docs: update devbox run helper for main

This seems to be required to fix bazel builds on an applied devbox

## Summary
- add the Bazel `xz` module
- wire `lzma-sys` directly to `@xz//:lzma` and disable its build script
- refresh `MODULE.bazel.lock`

## Validation
- `just bazel-lock-update`
- `just bazel-lock-check`
- `bazel run //codex-rs/cli:codex --run_under="cd $PWD &&" -- --version`
- `just bazel-codex --version`

Co-authored-by: Codex <noreply@openai.com>

MODULE.bazel

@@ -234,14 +234,18 @@ crate.annotation(
 
 inject_repo(crate, "zlib")
 
-# TODO(zbarsky): Enable annotation after fixing windows arm64 builds.
+bazel_dep(name = "xz", version = "5.4.5.bcr.8")
+
 crate.annotation(
     crate = "lzma-sys",
-    gen_build_script = "on",
+    gen_build_script = "off",
+    deps = ["@xz//:lzma"],
 )
 
 bazel_dep(name = "openssl", version = "3.5.4.bcr.0")
 
+inject_repo(crate, "xz")
+
 crate.annotation(
     build_script_data = [
         "@openssl//:gen_dir",

MODULE.bazel.lock

@@ -228,6 +228,8 @@
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/MODULE.bazel": "b573395fe63aef4299ba095173e2f62ccfee5ad9bbf7acaa95dba73af9fc2b38",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8",
+    "https://bcr.bazel.build/modules/xz/5.4.5.bcr.8/MODULE.bazel": "e48a69bd54053c2ec5fffc2a29fb70122afd3e83ab6c07068f63bc6553fa57cc",
+    "https://bcr.bazel.build/modules/xz/5.4.5.bcr.8/source.json": "bd7e928ccd63505b44f4784f7bbf12cc11f9ff23bf3ca12ff2c91cd74846099e",
     "https://bcr.bazel.build/modules/zlib/1.2.11/MODULE.bazel": "07b389abc85fdbca459b69e2ec656ae5622873af3f845e1c9d80fe179f3effa0",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/MODULE.bazel": "eec517b5bbe5492629466e11dae908d043364302283de25581e3eb944326c4ca",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.8/MODULE.bazel": "772c674bb78a0342b8caf32ab5c25085c493ca4ff08398208dcbe4375fe9f776",

codex-rs/app-server/README.md

@@ -132,7 +132,7 @@ Example with notification opt-out:
 
 ## API Overview
 
-- `thread/start` — create a new thread; emits `thread/started` (including the current `thread.status`) and auto-subscribes you to turn/item events for that thread.
+- `thread/start` — create a new thread; emits `thread/started` (including the current `thread.status`) and auto-subscribes you to turn/item events for that thread. When the request includes a `cwd` and the resolved sandbox is `workspace-write` or full access, app-server also marks that project as trusted in the user `config.toml`.
 - `thread/resume` — reopen an existing thread by id so subsequent `turn/start` calls append to it.
 - `thread/fork` — fork an existing thread into a new thread id by copying the stored history; if the source thread is currently mid-turn, the fork records the same interruption marker as `turn/interrupt` instead of inheriting an unmarked partial turn suffix. The returned `thread.forkedFromId` points at the source thread when known. Accepts `ephemeral: true` for an in-memory temporary fork, emits `thread/started` (including the current `thread.status`), and auto-subscribes you to turn/item events for the new thread.
 - `thread/list` — page through stored rollouts; supports cursor-based pagination and optional `modelProviders`, `sourceKinds`, `archived`, `cwd`, and `searchTerm` filters. Each returned `thread` includes `status` (`ThreadStatus`), defaulting to `notLoaded` when the thread is not currently loaded.

codex-rs/app-server/src/codex_message_processor.rs

@@ -235,6 +235,7 @@ use codex_features::Feature;
 use codex_features::Stage;
 use codex_feedback::CodexFeedback;
 use codex_git_utils::git_diff_to_remote;
+use codex_git_utils::resolve_root_git_project_for_trust;
 use codex_login::AuthManager;
 use codex_login::AuthMode as CoreAuthMode;
 use codex_login::CLIENT_ID;
@@ -255,6 +256,7 @@ use codex_protocol::ThreadId;
 use codex_protocol::config_types::CollaborationMode;
 use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::Personality;
+use codex_protocol::config_types::TrustLevel;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::dynamic_tools::DynamicToolSpec as CoreDynamicToolSpec;
 use codex_protocol::items::TurnItem;
@@ -2190,10 +2192,11 @@ impl CodexMessageProcessor {
         experimental_raw_events: bool,
         request_trace: Option<W3cTraceContext>,
     ) {
-        let config = match derive_config_from_params(
+        let requested_cwd = typesafe_overrides.cwd.clone();
+        let mut config = match derive_config_from_params(
             &cli_overrides,
-            config_overrides,
-            typesafe_overrides,
+            config_overrides.clone(),
+            typesafe_overrides.clone(),
             &cloud_requirements,
             &listener_task_context.codex_home,
             &runtime_feature_enablement,
@@ -2211,6 +2214,56 @@ impl CodexMessageProcessor {
             }
         };
 
+        if requested_cwd.is_some()
+            && !config.active_project.is_trusted()
+            && matches!(
+                config.permissions.sandbox_policy.get(),
+                codex_protocol::protocol::SandboxPolicy::WorkspaceWrite { .. }
+                    | codex_protocol::protocol::SandboxPolicy::DangerFullAccess
+                    | codex_protocol::protocol::SandboxPolicy::ExternalSandbox { .. }
+            )
+        {
+            let trust_target = resolve_root_git_project_for_trust(config.cwd.as_path())
+                .unwrap_or_else(|| config.cwd.to_path_buf());
+            if let Err(err) = codex_core::config::set_project_trust_level(
+                &listener_task_context.codex_home,
+                trust_target.as_path(),
+                TrustLevel::Trusted,
+            ) {
+                let error = JSONRPCErrorError {
+                    code: INTERNAL_ERROR_CODE,
+                    message: format!("failed to persist trusted project state: {err}"),
+                    data: None,
+                };
+                listener_task_context
+                    .outgoing
+                    .send_error(request_id, error)
+                    .await;
+                return;
+            }
+
+            config = match derive_config_from_params(
+                &cli_overrides,
+                config_overrides,
+                typesafe_overrides,
+                &cloud_requirements,
+                &listener_task_context.codex_home,
+                &runtime_feature_enablement,
+            )
+            .await
+            {
+                Ok(config) => config,
+                Err(err) => {
+                    let error = config_load_error(&err);
+                    listener_task_context
+                        .outgoing
+                        .send_error(request_id, error)
+                        .await;
+                    return;
+                }
+            };
+        }
+
         let dynamic_tools = dynamic_tools.unwrap_or_default();
         let core_dynamic_tools = if dynamic_tools.is_empty() {
             Vec::new()

codex-rs/app-server/tests/suite/v2/thread_shell_command.rs

@@ -26,6 +26,7 @@ use codex_app_server_protocol::TurnCompletedNotification;
 use codex_app_server_protocol::TurnStartParams;
 use codex_app_server_protocol::TurnStartResponse;
 use codex_app_server_protocol::UserInput as V2UserInput;
+use codex_core::shell::default_user_shell;
 use codex_features::FEATURES;
 use codex_features::Feature;
 use pretty_assertions::assert_eq;
@@ -67,11 +68,12 @@ async fn thread_shell_command_runs_as_standalone_turn_and_persists_history() ->
     )
     .await??;
     let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+    let (shell_command, expected_output) = current_shell_output_command("hello from bang")?;
 
