Let caller-offered computer tools pass through the headless middleware

[charan-rathore]

What this changes

Fixes #804. In a chat with a remote AG-UI Bot, every computer_* call was refused with "The tool computer_navigate is unavailable for this headless turn." while the built-in General Assistant browsed fine on the same deployment.

HeadlessToolsMiddleware claims every computer_* tool call by name prefix, but its tool map only holds the Bot's server-side grants. A remote Bot has no server-side computer grant, so a call to the browser-offered computer_* tools was intercepted and refused instead of passing through to the caller that offered them. The middleware's own continuation logic already anticipates partially-owned pending sets (owned.length !== pending.length), so the fix is one condition: claim a computer_* call only when the caller did not offer the tool. The governed refusal still covers genuinely browserless turns (routines), where the call would otherwise die silently.

Where it runs

• New state that outlives a request? None - one per-run Set of tool names already in the input.
• What happens on the second replica? Nothing new: the check reads the current run's input only.
• Anything serialised? No.
• Anything fanned out to a browser? That is the point of the fix: the tool call now reaches the caller's browser through the existing AG-UI stream instead of being refused server-side.
• New listener, port, or schedule? None.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act. Server-side computer grants are still claimed and executed through the policy path as before; only caller-offered tools pass through, executed by the caller's own browser policy.
• New refusals and new failures each write a row. No new refusals; the existing refusal for not-offered tools is unchanged.
• Nothing new is trusted from the client that the server can resolve itself. The caller already controls which tools it offers in its own run input.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

New toolkit/tests/headless-tools.test.ts (bun test):

• a computer tool the caller offers passes through for the caller to execute - RED before the fix (the call was refused and the run continued with a fabricated error result), GREEN after: the terminal event is forwarded unanswered and no error result is synthesized.
• a computer tool the caller did not offer still gets the governed refusal - the Remote AG-UI Bots can't use the browser in chat: computer_* calls refused as "unavailable for this headless turn" #804-adjacent guarantee: browserless turns still get the refusal.

Existing server/tests/headless-tools.test.ts: all 8 tests pass unchanged, including "unknown computer tool calls become error results rather than commands".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T09:07:43.585937Z	767bfe0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.