OpenAI Codex CLI Files

New Features

• Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. (#36544, [#36409], [#36919], [#36796])
• Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally. (#35722, [#36007], [#36380], [#36948], [#36950])
• Enable automatically reviewed approvals with the new --approve-for-me CLI flag. (#36373)
• Import Cursor-managed skills and synchronize changes to imported Claude and Cursor conversations without creating duplicates. (#36361, [#36356], [#35623])
• Support the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. (#35724, [#35725], [#35590], [#35742])
• Enable cached web search and remote conversation compaction for Amazon Bedrock. (#36938, [#36981])

Bug Fixes

• Redact secrets and complete bearer tokens from displayed commands and replayed conversation history. (#36893, [#36908])
• Prevent lost or stalled terminal input when focus returns, MCP servers initialize, or Ghostty handles keyboard shortcuts. (#35649, [#35957], [#36834])
• Correct rendering and cursor positioning for Japanese characters, emoji, hyperlinks, and text near viewport boundaries. (#35960, [#35962], [#37166])
• Properly interrupt Windows background processes and handle Windows filesystem paths consistently. (#35655, [#35851], [#37129])
• Require explicit trust for unfamiliar local projects and enforce managed authentication restrictions before credentials are used. (#36960, [#37132])
• Harden plugin isolation and deny network access when policy updates fail. (#37027, [#36967], [#36037])

Documentation

• Improve the bundled OpenAI documentation skill with targeted official-source lookup and clearer guidance for Codex, model selection, and API workflows. (#36014)

Chores

• Upgrade the MCP SDK to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0. (#36001, [#35959], [#35831])
• Secure macOS release notarization using Azure Key Vault instead of exporting private signing keys. (#37154)
• Remove the deprecated codex exec --full-auto flag; use --sandbox workspace-write instead. (#36054)
• Stop publishing redundant Linux bundle archives; use the standard codex-package-<target> release archives. (#36342)

Changelog

Full Changelog: https://github.com/openai/codex/compare/rust-v0.146.0...rust-v0.147.0