     let shell_id = mcp
         .send_thread_shell_command_request(ThreadShellCommandParams {
             thread_id: thread.id.clone(),
-            command: "printf 'hello from bang\\n'".to_string(),
+            command: shell_command,
         })
         .await?;
     let shell_resp: JSONRPCResponse = timeout(
@@ -93,7 +95,7 @@ async fn thread_shell_command_runs_as_standalone_turn_and_persists_history() ->
     assert_eq!(status, &CommandExecutionStatus::InProgress);
 
     let delta = wait_for_command_execution_output_delta(&mut mcp, &command_id).await?;
-    assert_eq!(delta.delta, "hello from bang\n");
+    assert_eq!(delta.delta, expected_output);
 
     let completed = wait_for_command_execution_completed(&mut mcp, Some(&command_id)).await?;
     let ThreadItem::CommandExecution {
@@ -110,7 +112,7 @@ async fn thread_shell_command_runs_as_standalone_turn_and_persists_history() ->
     assert_eq!(id, &command_id);
     assert_eq!(source, &CommandExecutionSource::UserShell);
     assert_eq!(status, &CommandExecutionStatus::Completed);
-    assert_eq!(aggregated_output.as_deref(), Some("hello from bang\n"));
+    assert_eq!(aggregated_output.as_deref(), Some(expected_output.as_str()));
     assert_eq!(*exit_code, Some(0));
 
     timeout(
@@ -147,7 +149,7 @@ async fn thread_shell_command_runs_as_standalone_turn_and_persists_history() ->
     };
     assert_eq!(source, &CommandExecutionSource::UserShell);
     assert_eq!(status, &CommandExecutionStatus::Completed);
-    assert_eq!(aggregated_output.as_deref(), Some("hello from bang\n"));
+    assert_eq!(aggregated_output.as_deref(), Some(expected_output.as_str()));
 
     Ok(())
 }
@@ -196,6 +198,7 @@ async fn thread_shell_command_uses_existing_active_turn() -> Result<()> {
     )
     .await??;
     let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+    let (shell_command, expected_output) = current_shell_output_command("active turn bang")?;
 
     let turn_id = mcp
         .send_turn_start_request(TurnStartParams {
@@ -240,7 +243,7 @@ async fn thread_shell_command_uses_existing_active_turn() -> Result<()> {
     let shell_id = mcp
         .send_thread_shell_command_request(ThreadShellCommandParams {
             thread_id: thread.id.clone(),
-            command: "printf 'active turn bang\\n'".to_string(),
+            command: shell_command,
         })
         .await?;
     let shell_resp: JSONRPCResponse = timeout(
@@ -269,7 +272,7 @@ async fn thread_shell_command_uses_existing_active_turn() -> Result<()> {
         unreachable!("helper returns command execution item");
     };
     assert_eq!(source, &CommandExecutionSource::UserShell);
-    assert_eq!(aggregated_output.as_deref(), Some("active turn bang\n"));
+    assert_eq!(aggregated_output.as_deref(), Some(expected_output.as_str()));
 
     mcp.send_response(
         request_id,
@@ -309,7 +312,7 @@ async fn thread_shell_command_uses_existing_active_turn() -> Result<()> {
                     source: CommandExecutionSource::UserShell,
                     aggregated_output,
                     ..
-                } if aggregated_output.as_deref() == Some("active turn bang\n")
+                } if aggregated_output.as_deref() == Some(expected_output.as_str())
             )
         }),
         "expected active-turn shell command to be persisted on the existing turn"
@@ -318,6 +321,24 @@ async fn thread_shell_command_uses_existing_active_turn() -> Result<()> {
     Ok(())
 }
 
+fn current_shell_output_command(text: &str) -> Result<(String, String)> {
+    let command_and_output = match default_user_shell().name() {
+        "powershell" => {
+            let escaped_text = text.replace('\'', "''");
+            (
+                format!("Write-Output '{escaped_text}'"),
+                format!("{text}\r\n"),
+            )
+        }
+        "cmd" => (format!("echo {text}"), format!("{text}\r\n")),
+        _ => {
+            let quoted_text = shlex::try_quote(text)?;
+            (format!("printf '%s\\n' {quoted_text}"), format!("{text}\n"))
+        }
+    };
+    Ok(command_and_output)
+}
+
 async fn wait_for_command_execution_started(
     mcp: &mut McpProcess,
     expected_id: Option<&str>,

codex-rs/app-server/tests/suite/v2/thread_start.rs

@@ -4,12 +4,14 @@ use app_test_support::McpProcess;
 use app_test_support::create_mock_responses_server_repeating_assistant;
 use app_test_support::to_response;
 use app_test_support::write_chatgpt_auth;
+use codex_app_server_protocol::AskForApproval;
 use codex_app_server_protocol::JSONRPCError;
 use codex_app_server_protocol::JSONRPCMessage;
 use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::McpServerStartupState;
 use codex_app_server_protocol::McpServerStatusUpdatedNotification;
 use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::SandboxMode;
 use codex_app_server_protocol::ServerNotification;
 use codex_app_server_protocol::ThreadStartParams;
 use codex_app_server_protocol::ThreadStartResponse;
@@ -17,6 +19,7 @@ use codex_app_server_protocol::ThreadStartedNotification;
 use codex_app_server_protocol::ThreadStatus;
 use codex_app_server_protocol::ThreadStatusChangedNotification;
 use codex_core::config::set_project_trust_level;
+use codex_git_utils::resolve_root_git_project_for_trust;
 use codex_login::AuthCredentialsStoreMode;
 use codex_login::REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR;
 use codex_protocol::config_types::ServiceTier;
@@ -48,7 +51,7 @@ async fn thread_start_creates_thread_and_emits_started() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
 
     let codex_home = TempDir::new()?;
-    create_config_toml(codex_home.path(), &server.uri())?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
 
     // Start server and initialize.
     let mut mcp = McpProcess::new(codex_home.path()).await?;
@@ -231,7 +234,7 @@ async fn thread_start_respects_project_config_from_cwd() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
 
     let codex_home = TempDir::new()?;
-    create_config_toml(codex_home.path(), &server.uri())?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
 
     let workspace = TempDir::new()?;
     let project_config_dir = workspace.path().join(".codex");
@@ -272,7 +275,7 @@ async fn thread_start_accepts_flex_service_tier() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
 
     let codex_home = TempDir::new()?;
-    create_config_toml(codex_home.path(), &server.uri())?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
 
     let mut mcp = McpProcess::new(codex_home.path()).await?;
     timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
@@ -300,7 +303,7 @@ async fn thread_start_accepts_metrics_service_name() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
 
     let codex_home = TempDir::new()?;
-    create_config_toml(codex_home.path(), &server.uri())?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
 
     let mut mcp = McpProcess::new(codex_home.path()).await?;
     timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
@@ -327,7 +330,7 @@ async fn thread_start_accepts_metrics_service_name() -> Result<()> {
 async fn thread_start_ephemeral_remains_pathless() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
     let codex_home = TempDir::new()?;
-    create_config_toml(codex_home.path(), &server.uri())?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
 
     let mut mcp = McpProcess::new(codex_home.path()).await?;
     timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
@@ -584,16 +587,210 @@ async fn thread_start_surfaces_cloud_requirements_load_errors() -> Result<()> {
     Ok(())
 }
 
