set for OpenAI-compatible completion requests, changing the default active tool loadout and increasing request size. The behavior is localized and tested, but the default behavior change warrants human review.

Notes:

• Diff unchanged. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[StiensWout]

/recheck-vouch

The label job failed when GitHub returned HTTP 502 while adding vouch:trusted. Requesting a fresh trust-label check through the workflow's supported command.

_{gpt-6.1-sol via T3 Code through the Codex harness, responding for Wout.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 679e6c22-8864-49b9-950f-4799e9754948

---

📥 Commits

Reviewing files that changed from the base of the PR and between 5753207 and 13933b4.

---

📒 Files selected for processing (3)

• packages/provider-pi/src/server/mcpBridge.testkit.ts
• packages/provider-pi/src/server/mcpExtensionSource.test.ts
• packages/provider-pi/src/server/mcpExtensionSource.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Discovery reconciliation now receives model context across Pi lifecycle hooks. For OpenAI completion models, it adds catalogued T3 bridge tools to the active loadout. Tests cover gateway tool activation, model switches, and tree loadouts.

Changes

MCP tool discovery

Layer / File(s)	Summary
Model-aware discovery reconciliation packages/provider-pi/src/server/mcpBridge.testkit.ts, packages/provider-pi/src/server/mcpExtensionSource.ts	The agent-start context accepts an optional model API. Discovery reconciliation uses model context on session-tree, model-selection, session-start, and before-agent-start callbacks. For openai-completions, it adds catalogued T3 bridge tools to the active loadout.
Gateway lifecycle and loadout coverage packages/provider-pi/src/server/mcpExtensionSource.test.ts	Tests cover gateway tool activation across lifecycle hooks, model switches, and tree loadouts. Existing discovery cases use a shared context with model API and UI notification.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant PiHooks as Pi lifecycle hooks
  participant Reconcile as reconcileDiscovery
  participant Catalog as T3 bridge catalog
  participant Loadout as active tool loadout
  PiHooks->>Reconcile: model context on session and agent hooks
  Catalog->>Reconcile: catalogued T3 tool names
  Reconcile->>Loadout: activate tool_search and eligible bridge tools

Loading

---

Merge Risk | ⚪ Minimal · up to 13933

Merge Risk: ⚪ Minimal · up to 13933

This change loads T3 tool schemas for OpenAI-compatible gateways so tool calls are delivered instead of silently ending a turn. It increases request size on that transport. No concrete merge-blocking risk was found.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 13933

Completion requests receive a broader tool catalog, and loaded tools remain available after switching providers. Existing execution approvals remain in place. No permission bypass was established, but production enforcement of tool exclusions could not be independently confirmed.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The expanded selection surface encompasses the catalog associated with the current configured credential, subject to host selectors. It can include previously deferred tools and persist into later model selections. The inspected code does not establish the maximum downstream tenant, asset or datastore scope of that credential.

Security Findings and Attack Paths

• inferred — Conversation content influencing tool selection can now reach optional tool declarations without a preceding discovery step. The inspected execution hook still blocks declined mutations in restricted modes. Full-access execution without confirmation predates this PR; increased visibility alone does not establish a permission bypass.

Trust Boundaries and Controls

• observed — The unchanged launch path removes inherited endpoint and bearer values before injecting the current session's configuration. Catalog retrieval and execution use that authenticated connection. The new activation list contains tool names, not credentials, and does not replace the connection or approval mechanisms.

Resilience and Maintainability Implications

• inferred — Repeated lifecycle reconciliation preserves existing active names and does not create a new asynchronous loadout race. Partial registration failure and actual host dispatch, interruption and selector behavior remain incompletely verified; these are coverage limitations rather than demonstrated control failures.

Hardening Proposals

• proposed — Independently validate the supported host versions' selector contract across pre-prompt reactivation, model switches and restored loadouts, including a restrictive allowlist and explicit exclusions. This would resolve the principal authority-boundary uncertainty without treating it as an observed bypass.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: loading T3 tool schemas for completion gateways.
Description check		The description explains the problem, implementation, scope, behavior changes, issue reference, and focused verification results. It also documents the increased request size and tool-selection contro…
Linked Issues check		Issue #17500 requires tool calls to reach the provider instead of ending as silent clean stops. The extension now reconciles the full permitted T3 catalog into Pi's active loadout for `openai-completi…
Out of Scope Changes check		The changes stay within issue #17500. The source changes load T3 schemas for completion gateways while preserving deferred exposure, aliases, and active-tool filters. The test changes provide model co…

---

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}