fix(mcp): let an eval cell use a searchable tool that is not active yet

[code-yeongyu]

Problem

In session 019fa397-dbbc-7a05-baa2-6a68852ff384 an eval cell ran:

tool.mcp_computer_use_click({'x':826,'y':371,'button':'left','clickCount':1})

and got back:

Tool mcp_computer_use_click is registered but inactive.
Active tools: read, bash, apply_patch, todo, ...

The assistant then emitted empty text and stalled (msg 22). The user had to intervene — "no use eval just pure tool call plz" (msg 25) — and eval was abandoned for the rest of the session.

The tool was registered, just not active. Moments later the model called tool_search, which activated those exact same tools, and the identical work succeeded. Search-mode MCP exposure registers the whole catalog but keeps only directTools active, and only tool_search could promote from it. That asymmetry — tool_search may promote, a code-mode cell may not — is the bug.

Change

executeTool() resolved a name against the active set and, on a miss, consulted the definition registry only to choose between inactive_tool and unknown_tool before throwing.

Add registerLazyToolActivator(activator). When a name resolves to a registered-but-inactive tool, registered activators run before the throw; one returning true means it actually activated the tool, and execution proceeds.

Core deliberately does not decide eligibility. builtin/mcp registers an activator whose eligible set is the tier-B searchable catalog and nothing else.

Why not blanket activation

A one-line "activate anything registered" change is unsafe. _toolDefinitions also holds:

Kind	Why it must stay inactive	Anchor
Permission-denied tools	deny * rules are applied by deactivating	permission-system/index.ts:96-100, config.ts:71-84
MCP list_changed additions	documented rug-pull defense	mcp/notifications.ts:1-9
Removed-tool tombstones	re-registered specifically to stay inactive	mcp/service.ts:436-439
look_at / read_video	capability gates (model lacks vision/video)	look-at/index.ts:37-48

None are in the searchable catalog, so all stay inactive. Activation also routes through the tier-B activate() path rather than the generic active-set setter, so stubSwap still swaps the registered stub for the full definition — marking a stub active would have returned stub output while the active-set assertion looked correct.

An activator returning false preserves inactive_tool byte for byte; unknown_tool is untouched. execute-tool.test.ts and look-at-extension.test.ts pass unmodified.

Evidence

Real AgentSession through pi.executeTool, same tool and coordinates as the failing session:

BEFORE active: read
RESULT: [{"type":"text","text":"clicked 826,371"}]
AFTER active: read,mcp_computer_use_click
look_at REFUSED: inactive_tool
unknown REFUSED: unknown_tool
FINAL active: read,mcp_computer_use_click

The capability-gated tool is still refused and never enters the active set.

Gates

• test/mcp/ + execute-tool + look-at-extension + extensions-runner + permission/: 849 passed (63 files)
• packages/senpi-codemode: 403 passed, 6 skipped (pre-existing interpreter skips)
• npx tsgo --noEmit: exit 0
• npm run check (root): exit 0

Both criteria were captured RED first: the policy test failed on the absent module, and the session-wiring test failed with pi.registerLazyToolActivator is not a function.

Review

Reviewed by momus, which returned REJECT / SAFE-ONLY-IF on the original blanket-activation design. Every blocker was applied: catalog-scoped eligibility, tier-B activate() for stub-swap, opt-in registration, and tests covering the refusal paths rather than only the happy path.

Plan: .omo/plans/eval-auto-activate-tools.md

---

Summary by cubic

Fixes stalled eval cells by lazily activating eligible searchable MCP tools just in time for eval. Activation is opt-in via activateInactiveTool (enabled only for eval), and gated, tombstoned, and permission‑denied tools remain inactive.

• Bug Fixes

  • executeTool() now, when activateInactiveTool is true, runs registered lazy activators for registered‑but‑inactive tools and executes on success.
  • Restores the setActiveToolsByName docblock after introducing _activateLazyTool.

• New Features

  • Adds registerLazyToolActivator(activator) to the Extension API and ExecuteToolOptions.activateInactiveTool. The codemode wrapper enables it for eval; other callers keep inactive_tool/unknown_tool unchanged.
  • builtin/mcp registers an activator that promotes only tier‑B searchable tools via its activate() path, preserving stub‑swap and catalog rules. Extension loader/runner persist and replay activators across bindCore().

^{Written for commit 07ab203. Summary will update on new commits.}