-// Helper to create a config.toml pointing at the mock model server.
-fn create_config_toml(codex_home: &Path, server_uri: &str) -> std::io::Result<()> {
+#[tokio::test]
+async fn thread_start_with_elevated_sandbox_trusts_project_and_followup_loads_project_config()
+-> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
+
+    let workspace = TempDir::new()?;
+    let project_config_dir = workspace.path().join(".codex");
+    std::fs::create_dir_all(&project_config_dir)?;
+    std::fs::write(
+        project_config_dir.join("config.toml"),
+        r#"
+model_reasoning_effort = "high"
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let first_request = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(workspace.path().display().to_string()),
+            sandbox: Some(SandboxMode::WorkspaceWrite),
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(first_request)),
+    )
+    .await??;
+
+    let second_request = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(workspace.path().display().to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let second_response: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(second_request)),
+    )
+    .await??;
+    let ThreadStartResponse {
+        approval_policy,
+        reasoning_effort,
+        ..
+    } = to_response::<ThreadStartResponse>(second_response)?;
+
+    assert_eq!(approval_policy, AskForApproval::OnRequest);
+    assert_eq!(reasoning_effort, Some(ReasoningEffort::High));
+
+    let config_toml = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+    let trusted_root = resolve_root_git_project_for_trust(workspace.path())
+        .unwrap_or_else(|| workspace.path().to_path_buf());
+    assert!(config_toml.contains(&trusted_root.display().to_string()));
+    assert!(config_toml.contains("trust_level = \"trusted\""));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn thread_start_with_nested_git_cwd_trusts_repo_root() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
+
+    let repo_root = TempDir::new()?;
+    std::fs::create_dir(repo_root.path().join(".git"))?;
+    let nested = repo_root.path().join("nested/project");
+    std::fs::create_dir_all(&nested)?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(nested.display().to_string()),
+            sandbox: Some(SandboxMode::WorkspaceWrite),
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    let config_toml = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+    let trusted_root =
+        resolve_root_git_project_for_trust(&nested).expect("git root should resolve");
+    assert!(config_toml.contains(&trusted_root.display().to_string()));
+    assert!(!config_toml.contains(&nested.display().to_string()));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn thread_start_with_read_only_sandbox_does_not_persist_project_trust() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
+
+    let workspace = TempDir::new()?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(workspace.path().display().to_string()),
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    let config_toml = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+    assert!(!config_toml.contains("trust_level = \"trusted\""));
+    assert!(!config_toml.contains(&workspace.path().display().to_string()));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn thread_start_skips_trust_write_when_project_is_already_trusted() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
+
+    let workspace = TempDir::new()?;
+    let project_config_dir = workspace.path().join(".codex");
+    std::fs::create_dir_all(&project_config_dir)?;
+    std::fs::write(
+        project_config_dir.join("config.toml"),
+        r#"
+model_reasoning_effort = "high"
+"#,
+    )?;
+    set_project_trust_level(codex_home.path(), workspace.path(), TrustLevel::Trusted)?;
+    let config_before = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(workspace.path().display().to_string()),
+            sandbox: Some(SandboxMode::WorkspaceWrite),
+            ..Default::default()
+        })
+        .await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let ThreadStartResponse {
+        approval_policy,
+        reasoning_effort,
+        ..
+    } = to_response::<ThreadStartResponse>(response)?;
+
+    assert_eq!(approval_policy, AskForApproval::OnRequest);
+    assert_eq!(reasoning_effort, Some(ReasoningEffort::High));
+
+    let config_after = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+    assert_eq!(config_after, config_before);
+
+    Ok(())
+}
+
+fn create_config_toml_without_approval_policy(
+    codex_home: &Path,
+    server_uri: &str,
+) -> std::io::Result<()> {
+    create_config_toml_with_optional_approval_policy(
+        codex_home, server_uri, /*approval_policy*/ None,
+    )
+}
+
+fn create_config_toml_with_optional_approval_policy(
+    codex_home: &Path,
+    server_uri: &str,
+    approval_policy: Option<&str>,
+) -> std::io::Result<()> {
     let config_toml = codex_home.join("config.toml");
+    let approval_policy = approval_policy
+        .map(|policy| format!("approval_policy = \"{policy}\"\n"))
+        .unwrap_or_default();
     std::fs::write(
         config_toml,
         format!(
             r#"
 model = "mock-model"
-approval_policy = "never"
-sandbox_mode = "read-only"
+{approval_policy}sandbox_mode = "read-only"
 
 model_provider = "mock_provider"
 

codex-rs/app-server/tests/suite/v2/turn_start.rs

@@ -2523,6 +2523,67 @@ async fn command_execution_notifications_include_process_id() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn turn_start_with_elevated_override_does_not_persist_project_trust() -> Result<()> {
+    let responses = vec![create_final_assistant_message_sse_response("Done")?];
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml(
+        codex_home.path(),
+        &server.uri(),
+        "never",
+        &BTreeMap::from([(Feature::Personality, true)]),
+    )?;
+
+    let workspace = TempDir::new()?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_request = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(workspace.path().display().to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let thread_response: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(thread_request)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(thread_response)?;
+
+    let turn_request = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id,
+            cwd: Some(workspace.path().to_path_buf()),
+            sandbox_policy: Some(codex_app_server_protocol::SandboxPolicy::DangerFullAccess),
+            input: vec![V2UserInput::Text {
+                text: "Hello".to_string(),
+                text_elements: Vec::new(),
+            }],
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_request)),
+    )
+    .await??;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    let config_toml = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
+    assert!(!config_toml.contains("trust_level = \"trusted\""));
+    assert!(!config_toml.contains(&workspace.path().display().to_string()));
+
+    Ok(())
+}
+
 // Helper to create a config.toml pointing at the mock model server.
 fn create_config_toml(
     codex_home: &Path,

codex-rs/core/src/codex_tests.rs

@@ -41,11 +41,11 @@ use crate::state::TaskKind;
 use crate::tasks::SessionTask;
 use crate::tasks::SessionTaskContext;
 use crate::tools::ToolRouter;
+use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::ShellHandler;
 use crate::tools::handlers::UnifiedExecHandler;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::router::ToolCallSource;
 use crate::turn_diff_tracker::TurnDiffTracker;
@@ -119,14 +119,10 @@ use std::time::Duration as StdDuration;
 #[path = "codex_tests_guardian.rs"]
 mod guardian_tests;
 
-fn expect_text_tool_output(output: &AnyToolResult) -> String {
-    let ResponseInputItem::FunctionCallOutput { output, .. } = output
-        .result
-        .to_response_item(&output.call_id, &output.payload)
-    else {
-        panic!("expected function call output");
-    };
-    output.body.to_text().unwrap_or_default()
+use codex_protocol::models::function_call_output_content_items_to_text;
+
+fn expect_text_tool_output(output: &FunctionToolOutput) -> String {
+    function_call_output_content_items_to_text(&output.body).unwrap_or_default()
 }
 
 struct InstructionsTestCase {
@@ -3123,7 +3119,6 @@ async fn spawn_task_turn_span_inherits_dispatch_trace_context() {
         captured_trace: Arc<std::sync::Mutex<Option<W3cTraceContext>>>,
     }
 
