fix(agent): treat gpt shell as advertised

The worker prefix lists shell, but the call gate only matched the
default bash wire, so a shell call promoted run_shell. An exclude of
manage_tasks now denies both update_plan and the engine id; shell and
run_shell follow the same rule.

Author: TheGreatAxios

src/agent/tool-aliases.ts

@@ -106,16 +106,19 @@ export function enginesForAdvertisedWire(
   return table.get(wire) ?? table.get(wire.toLowerCase());
 }
 
+/** Wire this profile advertises for `engine`, including a fold that replaces it. */
+function profileWireName(engine: string, profile: ToolProfile): string {
+  const fold = PROFILE_FOLDS[profile];
+  if (fold !== undefined && fold.engines.includes(engine)) return fold.wire;
+  return advertisedToolName(engine, profile);
+}
+
 /** Every wire any profile advertises for `engine`, including fold wires. */
 export function advertisedNamesForEngine(engine: string): readonly string[] {
   const names: string[] = [];
   const seen = new Set<string>();
   for (const profile of toolProfiles()) {
-    const fold = PROFILE_FOLDS[profile];
-    const wire =
-      fold !== undefined && fold.engines.includes(engine)
-        ? fold.wire
-        : advertisedToolName(engine, profile);
+    const wire = profileWireName(engine, profile);
     if (seen.has(wire)) continue;
     seen.add(wire);
     names.push(wire);
@@ -205,16 +208,23 @@ export function advertisedToolName(
 }
 
 /** True when `name` (wire, engine, or hidden alias) is covered by an
- * advertised or activated listing (which may store wire or engine ids). */
+ * advertised or activated listing (which may store wire or engine ids).
+ * A call is advertised when this profile's wire is on the list, and also
+ * when the default wire is — primary prefixes still store `bash` while a
+ * gpt worker prefix stores `shell`. */
 export function nameMatchesAdvertisedListing(
   name: string,
   isListed: (candidate: string) => boolean,
+  profile: ToolProfile = "default",
 ): boolean {
   if (isListed(name)) return true;
   const engine = engineToolName(name);
   if (engine !== name && isListed(engine)) return true;
-  const wire = advertisedToolName(engine);
-  return wire !== name && isListed(wire);
+  const wires =
+    profile === "default"
+      ? [profileWireName(engine, profile)]
+      : [profileWireName(engine, profile), profileWireName(engine, "default")];
+  return wires.some((wire) => wire !== name && isListed(wire));
 }
 
 // update_plan dispatches through translateUpdatePlanArgs, so advertising

src/agent/tool-search.test.ts

@@ -1051,6 +1051,62 @@ describe("advertisedToolNamesForWorker", () => {
     expect(build).not.toContain("write_file");
   });
 
+  test("gpt shell is advertised, so a shell call does not promote run_shell", async () => {
+    const prefix = advertisedToolNamesForWorker({
+      allow: BUILD_TOOLS,
+      profile: "gpt",
+    });
+    const runner = createDynamicToolRunner([
+      {
+        kind: "string",
+        definition: {
+          name: "run_shell",
+          description: "run a shell command",
+          inputSchema: { type: "object", properties: {}, required: [] },
+        },
+        handler: async () => "ran:shell",
+      },
+      {
+        kind: "string",
+        definition: {
+          name: "apply_patch",
+          description: "apply a patch",
+          inputSchema: { type: "object", properties: {}, required: [] },
+        },
+        handler: async () => "ran:patch",
+      },
+    ]);
+    const advertised = createAdvertisedToolset({
+      sessionMode: "orchestrator",
+      toolAvailability: { languageServerAvailable: false },
+      getProvider: () => ({ providerName: "openai", model: "gpt-5-codex" }),
+      builtInPrefix: prefix,
+    });
+    expect(advertised.isAdvertised("shell")).toBe(true);
+    expect(advertised.isAdvertised("run_shell")).toBe(true);
+    expect(advertised.isAdvertised("apply_patch")).toBe(true);
+    const promoted: string[] = [];
+    runner.setCallGate((name) => advertised.isAdvertised(name));
+    runner.setOnUndeclaredCall((name) => {
+      promoted.push(name);
+      advertised.activated.activate([name]);
+    });
+    const signal = new AbortController().signal;
+    const shell = await runner.run(
+      { id: "shell", name: "shell", arguments: { command: "true" } },
+      signal,
+    );
+    const patch = await runner.run(
+      { id: "patch", name: "apply_patch", arguments: {} },
+      signal,
+    );
+    expect(shell.content).toBe("ran:shell");
+    expect(shell.isError).toBeUndefined();
+    expect(patch.content).toBe("ran:patch");
+    expect(patch.isError).toBeUndefined();
+    expect(promoted).toEqual([]);
+  });
+
   test("every non-default profile projects allowlisted engines through its wire table", () => {
     const allow = BUILD_TOOLS as readonly string[];
     for (const profile of toolProfiles()) {