• [#35590] Expose cached MCP tools before server startup @copyberry
• [#35594] Recommend longer waits in the v2 wait_agent schema @copyberry
• [#35595] Allow alpha hotfix versions in R2 releases @copyberry
• [#35597] Add metrics for extension-rendered skill catalogs @copyberry
• [#35607] Record metrics for empty skill catalogs @copyberry
• [#35608] Support model-owned token budget defaults @copyberry
• [#35621] Skip restored token usage replay for exec resumes @copyberry
• [#35623] Parse Claude and Cursor session records separately @copyberry
• [#35642] Make OpenTelemetry provider shutdown idempotent @copyberry
• [#35644] Preserve thread metadata when rollout files are missing @copyberry
• [#35649] Preserve TUI input when terminal focus returns @copyberry
• [#35652] Enable network policy callbacks for remote exec @copyberry
• [#35653] Test developer instruction inheritance for multi-agent workers @copyberry
• [#35655] Terminate Windows non-TTY processes on interrupt @copyberry
• [#35656] Preserve multi-agent settings across config representations @copyberry
• [#35661] Place host skills before permission instructions @copyberry
• [#35663] Evaluate character matching over skill routing metadata @copyberry
• [#35665] Fix the async watcher test harness on Windows @copyberry
• [#35668] Expose the network proxy spec constructor @copyberry
• [#35670] Raise the Windows exec yield floor to 10 seconds @copyberry
• [#35671] Route curated plugins by authentication mode @copyberry
• [#35675] Prepare MCP and plugin recommendations concurrently @copyberry
• [#35678] Preserve paginated thread metadata across resumes @copyberry
• [#35685] Load cloud-managed profiles for codex sandbox @copyberry
• [#35688] Point crossterm patch to the OpenAI OSS fork @copyberry
• [#35689] Preserve item timestamps in thread history projections @copyberry
• [#35691] Include empty-preview threads in relationship listings @copyberry
• [#35693] Refresh the subagent picker in the background @copyberry
• [#35695] Honor the configured SQLite home in the logs client @copyberry
• [#35708] Add configurable developer instructions for v2 subagents @copyberry
• [#35715] Support streaming bodies in route-aware HTTP requests @copyberry
• [#35717] Reuse route-aware clients for OpenAI file uploads @copyberry
• [#35720] Upgrade rmcp to 3.0.0-beta.3 @copyberry
• [#35721] Honor disabled code mode fallback without a process host @copyberry
• [#35722] Add persisted sections for organizing threads @copyberry
• [#35724] Add MCP 2026-07-28 discovery support @copyberry
• [#35725] Complete MCP 2026 client support @copyberry
• [#35738] Add bounded metadata for executed tool calls @copyberry
• [#35742] Avoid blocking turns on optional MCP startup @copyberry
• [#35744] Keep agent registry identities consistent @copyberry
• [#35766] Emit host skill budget warnings from world state @copyberry
• [#35769] Share the skills budget across host and executor catalogs @copyberry
• [#35772] Throttle models cache TTL renewals @copyberry
• [#35773] Scale skill metadata budgets with context windows @copyberry
• [#35777] Resolve MCP tool catalogs concurrently @copyberry
• [#35779] Load thread titles concurrently during session startup @copyberry
• [#35785] Support self-serve Business ProLite accounts @copyberry
• [#35787] Gate paginated thread history on the state database @copyberry
• [#35794] Wait for MCP readiness in the curated sync test @copyberry
• [#35802] Tag reports with the selected turn's model and effort @copyberry
• [#35806] Route MCP OAuth through configured HTTP clients @copyberry
• [#35814] Use configured HTTP clients for all MCP OAuth requests @copyberry
• [#35818] Advance latest-alpha-cli after release publishing completes @copyberry
• [#35821] Use the shared HTTP client for TUI network checks @copyberry
• [#35825] Use the shared HTTP client for announcement tips @copyberry
• [#35828] Enforce centralized SQLite connection creation @copyberry
• [#35830] Route WebRTC sideband joins to the Realtime API @copyberry
• [#35831] Update rusty_v8 to 150.4.0 @copyberry
• [#35835] Track parent turns for nested Codex requests @copyberry
• [#35836] Clean up cancelled MCP elicitation requests @copyberry
• [#35837] Expose plugin eligibility metadata in app-server summaries @copyberry
• [#35839] Decouple recommended plugins from tool suggestions @copyberry
• [#35840] Handle legacy MCP discovery prevalidation errors @copyberry
• [#35843] Tie remote exec servers to their parent stdin @copyberry
• [#35845] Support plaintext collaboration tool messages @copyberry
• [#35850] Preserve foreign paths in background terminal listings @copyberry
• [#35851] Normalize Windows namespace paths in path URIs @copyberry
• [#35854] Box app-server event payloads @copyberry