-    #[async_trait::async_trait]
     impl SessionTask for TraceCaptureTask {
         fn kind(&self) -> TaskKind {
             TaskKind::Regular
@@ -4379,7 +4374,6 @@ struct NeverEndingTask {
     listen_to_cancellation_token: bool,
 }
 
-#[async_trait::async_trait]
 impl SessionTask for NeverEndingTask {
     fn kind(&self) -> TaskKind {
         self.kind
@@ -5119,7 +5113,8 @@ async fn fatal_tool_error_stops_turn_and_reports_error() {
             ToolCallSource::Direct,
         )
         .await
-        .expect_err("expected fatal error");
+        .err()
+        .expect("expected fatal error");
 
     match err {
         FunctionCallError::Fatal(message) => {

codex-rs/core/src/codex_tests_guardian.rs

@@ -8,7 +8,7 @@ use crate::exec::ExecParams;
 use crate::exec_policy::ExecPolicyManager;
 use crate::guardian::GUARDIAN_REVIEWER_NAME;
 use crate::sandboxing::SandboxPermissions;
-use crate::tools::registry::AnyToolResult;
+use crate::tools::context::FunctionToolOutput;
 use crate::turn_diff_tracker::TurnDiffTracker;
 use codex_app_server_protocol::ConfigLayerSource;
 use codex_exec_server::EnvironmentManager;
@@ -20,6 +20,7 @@ use codex_protocol::models::ContentItem;
 use codex_protocol::models::NetworkPermissions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::ResponseItem;
+use codex_protocol::models::function_call_output_content_items_to_text;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
@@ -39,14 +40,8 @@ use std::fs;
 use std::sync::Arc;
 use tempfile::tempdir;
 
-fn expect_text_output(output: &AnyToolResult) -> String {
-    let ResponseInputItem::FunctionCallOutput { output, .. } = output
-        .result
-        .to_response_item(&output.call_id, &output.payload)
-    else {
-        panic!("expected function call output");
-    };
-    output.body.to_text().unwrap_or_default()
+fn expect_text_output(output: &FunctionToolOutput) -> String {
+    function_call_output_content_items_to_text(&output.body).unwrap_or_default()
 }
 
 #[tokio::test]

codex-rs/core/src/models_manager/manager_tests.rs

@@ -112,10 +112,12 @@ impl ProviderAuthScript {
     fn new(tokens: &[&str]) -> std::io::Result<Self> {
         let tempdir = tempfile::tempdir()?;
         let tokens_file = tempdir.path().join("tokens.txt");
+        // `cmd.exe`'s `set /p` treats LF-only input as one line, so use CRLF on Windows.
+        let token_line_ending = if cfg!(windows) { "\r\n" } else { "\n" };
         let mut token_file_contents = String::new();
         for token in tokens {
             token_file_contents.push_str(token);
-            token_file_contents.push('\n');
+            token_file_contents.push_str(token_line_ending);
         }
         std::fs::write(&tokens_file, token_file_contents)?;
 
@@ -142,23 +144,28 @@ mv tokens.next tokens.txt
 
         #[cfg(windows)]
         let (command, args) = {
-            let script_path = tempdir.path().join("print-token.ps1");
+            let script_path = tempdir.path().join("print-token.cmd");
             std::fs::write(
                 &script_path,
-                r#"$lines = @(Get-Content -Path tokens.txt)
-if ($lines.Count -eq 0) { exit 1 }
-Write-Output $lines[0]
-$lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt
+                r#"@echo off
+setlocal EnableExtensions DisableDelayedExpansion
+set "first_line="
+<tokens.txt set /p "first_line="
+if not defined first_line exit /b 1
+setlocal EnableDelayedExpansion
+echo(!first_line!
+endlocal
+more +1 tokens.txt > tokens.next
+move /y tokens.next tokens.txt >nul
 "#,
             )?;
             (
-                "powershell".to_string(),
+                "cmd.exe".to_string(),
                 vec![
-                    "-NoProfile".to_string(),
-                    "-ExecutionPolicy".to_string(),
-                    "Bypass".to_string(),
-                    "-File".to_string(),
-                    ".\\print-token.ps1".to_string(),
+                    "/d".to_string(),
+                    "/s".to_string(),
+                    "/c".to_string(),
+                    ".\\print-token.cmd".to_string(),
                 ],
             )
         };
@@ -172,7 +179,7 @@ $lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt
 
     fn auth_config(&self) -> ModelProviderAuthInfo {
         let timeout_ms = if cfg!(windows) {
-            // `powershell.exe` startup can be slow on loaded Windows CI workers
+            // Process startup can be slow on loaded Windows CI workers.
             10_000
         } else {
             2_000

codex-rs/core/src/state/turn.rs

@@ -18,7 +18,7 @@ use rmcp::model::RequestId;
 use tokio::sync::oneshot;
 
 use crate::codex::TurnContext;
-use crate::tasks::SessionTask;
+use crate::tasks::AnySessionTask;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::ReviewDecision;
 use codex_protocol::protocol::TokenUsage;
@@ -69,7 +69,7 @@ pub(crate) enum TaskKind {
 pub(crate) struct RunningTask {
     pub(crate) done: Arc<Notify>,
     pub(crate) kind: TaskKind,
-    pub(crate) task: Arc<dyn SessionTask>,
+    pub(crate) task: Arc<dyn AnySessionTask>,
     pub(crate) cancellation_token: CancellationToken,
     pub(crate) handle: Arc<AbortOnDropHandle<()>>,
     pub(crate) turn_context: Arc<TurnContext>,

codex-rs/core/src/tasks/compact.rs

@@ -4,14 +4,12 @@ use super::SessionTask;
 use super::SessionTaskContext;
 use crate::codex::TurnContext;
 use crate::state::TaskKind;
-use async_trait::async_trait;
 use codex_protocol::user_input::UserInput;
 use tokio_util::sync::CancellationToken;
 
 #[derive(Clone, Copy, Default)]
 pub(crate) struct CompactTask;
 
-#[async_trait]
 impl SessionTask for CompactTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Compact
@@ -30,14 +28,14 @@ impl SessionTask for CompactTask {
     ) -> Option<String> {
         let session = session.clone_session();
         let _ = if crate::compact::should_use_remote_compact_task(&ctx.provider) {
-            let _ = session.services.session_telemetry.counter(
+            session.services.session_telemetry.counter(
                 "codex.task.compact",
                 /*inc*/ 1,
                 &[("type", "remote")],
             );
             crate::compact_remote::run_remote_compact_task(session.clone(), ctx).await
         } else {
-            let _ = session.services.session_telemetry.counter(
+            session.services.session_telemetry.counter(
                 "codex.task.compact",
                 /*inc*/ 1,
                 &[("type", "local")],

codex-rs/core/src/tasks/ghost_snapshot.rs

@@ -2,7 +2,6 @@ use crate::codex::TurnContext;
 use crate::state::TaskKind;
 use crate::tasks::SessionTask;
 use crate::tasks::SessionTaskContext;
-use async_trait::async_trait;
 use codex_git_utils::CreateGhostCommitOptions;
 use codex_git_utils::GhostSnapshotReport;
 use codex_git_utils::GitToolingError;
@@ -26,7 +25,6 @@ pub(crate) struct GhostSnapshotTask {
 
 const SNAPSHOT_WARNING_THRESHOLD: Duration = Duration::from_secs(240);
 