src/session/assemble-runtime.ts

@@ -452,17 +452,17 @@ export function createAdvertisedToolset(args: {
     );
   };
   const isAdvertised = (name: string): boolean => {
-    const denied = deniedFor(args.getProvider());
+    const provider = args.getProvider();
+    const profile = toolProfileForModel(provider);
+    const denied = deniedFor(provider);
     if (denied.includes(name) || denied.includes(canonicalToolName(name))) {
       return false;
     }
-    const effective = foldFileToolNames(
-      prefix,
-      toolProfileForModel(args.getProvider()),
-    );
+    const effective = foldFileToolNames(prefix, profile);
     return nameMatchesAdvertisedListing(
       name,
       (n) => effective.includes(n) || activated.has(n),
+      profile,
     );
   };
   const flushPromotions = (): boolean => {

src/subagent/capability-preflight.test.ts

@@ -364,6 +364,40 @@ describe("preflightCapabilities", () => {
     expect(result.unavailable.code).toBe("unknown_tool");
     expect(result.unavailable.tool).toBe("bash");
   });
+
+  test("gpt exclude denies the wire and the engine together", () => {
+    const cases = [
+      { exclude: "manage_tasks", required: ["update_plan", "manage_tasks"] },
+      { exclude: "update_plan", required: ["update_plan", "manage_tasks"] },
+      { exclude: "run_shell", required: ["shell", "run_shell"] },
+      { exclude: "shell", required: ["shell", "run_shell"] },
+    ] as const;
+    for (const entry of cases) {
+      for (const required of entry.required) {
+        const result = preflightCapabilities({
+          required: [required],
+          resolvedFilter: { mode: "exclude", tools: [entry.exclude] },
+          knownEngines: DEFAULT_KNOWN_ENGINES,
+          agentLabel: "coder",
+          toolProfile: "gpt",
+        });
+        const label = `${entry.exclude} blocks ${required}`;
+        expect(result.ok, label).toBe(false);
+        if (result.ok) continue;
+        expect(result.unavailable.code, label).toBe("permission_static");
+      }
+    }
+    for (const required of ["manage_tasks", "update_plan"] as const) {
+      const result = preflightCapabilities({
+        required: [required],
+        resolvedFilter: { mode: "exclude", tools: ["read_file"] },
+        knownEngines: DEFAULT_KNOWN_ENGINES,
+        agentLabel: "coder",
+        toolProfile: "gpt",
+      });
+      expect(result.ok, required).toBe(true);
+    }
+  });
 });
 
 describe("formatCapabilityUnavailable", () => {

src/subagent/capability-preflight.ts

@@ -245,6 +245,9 @@ function enginesCoveredByDirector(
       (engine) => named.has(engine) || postFilter.has(engine),
     );
   }
+  // An explicit exclude names the engine. Post-filter mounts (manage_tasks)
+  // are not exempt here — update_plan and manage_tasks must agree, and the
+  // engine-id path applies the same denylist.
   return engines.filter((engine) => !named.has(engine));
 }
 
@@ -353,6 +356,21 @@ export function preflightCapabilities(
           unavailable: { code: "missing_binary", tool: resolved },
         };
       }
+      // Explicit exclude wins over the post-filter mount exemption and over a
+      // live MCP mount. Otherwise gpt update_plan (wire path) is
+      // permission_static while manage_tasks (engine-id path) still passes.
+      // shell / run_shell share that rule. run.ts strips named tools in
+      // exclude mode, so an excluded MCP tool must reject here.
+      if (deny !== undefined && deny.has(resolved)) {
+        return {
+          ok: false,
+          unavailable: {
+            code: "permission_static",
+            tool: resolved,
+            alternatives: rerouteAlternatives(resolved),
+          },
+        };
+      }
       if (!postFilter.has(resolved) && !isLiveMcp) {
         if (allow !== undefined && !allow.has(resolved)) {
           return {
@@ -364,28 +382,6 @@ export function preflightCapabilities(
             },
           };
         }
-        if (deny !== undefined && deny.has(resolved)) {
-          return {
-            ok: false,
-            unavailable: {
-              code: "permission_static",
-              tool: resolved,
-              alternatives: rerouteAlternatives(resolved),
-            },
-          };
-        }
-      } else if (isLiveMcp && deny !== undefined && deny.has(resolved)) {
-        // An explicit exclude naming a live MCP tool still withholds it —
-        // run.ts strips named tools in exclude mode, so the mount would drop
-        // it and the requirement must reject here, not as a stale snapshot.
-        return {
-          ok: false,
-          unavailable: {
-            code: "permission_static",
-            tool: resolved,
-            alternatives: rerouteAlternatives(resolved),
-          },
-        };
       }
       if (!seen.has(resolved)) {
         seen.add(resolved);