• [#35856] Resolve imported connectors by MCP server name @copyberry
• [#35857] Add Bazel unit test targets for Rust binaries @copyberry
• [#35859] Expose plugin installation timestamps in app-server summaries @copyberry
• [#35870] Include session titles in external agent import history @copyberry
• [#35874] Mark the primary environment in model context @copyberry
• [#35875] Allow environment readiness updates in place @copyberry
• [#35878] Use step environments for MCP file uploads @copyberry
• [#35886] Show blocked goals as stalled in the TUI @copyberry
• [#35887] Clean up side conversations in the background @copyberry
• [#35895] Inherit ready step environments when spawning agents @copyberry
• [#35937] Let unrelated tools run while MCP servers start @copyberry
• [#35941] Bound MCP namespace descriptions @copyberry
• [#35942] Update tests for current tool call and app-server event types @copyberry
• [#35944] Report direct input capability for listed subagents @copyberry
• [#35957] Fix TUI input queue handling during MCP startup @copyberry
• [#35959] Upgrade Ratatui to 0.30.2 @copyberry
• [#35960] Preserve hyperlink cell widths during terminal diffing @copyberry
• [#35962] Fix TUI layout for halfwidth Japanese sound marks @copyberry
• [#35982] Avoid cloning rollout history when truncating forks @copyberry
• [#35989] Display title-only reasoning summaries in the TUI @copyberry
• [#35990] Test exec-server compatibility across Codex versions @copyberry
• [#35992] Group external agent config migration into a module @copyberry
• [#35997] Remove obsolete rusty_v8 146.4.0 Bazel targets @copyberry
• [#36001] Upgrade rmcp to 3.0.0 @copyberry
• [#36002] Resolve MCP file uploads with environment-native paths @copyberry
• [#36006] Reduce response serialization and rollout scan overhead @copyberry
• [#36007] Add persisted manual ordering for thread sections @copyberry
• [#36008] Route pet asset downloads through the shared HTTP client @copyberry
• [#36011] Share optional MCP startup grace across connection sets @copyberry
• [#36014] Refine OpenAI docs skill source routing @copyberry
• [#36020] Avoid cloning ignored analytics notifications @copyberry
• [#36030] Increase the app-server tracing test stack size @copyberry
• [#36031] Load cloud-managed servers in MCP CLI commands @copyberry
• [#36033] Use the shared HTTP client in codex-protocol @copyberry
• [#36035] Exit the stdio app-server when its connection closes @copyberry
• [#36036] Allow naming forked chats from the TUI @copyberry
• [#36037] Deny network access when an allow amendment fails @copyberry
• [#36039] Limit MCP catalog pagination @copyberry
• [#36043] Document the Responses API proxy reqwest exception @copyberry
• [#36045] Distinguish unknown MCP authentication status @copyberry
• [#36047] Extract MCP environment headers into a local variable @copyberry
• [#36049] Keep tool-call metrics out of Statsig exports @copyberry
• [#36051] Avoid overwriting symlinked migration targets @copyberry
• [#36054] Remove legacy --full-auto handling from codex exec @copyberry
• [#36055] Expose MCP read-only hints in tool call items @copyberry
• [#36076] Remove codex-core's direct reqwest dependency @copyberry
• [#36078] Route Ollama through the shared HTTP client @copyberry
• [#36083] Handle fractional rate limits in thread history projection @copyberry
• [#36092] Correlate image requests and explicit interrupts with turns @copyberry
• [#36119] Unify tool runtime assembly before router construction @copyberry
• [#36120] Delegate readiness waits to tool runtimes @copyberry
• [#36121] Sandbox executor skill resource reads @copyberry
• [#36124] Respect filesystem permissions during capability discovery @copyberry
• [#36127] Centralize tool registration and protect host tools @copyberry
• [#36128] Preserve delegated tasks across remote compaction @copyberry
• [#36129] Resolve normalized tool name collisions in code mode @copyberry
• [#36133] Preserve executor workspace permissions for apply_patch @copyberry
• [#36138] Isolate apply-patch permission test variants @copyberry
• [#36139] Bound the code mode output termination test @copyberry
• [#36140] Wait for memory consolidation shutdown before finishing jobs @copyberry
• [#36146] Stabilize approval scenario tests @copyberry
• [#36148] Harden the file change approval integration test @copyberry
• [#36149] Strengthen session file change approval coverage @copyberry
• [#36165] Stabilize file approval replay test @copyberry
• [#36166] Make pending realtime sideband test deterministic @copyberry
• [#36167] Harden the auto-review model override test @copyberry
• [#36168] Make tool telemetry tag collection synchronous @copyberry
• [#36171] Test workspace-root patch protection for metadata @copyberry