-#[async_trait]
 impl SessionTask for GhostSnapshotTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Regular

codex-rs/core/src/tasks/mod.rs

@@ -9,7 +9,7 @@ use std::sync::Arc;
 use std::time::Duration;
 use std::time::Instant;
 
-use async_trait::async_trait;
+use futures::future::BoxFuture;
 use tokio::select;
 use tokio::sync::Notify;
 use tokio_util::sync::CancellationToken;
@@ -126,7 +126,6 @@ impl SessionTaskContext {
 /// intentionally small: implementers identify themselves via
 /// [`SessionTask::kind`], perform their work in [`SessionTask::run`], and may
 /// release resources in [`SessionTask::abort`].
-#[async_trait]
 pub(crate) trait SessionTask: Send + Sync + 'static {
     /// Describes the type of work the task performs so the session can
     /// surface it in telemetry and UI.
@@ -143,21 +142,84 @@ pub(crate) trait SessionTask: Send + Sync + 'static {
     /// abort; implementers should watch for it and terminate quickly once it
     /// fires. Returning [`Some`] yields a final message that
     /// [`Session::on_task_finished`] will emit to the client.
-    async fn run(
+    fn run(
         self: Arc<Self>,
         session: Arc<SessionTaskContext>,
         ctx: Arc<TurnContext>,
         input: Vec<UserInput>,
         cancellation_token: CancellationToken,
-    ) -> Option<String>;
+    ) -> impl std::future::Future<Output = Option<String>> + Send;
 
     /// Gives the task a chance to perform cleanup after an abort.
     ///
     /// The default implementation is a no-op; override this if additional
     /// teardown or notifications are required once
     /// [`Session::abort_all_tasks`] cancels the task.
-    async fn abort(&self, session: Arc<SessionTaskContext>, ctx: Arc<TurnContext>) {
-        let _ = (session, ctx);
+    fn abort(
+        &self,
+        session: Arc<SessionTaskContext>,
+        ctx: Arc<TurnContext>,
+    ) -> impl std::future::Future<Output = ()> + Send {
+        async move {
+            let _ = (session, ctx);
+        }
+    }
+}
+
+pub(crate) trait AnySessionTask: Send + Sync + 'static {
+    fn kind(&self) -> TaskKind;
+
+    fn span_name(&self) -> &'static str;
+
+    fn run(
+        self: Arc<Self>,
+        session: Arc<SessionTaskContext>,
+        ctx: Arc<TurnContext>,
+        input: Vec<UserInput>,
+        cancellation_token: CancellationToken,
+    ) -> BoxFuture<'static, Option<String>>;
+
+    fn abort<'a>(
+        &'a self,
+        session: Arc<SessionTaskContext>,
+        ctx: Arc<TurnContext>,
+    ) -> BoxFuture<'a, ()>;
+}
+
+impl<T> AnySessionTask for T
+where
+    T: SessionTask,
+{
+    fn kind(&self) -> TaskKind {
+        SessionTask::kind(self)
+    }
+
+    fn span_name(&self) -> &'static str {
+        SessionTask::span_name(self)
+    }
+
+    fn run(
+        self: Arc<Self>,
+        session: Arc<SessionTaskContext>,
+        ctx: Arc<TurnContext>,
+        input: Vec<UserInput>,
+        cancellation_token: CancellationToken,
+    ) -> BoxFuture<'static, Option<String>> {
+        Box::pin(SessionTask::run(
+            self,
+            session,
+            ctx,
+            input,
+            cancellation_token,
+        ))
+    }
+
+    fn abort<'a>(
+        &'a self,
+        session: Arc<SessionTaskContext>,
+        ctx: Arc<TurnContext>,
+    ) -> BoxFuture<'a, ()> {
+        Box::pin(SessionTask::abort(self, session, ctx))
     }
 }
 
@@ -179,7 +241,7 @@ impl Session {
         input: Vec<UserInput>,
         task: T,
     ) {
-        let task: Arc<dyn SessionTask> = Arc::new(task);
+        let task: Arc<dyn AnySessionTask> = Arc::new(task);
         let task_kind = task.kind();
         let span_name = task.span_name();
         let started_at = Instant::now();

codex-rs/core/src/tasks/regular.rs

@@ -1,6 +1,5 @@
 use std::sync::Arc;
 
-use async_trait::async_trait;
 use tokio_util::sync::CancellationToken;
 
 use crate::codex::TurnContext;
@@ -25,7 +24,6 @@ impl RegularTask {
     }
 }
 
-#[async_trait]
 impl SessionTask for RegularTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Regular

codex-rs/core/src/tasks/review.rs

@@ -1,7 +1,6 @@
 use std::borrow::Cow;
 use std::sync::Arc;
 
-use async_trait::async_trait;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::items::TurnItem;
 use codex_protocol::models::ContentItem;
@@ -48,7 +47,6 @@ impl ReviewTask {
     }
 }
 
-#[async_trait]
 impl SessionTask for ReviewTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Review
@@ -65,7 +63,7 @@ impl SessionTask for ReviewTask {
         input: Vec<UserInput>,
         cancellation_token: CancellationToken,
     ) -> Option<String> {
-        let _ = session.session.services.session_telemetry.counter(
+        session.session.services.session_telemetry.counter(
             "codex.task.review",
             /*inc*/ 1,
             &[],

codex-rs/core/src/tasks/undo.rs

@@ -4,7 +4,6 @@ use crate::codex::TurnContext;
 use crate::state::TaskKind;
 use crate::tasks::SessionTask;
 use crate::tasks::SessionTaskContext;
-use async_trait::async_trait;
 use codex_git_utils::RestoreGhostCommitOptions;
 use codex_git_utils::restore_ghost_commit_with_options;
 use codex_protocol::models::ResponseItem;
@@ -25,7 +24,6 @@ impl UndoTask {
     }
 }
 
-#[async_trait]
 impl SessionTask for UndoTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Regular
@@ -42,11 +40,11 @@ impl SessionTask for UndoTask {
         _input: Vec<UserInput>,
         cancellation_token: CancellationToken,
     ) -> Option<String> {
-        let _ = session.session.services.session_telemetry.counter(
-            "codex.task.undo",
-            /*inc*/ 1,
-            &[],
-        );
+        session
+            .session
+            .services
+            .session_telemetry
+            .counter("codex.task.undo", /*inc*/ 1, &[]);
         let sess = session.clone_session();
         sess.send_event(
             ctx.as_ref(),

codex-rs/core/src/tasks/user_shell.rs

@@ -1,7 +1,6 @@
 use std::sync::Arc;
 use std::time::Duration;
 
-use async_trait::async_trait;
 use codex_async_utils::CancelErr;
 use codex_async_utils::OrCancelExt;
 use codex_protocol::user_input::UserInput;
@@ -62,7 +61,6 @@ impl UserShellCommandTask {
     }
 }
 
-#[async_trait]
 impl SessionTask for UserShellCommandTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Regular

codex-rs/core/src/tools/code_mode/execute_handler.rs

@@ -2,10 +2,8 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
-use futures::future::BoxFuture;
 
 use super::ExecContext;
 use super::PUBLIC_TOOL_NAME;
@@ -54,6 +52,8 @@ impl CodeModeExecuteHandler {
 }
 
 impl ToolHandler for CodeModeExecuteHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -62,35 +62,23 @@ impl ToolHandler for CodeModeExecuteHandler {
         matches!(payload, ToolPayload::Custom { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let result = match payload {
-                ToolPayload::Custom { input } if tool_name == PUBLIC_TOOL_NAME => {
-                    self.execute(session, turn, call_id.clone(), input).await
-                }
-                _ => Err(FunctionCallError::RespondToModel(format!(
-                    "{PUBLIC_TOOL_NAME} expects raw JavaScript source text"
-                ))),
-            }?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+        match payload {
+            ToolPayload::Custom { input } if tool_name == PUBLIC_TOOL_NAME => {
+                self.execute(session, turn, call_id, input).await
+            }
+            _ => Err(FunctionCallError::RespondToModel(format!(
+                "{PUBLIC_TOOL_NAME} expects raw JavaScript source text"
+            ))),
+        }
     }
 }

codex-rs/core/src/tools/code_mode/wait_handler.rs

@@ -1,10 +1,9 @@
-use futures::future::BoxFuture;
 use serde::Deserialize;
 
 use crate::function_tool::FunctionCallError;
+use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
@@ -40,55 +39,44 @@ where
 }
 
 impl ToolHandler for CodeModeWaitHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let result = match payload {
-                ToolPayload::Function { arguments } if tool_name == WAIT_TOOL_NAME => {
-                    let args: ExecWaitArgs = parse_arguments(&arguments)?;
-                    let exec = ExecContext { session, turn };
-                    let started_at = std::time::Instant::now();
-                    let response = exec
-                        .session
-                        .services
-                        .code_mode_service
-                        .wait(codex_code_mode::WaitRequest {
-                            cell_id: args.cell_id,
-                            yield_time_ms: args.yield_time_ms,
-                            terminate: args.terminate,
-                        })
-                        .await
-                        .map_err(FunctionCallError::RespondToModel)?;
-                    handle_runtime_response(&exec, response, args.max_tokens, started_at)
-                        .await
-                        .map_err(FunctionCallError::RespondToModel)
-                }
-                _ => Err(FunctionCallError::RespondToModel(format!(
-                    "{WAIT_TOOL_NAME} expects JSON arguments"
-                ))),
-            }?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+        match payload {
+            ToolPayload::Function { arguments } if tool_name == WAIT_TOOL_NAME => {
+                let args: ExecWaitArgs = parse_arguments(&arguments)?;
+                let exec = ExecContext { session, turn };
+                let started_at = std::time::Instant::now();
+                let response = exec
+                    .session
+                    .services
+                    .code_mode_service
+                    .wait(codex_code_mode::WaitRequest {
+                        cell_id: args.cell_id,
+                        yield_time_ms: args.yield_time_ms,
+                        terminate: args.terminate,
+                    })
+                    .await
+                    .map_err(FunctionCallError::RespondToModel)?;
+                handle_runtime_response(&exec, response, args.max_tokens, started_at)
+                    .await
+                    .map_err(FunctionCallError::RespondToModel)
+            }
+            _ => Err(FunctionCallError::RespondToModel(format!(
+                "{WAIT_TOOL_NAME} expects JSON arguments"
+            ))),
+        }
     }
 }

codex-rs/core/src/tools/handlers/agent_jobs.rs

@@ -11,7 +11,6 @@ use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::multi_agents::build_agent_spawn_config;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::ThreadId;
@@ -20,7 +19,6 @@ use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SubAgentSource;
 use codex_protocol::user_input::UserInput;
 use futures::StreamExt;
-use futures::future::BoxFuture;
 use futures::stream::FuturesUnordered;
 use serde::Deserialize;
 use serde::Serialize;
@@ -180,6 +178,8 @@ impl JobProgressEmitter {
 }
 
 impl ToolHandler for BatchJobHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -188,48 +188,31 @@ impl ToolHandler for BatchJobHandler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "agent jobs handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "agent jobs handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            let result = match tool_name.as_str() {
-                "spawn_agents_on_csv" => {
-                    spawn_agents_on_csv::handle(session, turn, arguments).await
-                }
-                "report_agent_job_result" => {
-                    report_agent_job_result::handle(session, arguments).await
-                }
-                other => Err(FunctionCallError::RespondToModel(format!(
-                    "unsupported agent job tool {other}"
-                ))),
-            }?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+        match tool_name.as_str() {
+            "spawn_agents_on_csv" => spawn_agents_on_csv::handle(session, turn, arguments).await,
+            "report_agent_job_result" => report_agent_job_result::handle(session, arguments).await,
+            other => Err(FunctionCallError::RespondToModel(format!(
+                "unsupported agent job tool {other}"
+            ))),
+        }
     }
 }
 

codex-rs/core/src/tools/handlers/apply_patch.rs

@@ -16,7 +16,6 @@ use crate::tools::events::ToolEventCtx;
 use crate::tools::handlers::apply_granted_turn_permissions;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::orchestrator::ToolOrchestrator;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use crate::tools::runtimes::apply_patch::ApplyPatchRequest;
@@ -31,7 +30,6 @@ use codex_sandboxing::policy_transforms::merge_permission_profiles;
 use codex_sandboxing::policy_transforms::normalize_additional_permissions;
 use codex_tools::ApplyPatchToolArgs;
 use codex_utils_absolute_path::AbsolutePathBuf;
-use futures::future::BoxFuture;
 use std::collections::BTreeSet;
 use std::sync::Arc;
 
@@ -124,6 +122,8 @@ async fn effective_patch_permissions(
 }
 
 impl ToolHandler for ApplyPatchHandler {
+    type Output = ApplyPatchToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -135,137 +135,119 @@ impl ToolHandler for ApplyPatchHandler {
         )
     }
 