• [#36177] Test remote Guardian network approval scoping @copyberry
• [#36181] Record attempted tool calls in response metadata @copyberry
• [#36183] Use permission profiles throughout sandbox execution @copyberry
• [#36184] Coalesce concurrent remote metadata requests @copyberry
• [#36187] Refresh environment dates from the configured clock @copyberry
• [#36188] Make thread history projection resilient to malformed rollouts @copyberry
• [#36191] Label explicit skill injection metrics @copyberry
• [#36194] Avoid shifting bytes in streaming output buffers @copyberry
• [#36207] Record normalized sandbox violation events @copyberry
• [#36212] Precompute app-server protocol exports @copyberry
• [#36217] Run code mode exclusively through the standalone host @copyberry
• [#36218] Expose connector candidates in external agent detection @copyberry
• [#36221] Ignore passthrough metadata when reconciling rollout items @copyberry
• [#36223] Preserve executor paths in read command actions @copyberry
• [#36228] Support Enterprise automation account plans @copyberry
• [#36237] Ignore symbolic slash-tmp permissions on Windows @copyberry
• [#36239] Refresh precomputed app-server protocol exports @copyberry
• [#36264] Prefer the bundled resource for the code mode host @copyberry
• [#36271] Derive report prompt hashes from persisted rollouts @copyberry
• [#36306] Restrict hosted MCP credentials to local environments @copyberry
• [#36309] Use the host skill provider catalog in world state @copyberry
• [#36310] Isolate MCP OAuth credentials by environment @copyberry
• [#36311] Include skills in debug prompt input output @copyberry
• [#36327] Preserve discovery order for host skill path aliases @copyberry
• [#36329] Restrict shell_command to a single local environment @copyberry
• [#36336] Detect connectors used in external agent sessions @copyberry
• [#36339] Enable skills in the MCP server @copyberry
• [#36342] Stop publishing legacy Linux bundle archives @copyberry
• [#36350] Require explicit sandbox permissions with shell justifications @copyberry
• [#36351] Use model catalog collaboration mode messages @copyberry
• [#36354] Pass sessions directly to session tasks @copyberry
• [#36355] Keep MCP tool calls bound to their thread @copyberry
• [#36356] Sync updates to imported external agent sessions @copyberry
• [#36357] Use the step-scoped router for tool execution @copyberry
• [#36359] Consolidate MCP config editing in codex-core @copyberry
• [#36360] Use MCP bindings as the step tool catalog @copyberry
• [#36361] Migrate Cursor-managed skills into Codex @copyberry
• [#36364] Move skill catalog rendering out of core @copyberry
• [#36365] Add strict automatic review for MCP elicitations @copyberry
• [#36367] Keep effective tool exposure in the registry @copyberry
• [#36372] Run native Windows Bazel tests with MSVC @copyberry
• [#36373] Add an --approve-for-me CLI flag @copyberry
• [#36374] Enable sandboxed V8 for code mode @copyberry
• [#36378] Load local session pickers from the state DB first @copyberry
• [#36380] Add thread section management APIs @copyberry
• [#36384] Load turn summaries with paginated queries @copyberry
• [#36385] Add acknowledged user message submission to core @copyberry
• [#36388] Track image preparation details in turn analytics @copyberry
• [#36389] Enforce single-writer ownership for all thread histories @copyberry
• [#36393] Avoid redundant filesystem probes @copyberry
• [#36402] Declare the experimental plugin search API @copyberry
• [#36408] Allow custom Codex instructions for realtime transitions @copyberry
• [#36409] Implement remote plugin search @copyberry
• [#36410] Make user input blocking behavior explicit @copyberry
• [#36411] Use Git repositories as pre-tool hook test markers @copyberry
• [#36413] Add a realtime delegation acknowledgement control @copyberry
• [#36440] Extract exec-server request dispatching @copyberry
• [#36482] Avoid querying terminal size on every TUI redraw @copyberry
• [#36485] Increase remote plugin bundle size limits @copyberry
• [#36507] Retain attempted tool metadata across prompts @copyberry
• [#36511] Support two-stroke TUI key chords @copyberry
• [#36534] Raise the MCP catalog item limit to 2,048 @copyberry
• [#36544] Support portable Agent Plugins throughout installation @copyberry
• [#36632] Preserve SQLite thread metadata during goal mutations @copyberry
• [#36635] Expose onboarding hints in login completion notifications @copyberry
• [#36641] Capture rollout budget units from response usage @copyberry
• [#36715] Use provider-reported rollout budget units @copyberry
• [#36716] Deduplicate MCP resource operation handling @copyberry
• [#36727] Simplify turn metadata state ownership @copyberry