-    fn is_mutating(&self, _invocation: &ToolInvocation) -> bool {
+    async fn is_mutating(&self, _invocation: &ToolInvocation) -> bool {
         true
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                tracker,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tracker,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let patch_input = match payload {
-                ToolPayload::Function { arguments } => {
-                    let args: ApplyPatchToolArgs = parse_arguments(&arguments)?;
-                    args.input
-                }
-                ToolPayload::Custom { input } => input,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "apply_patch handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
+        let patch_input = match payload {
+            ToolPayload::Function { arguments } => {
+                let args: ApplyPatchToolArgs = parse_arguments(&arguments)?;
+                args.input
+            }
+            ToolPayload::Custom { input } => input,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "apply_patch handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            // Re-parse and verify the patch so we can compute changes and approval.
-            // Avoid building temporary ExecParams/command vectors; derive directly from inputs.
-            let cwd = turn.cwd.clone();
-            let command = vec!["apply_patch".to_string(), patch_input.clone()];
-            match codex_apply_patch::maybe_parse_apply_patch_verified(&command, &cwd) {
-                codex_apply_patch::MaybeApplyPatchVerified::Body(changes) => {
-                    let (file_paths, effective_additional_permissions, file_system_sandbox_policy) =
-                        effective_patch_permissions(session.as_ref(), turn.as_ref(), &changes).await;
-                    match apply_patch::apply_patch(
-                        turn.as_ref(),
-                        &file_system_sandbox_policy,
-                        changes,
-                    )
+        // Re-parse and verify the patch so we can compute changes and approval.
+        // Avoid building temporary ExecParams/command vectors; derive directly from inputs.
+        let cwd = turn.cwd.clone();
+        let command = vec!["apply_patch".to_string(), patch_input.clone()];
+        match codex_apply_patch::maybe_parse_apply_patch_verified(&command, &cwd) {
+            codex_apply_patch::MaybeApplyPatchVerified::Body(changes) => {
+                let (file_paths, effective_additional_permissions, file_system_sandbox_policy) =
+                    effective_patch_permissions(session.as_ref(), turn.as_ref(), &changes).await;
+                match apply_patch::apply_patch(turn.as_ref(), &file_system_sandbox_policy, changes)
                     .await
-                    {
-                        InternalApplyPatchInvocation::Output(item) => {
-                            let content = item?;
-                            Ok(AnyToolResult {
-                                call_id,
-                                payload: payload_for_result,
-                                result: Box::new(ApplyPatchToolOutput::from_text(content)),
-                            })
-                        }
-                        InternalApplyPatchInvocation::DelegateToExec(apply) => {
-                            let changes = convert_apply_patch_to_protocol(&apply.action);
-                            let emitter =
-                                ToolEmitter::apply_patch(changes.clone(), apply.auto_approved);
-                            let event_ctx = ToolEventCtx::new(
-                                session.as_ref(),
-                                turn.as_ref(),
-                                &call_id,
-                                Some(&tracker),
-                            );
-                            emitter.begin(event_ctx).await;
+                {
+                    InternalApplyPatchInvocation::Output(item) => {
+                        let content = item?;
+                        Ok(ApplyPatchToolOutput::from_text(content))
+                    }
+                    InternalApplyPatchInvocation::DelegateToExec(apply) => {
+                        let changes = convert_apply_patch_to_protocol(&apply.action);
+                        let emitter =
+                            ToolEmitter::apply_patch(changes.clone(), apply.auto_approved);
+                        let event_ctx = ToolEventCtx::new(
+                            session.as_ref(),
+                            turn.as_ref(),
+                            &call_id,
+                            Some(&tracker),
+                        );
+                        emitter.begin(event_ctx).await;
 
-                            let req = ApplyPatchRequest {
-                                action: apply.action,
-                                file_paths,
-                                changes,
-                                exec_approval_requirement: apply.exec_approval_requirement,
-                                additional_permissions: effective_additional_permissions
-                                    .additional_permissions,
-                                permissions_preapproved: effective_additional_permissions
-                                    .permissions_preapproved,
-                                timeout_ms: None,
-                            };
+                        let req = ApplyPatchRequest {
+                            action: apply.action,
+                            file_paths,
+                            changes,
+                            exec_approval_requirement: apply.exec_approval_requirement,
+                            additional_permissions: effective_additional_permissions
+                                .additional_permissions,
+                            permissions_preapproved: effective_additional_permissions
+                                .permissions_preapproved,
+                            timeout_ms: None,
+                        };
 
-                            let mut orchestrator = ToolOrchestrator::new();
-                            let mut runtime = ApplyPatchRuntime::new();
-                            let tool_ctx = ToolCtx {
-                                session: session.clone(),
-                                turn: turn.clone(),
-                                call_id: call_id.clone(),
-                                tool_name: tool_name.to_string(),
-                            };
-                            let out = orchestrator
-                                .run(
-                                    &mut runtime,
-                                    &req,
-                                    &tool_ctx,
-                                    turn.as_ref(),
-                                    turn.approval_policy.value(),
-                                )
-                                .await
-                                .map(|result| result.output);
-                            let event_ctx = ToolEventCtx::new(
-                                session.as_ref(),
+                        let mut orchestrator = ToolOrchestrator::new();
+                        let mut runtime = ApplyPatchRuntime::new();
+                        let tool_ctx = ToolCtx {
+                            session: session.clone(),
+                            turn: turn.clone(),
+                            call_id: call_id.clone(),
+                            tool_name: tool_name.to_string(),
+                        };
+                        let out = orchestrator
+                            .run(
+                                &mut runtime,
+                                &req,
+                                &tool_ctx,
                                 turn.as_ref(),
-                                &call_id,
-                                Some(&tracker),
-                            );
-                            let content = emitter.finish(event_ctx, out).await?;
-                            Ok(AnyToolResult {
-                                call_id,
-                                payload: payload_for_result,
-                                result: Box::new(ApplyPatchToolOutput::from_text(content)),
-                            })
-                        }
+                                turn.approval_policy.value(),
+                            )
+                            .await
+                            .map(|result| result.output);
+                        let event_ctx = ToolEventCtx::new(
+                            session.as_ref(),
+                            turn.as_ref(),
+                            &call_id,
+                            Some(&tracker),
+                        );
+                        let content = emitter.finish(event_ctx, out).await?;
+                        Ok(ApplyPatchToolOutput::from_text(content))
                     }
                 }
-                codex_apply_patch::MaybeApplyPatchVerified::CorrectnessError(parse_error) => {
-                    Err(FunctionCallError::RespondToModel(format!(
-                        "apply_patch verification failed: {parse_error}"
-                    )))
-                }
-                codex_apply_patch::MaybeApplyPatchVerified::ShellParseError(error) => {
-                    tracing::trace!("Failed to parse apply_patch input, {error:?}");
-                    Err(FunctionCallError::RespondToModel(
-                        "apply_patch handler received invalid patch input".to_string(),
-                    ))
-                }
-                codex_apply_patch::MaybeApplyPatchVerified::NotApplyPatch => {
-                    Err(FunctionCallError::RespondToModel(
-                        "apply_patch handler received non-apply_patch input".to_string(),
-                    ))
-                }
             }
-        })
+            codex_apply_patch::MaybeApplyPatchVerified::CorrectnessError(parse_error) => {
+                Err(FunctionCallError::RespondToModel(format!(
+                    "apply_patch verification failed: {parse_error}"
+                )))
+            }
+            codex_apply_patch::MaybeApplyPatchVerified::ShellParseError(error) => {
+                tracing::trace!("Failed to parse apply_patch input, {error:?}");
+                Err(FunctionCallError::RespondToModel(
+                    "apply_patch handler received invalid patch input".to_string(),
+                ))
+            }
+            codex_apply_patch::MaybeApplyPatchVerified::NotApplyPatch => {
+                Err(FunctionCallError::RespondToModel(
+                    "apply_patch handler received non-apply_patch input".to_string(),
+                ))
+            }
+        }
     }
 }
 

codex-rs/core/src/tools/handlers/dynamic.rs

@@ -5,7 +5,6 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::dynamic_tools::DynamicToolCallRequest;
@@ -13,7 +12,6 @@ use codex_protocol::dynamic_tools::DynamicToolResponse;
 use codex_protocol::models::FunctionCallOutputContentItem;
 use codex_protocol::protocol::DynamicToolCallResponseEvent;
 use codex_protocol::protocol::EventMsg;
-use futures::future::BoxFuture;
 use serde_json::Value;
 use std::time::Instant;
 use tokio::sync::oneshot;
@@ -22,63 +20,53 @@ use tracing::warn;
 pub struct DynamicToolHandler;
 