• [#36729] Correlate code mode tool analytics with model responses @copyberry
• [#36732] Stabilize the cloud environment HTTP test @copyberry
• [#36734] Deduplicate MCP resource list handling @copyberry
• [#36740] Store turn skill state in extension data @copyberry
• [#36742] Simplify contextual user fragment registration @copyberry
• [#36744] Store the extension registry directly in its builder @copyberry
• [#36745] Consolidate apply_patch runtime execution @copyberry
• [#36757] Wait for patch events before reading shell snapshots @copyberry
• [#36759] Harden the TUI focus palette regression test @copyberry
• [#36764] Avoid building code-mode definitions during registration @copyberry
• [#36769] Stabilize the startup Git enrichment integration test @copyberry
• [#36770] Stabilize deferred goal fork testing @copyberry
• [#36771] Harden Linux managed proxy helper lifecycles @copyberry
• [#36772] Raise the host-owned Codex Apps catalog limit @copyberry
• [#36773] Derive the active user config layer from the layer stack @copyberry
• [#36774] Clarify config layer iteration APIs @copyberry
• [#36779] Stabilize network policy event capture in concurrent tests @copyberry
• [#36781] Add per-surface MCP tool exposure controls @copyberry
• [#36782] Add Guardian session reuse and interruption tests @copyberry
• [#36787] Consolidate model instructions in ModelMessages @copyberry
• [#36792] Gate plugin usage instructions by model capability @copyberry
• [#36793] Terminate timed-out Git process trees @copyberry
• [#36796] Add Agent Plugins MCP config parsing @copyberry
• [#36797] Normalize rusty_v8 checksum manifest line endings @copyberry
• [#36800] Avoid reinjecting permissions after command approvals @copyberry
• [#36807] Extract audio preparation into a utility crate @copyberry
• [#36808] Prefer SQLite names for local session archive commands @copyberry
• [#36809] Prefer the state database for exec resume --last @copyberry
• [#36810] Add MCP client conformance regression gates @copyberry
• [#36811] Honor per-environment login shell policy @copyberry
• [#36812] Add a dual-WebSocket transport for code mode @copyberry
• [#36815] Identify agents by name in token budget context @copyberry
• [#36822] Fix typo in approval resolver name @copyberry
• [#36825] Consolidate approval telemetry context @copyberry
• [#36830] Time out stalled code-mode host requests @copyberry
• [#36834] Avoid requesting key-release events in Ghostty @copyberry
• [#36840] Keep API request metrics out of Statsig exports @copyberry
• [#36856] Support deferred loading for freeform tools @copyberry
• [#36857] Support custom tools in namespaces @copyberry
• [#36862] Consolidate thread spawning behind a request object @copyberry
• [#36871] Parallelize R2 asset publishing with DotSlash @copyberry
• [#36877] Move executor skill bundle loading into the skills extension @copyberry
• [#36880] Move direct executor skill discovery into the skills extension @copyberry
• [#36882] Preserve complete MCP namespace descriptions @copyberry
• [#36884] Add host skill root loading @copyberry
• [#36892] Support leaf models in multi-agent v2 @copyberry
• [#36893] Redact secrets from app-server command execution items @copyberry
• [#36895] Handle late MCP startup results after lag timeout @copyberry
• [#36898] Avoid redundant filesystem metadata probes @copyberry
• [#36900] Register app tools independently of the connector list @copyberry
• [#36901] Propagate updated permissions to review threads @copyberry
• [#36903] Load skill interface metadata in the host loader @copyberry
• [#36904] Limit RMCP logs persisted to SQLite @copyberry
• [#36906] Preserve model providers when reloading v2 agents @copyberry
• [#36908] Improve bearer token secret redaction @copyberry
• [#36910] Negotiate MCP extensions per app-server session @copyberry
• [#36912] Read approval policy from the current turn configuration @copyberry
• [#36913] Move skill policy resolution into codex-skills @copyberry
• [#36916] Centralize app enabled-state evaluation @copyberry
• [#36917] Test explicit plugin mentions with disabled apps @copyberry
• [#36919] Merge local plugins into plugin search results @copyberry
• [#36921] Move the host skills service into the skills extension @copyberry
• [#36924] Reject implicitly discovered bare Git repositories @copyberry
• [#36930] Read turn permissions from the current configuration @copyberry
• [#36935] Trust undecided local projects automatically @copyberry
• [#36938] Enable cached web search for Amazon Bedrock @copyberry
• [#36939] Include policy approval reasons in Guardian reviews @copyberry
• [#36941] Use current session settings for review threads @copyberry
• [#36943] Move host skill root resolution into the skills extension @copyberry
• [#36945] Grant the blob size policy job read access to contents @copyberry
• [#36947] Accept user input when starting idle turns @copyberry
• [#36948] Paginate transcript history in the TUI @copyberry
• [#36949] Improve paginated TUI history loading @copyberry
• [#36950] Paginate TUI transcript history @copyberry
• [#36951] Harden paginated history handling in the TUI @copyberry
• [#36952] Add durable per-thread user submission queues @copyberry
• [#36954] Add tool registry collision policy configuration @copyberry
• [#36956] Keep image resize notices attached during remote compaction @copyberry
• [#36959] Track connectors detected in external agent sessions @copyberry
• [#36960] Prompt before trusting local project directories @copyberry
• [#36963] Link Codex attribution in pull request bodies @copyberry
• [#36964] Preserve working directories when importing external sessions @copyberry
• [#36966] Allow disabling the built-in image viewer @copyberry
• [#36967] Skip symlinks when installing plugins @copyberry
• [#36970] Make token budget context identity configurable @copyberry
• [#36976] Honor explicit-only orchestrator skills @copyberry
• [#36977] Improve connector detection for migrated sessions @copyberry
• [#36979] Add Fence auditing to the blob size workflow @copyberry
• [#36981] Enable remote compaction for Amazon Bedrock @copyberry
• [#36983] Preserve ChatGPT auth for trusted staging MCP servers @copyberry
• [#36984] Support configured ChatGPT cookies in HTTP clients @copyberry
• [#36986] Add process-scoped PSP routing for ChatGPT requests @copyberry
• [#36987] Add opt-in concurrent exec-server request dispatch @copyberry
• [#36989] Preserve shared bundled skill caches @copyberry
• [#36990] Remove legacy collaboration mode variants @copyberry
• [#36992] Allow injecting model catalog caches @copyberry
• [#36993] Support includeTurns reads for paginated threads @copyberry
• [#36998] Support deferred custom tools in tool search @copyberry
• [#37000] Keep shared skill caches fresh across plugin loads @copyberry
• [#37020] Enforce strict tool name collision errors @copyberry
• [#37022] Canonicalize default tools under the functions namespace @copyberry
• [#37027] Enforce Agent Plugin runtime boundaries @copyberry
• [#37031] Apply permission profile updates to future turn environments @copyberry
• [#37035] Align registry tests with canonical tool names @copyberry
• [#37038] Use turn environment permissions for tool execution @copyberry
• [#37040] Use turn environment permissions for context and discovery @copyberry
• [#37053] Reject conflicting namespace descriptions in strict tool mode @copyberry
• [#37055] Add safer TUI defaults for cyber models @copyberry
• [#37066] Preserve longer MCP source descriptions in tool search @copyberry
• [#37068] Fall back to per-process MCP cleanup on macOS @copyberry
• [#37083] Consolidate unified exec output state @copyberry
• [#37101] Reuse stable MCP bindings across sampling steps @copyberry
• [#37103] Use Luna for API-key Guardian reviews @copyberry
• [#37109] Bound interactive telemetry shutdown @copyberry
• [#37114] Add per-session code-mode execution limits @copyberry
• [#37128] Centralize tool approval handling in Session @copyberry
• [#37129] Make Windows path URI comparisons ASCII-case-insensitive @copyberry
• [#37132] Enforce managed authentication requirements locally @copyberry
• [#37134] Report prompt image resizing to the model @copyberry
• [#37144] Preserve discovery paths for symlinked skills @copyberry
• [#37145] Gate Apps usage instructions by model capability @copyberry
• [#37147] Track provisioned environment state across registration @copyberry
• [#37149] Project orchestrator skills through world state @copyberry
• [#37151] Coalesce concurrent Git status scans @copyberry
• [#37154] Use Azure Key Vault for macOS notarization @copyberry
• [#37156] Test remote environments reported ready before selection @copyberry
• [#37157] Harden named session lookup in the TUI @copyberry
• [#37162] Load host skill roots through the skills extension @copyberry
• [#37166] Keep textarea cursors and rendering inside the viewport @copyberry
• [#37167] Expose session sources to MCP contributors @copyberry
• [#37168] Bound remote MCP handshake HTTP requests @copyberry
• [#37169] Move plugin skill snapshot integration tests into core @copyberry
• [#37174] Centralize skill invocation helpers in codex-skills @copyberry
• [#37175] Add legacy rollout migration to paginated history @copyberry
• [#37177] Move explicit skill selection into the skills crate @copyberry
• [#37178] Preserve image transparency metadata in app-server items @copyberry
• [#37188] Reserve the tool_search namespace for the search tool @copyberry
• [#37189] Track multi-agent usage hints in world state @copyberry