 impl ToolHandler for DynamicToolHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn is_mutating(&self, _invocation: &ToolInvocation) -> bool {
+    async fn is_mutating(&self, _invocation: &ToolInvocation) -> bool {
         true
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let payload_for_result = payload.clone();
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "dynamic tool handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "dynamic tool handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            let args: Value = parse_arguments(&arguments)?;
-            let response =
-                request_dynamic_tool(&session, turn.as_ref(), call_id.clone(), tool_name, args)
-                    .await
-                    .ok_or_else(|| {
-                        FunctionCallError::RespondToModel(
-                            "dynamic tool call was cancelled before receiving a response"
-                                .to_string(),
-                        )
-                    })?;
+        let args: Value = parse_arguments(&arguments)?;
+        let response = request_dynamic_tool(&session, turn.as_ref(), call_id, tool_name, args)
+            .await
+            .ok_or_else(|| {
+                FunctionCallError::RespondToModel(
+                    "dynamic tool call was cancelled before receiving a response".to_string(),
+                )
+            })?;
 
-            let DynamicToolResponse {
-                content_items,
-                success,
-            } = response;
-            let body = content_items
-                .into_iter()
-                .map(FunctionCallOutputContentItem::from)
-                .collect::<Vec<_>>();
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(FunctionToolOutput::from_content(body, Some(success))),
-            })
-        })
+        let DynamicToolResponse {
+            content_items,
+            success,
+        } = response;
+        let body = content_items
+            .into_iter()
+            .map(FunctionCallOutputContentItem::from)
+            .collect::<Vec<_>>();
+        Ok(FunctionToolOutput::from_content(body, Some(success)))
     }
 }
 

codex-rs/core/src/tools/handlers/js_repl.rs

@@ -1,4 +1,3 @@
-use futures::future::BoxFuture;
 use serde_json::Value as JsonValue;
 use std::sync::Arc;
 use std::time::Duration;
@@ -17,7 +16,6 @@ use crate::tools::events::ToolEventStage;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::js_repl::JS_REPL_PRAGMA_PREFIX;
 use crate::tools::js_repl::JsReplArgs;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_features::Feature;
@@ -94,6 +92,8 @@ async fn emit_js_repl_exec_end(
     emitter.emit(ctx, stage).await;
 }
 impl ToolHandler for JsReplHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -105,114 +105,100 @@ impl ToolHandler for JsReplHandler {
         )
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                tracker,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tracker,
+            payload,
+            call_id,
+            ..
+        } = invocation;
 
-            if !session.features().enabled(Feature::JsRepl) {
+        if !session.features().enabled(Feature::JsRepl) {
+            return Err(FunctionCallError::RespondToModel(
+                "js_repl is disabled by feature flag".to_string(),
+            ));
+        }
+
+        let args = match payload {
+            ToolPayload::Function { arguments } => parse_arguments(&arguments)?,
+            ToolPayload::Custom { input } => parse_freeform_args(&input)?,
+            _ => {
                 return Err(FunctionCallError::RespondToModel(
-                    "js_repl is disabled by feature flag".to_string(),
+                    "js_repl expects custom or function payload".to_string(),
                 ));
             }
-
-            let args = match payload {
-                ToolPayload::Function { arguments } => parse_arguments(&arguments)?,
-                ToolPayload::Custom { input } => parse_freeform_args(&input)?,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "js_repl expects custom or function payload".to_string(),
-                    ));
-                }
-            };
-            let manager = turn.js_repl.manager().await?;
-            let started_at = Instant::now();
-            emit_js_repl_exec_begin(session.as_ref(), turn.as_ref(), &call_id).await;
-            let result = manager
-                .execute(Arc::clone(&session), Arc::clone(&turn), tracker, args)
-                .await;
-            let result = match result {
-                Ok(result) => result,
-                Err(err) => {
-                    let message = err.to_string();
-                    emit_js_repl_exec_end(
-                        session.as_ref(),
-                        turn.as_ref(),
-                        &call_id,
-                        "",
-                        Some(&message),
-                        started_at.elapsed(),
-                    )
-                    .await;
-                    return Err(err);
-                }
-            };
-
-            let content = result.output;
-            let mut items = Vec::with_capacity(result.content_items.len() + 1);
-            if !content.is_empty() {
-                items.push(FunctionCallOutputContentItem::InputText {
-                    text: content.clone(),
-                });
-            }
-            items.extend(result.content_items);
-
-            emit_js_repl_exec_end(
-                session.as_ref(),
-                turn.as_ref(),
-                &call_id,
-                &content,
-                /*error*/ None,
-                started_at.elapsed(),
-            )
+        };
+        let manager = turn.js_repl.manager().await?;
+        let started_at = Instant::now();
+        emit_js_repl_exec_begin(session.as_ref(), turn.as_ref(), &call_id).await;
+        let result = manager
+            .execute(Arc::clone(&session), Arc::clone(&turn), tracker, args)
             .await;
+        let result = match result {
+            Ok(result) => result,
+            Err(err) => {
+                let message = err.to_string();
+                emit_js_repl_exec_end(
+                    session.as_ref(),
+                    turn.as_ref(),
+                    &call_id,
+                    "",
+                    Some(&message),
+                    started_at.elapsed(),
+                )
+                .await;
+                return Err(err);
+            }
+        };
 
-            let output = if items.is_empty() {
-                FunctionToolOutput::from_text(content, Some(true))
-            } else {
-                FunctionToolOutput::from_content(items, Some(true))
-            };
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(output),
-            })
-        })
+        let content = result.output;
+        let mut items = Vec::with_capacity(result.content_items.len() + 1);
+        if !content.is_empty() {
+            items.push(FunctionCallOutputContentItem::InputText {
+                text: content.clone(),
+            });
+        }
+        items.extend(result.content_items);
+
+        emit_js_repl_exec_end(
+            session.as_ref(),
+            turn.as_ref(),
+            &call_id,
+            &content,
+            /*error*/ None,
+            started_at.elapsed(),
+        )
+        .await;
+
+        if items.is_empty() {
+            Ok(FunctionToolOutput::from_text(content, Some(true)))
+        } else {
+            Ok(FunctionToolOutput::from_content(items, Some(true)))
+        }
     }
 }
 
 impl ToolHandler for JsReplResetHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            if !invocation.session.features().enabled(Feature::JsRepl) {
-                return Err(FunctionCallError::RespondToModel(
-                    "js_repl is disabled by feature flag".to_string(),
-                ));
-            }
-            let manager = invocation.turn.js_repl.manager().await?;
-            manager.reset().await?;
-            Ok(AnyToolResult::new(
-                &invocation,
-                FunctionToolOutput::from_text("js_repl kernel reset".to_string(), Some(true)),
-            ))
-        })
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        if !invocation.session.features().enabled(Feature::JsRepl) {
+            return Err(FunctionCallError::RespondToModel(
+                "js_repl is disabled by feature flag".to_string(),
+            ));
+        }
+        let manager = invocation.turn.js_repl.manager().await?;
+        manager.reset().await?;
+        Ok(FunctionToolOutput::from_text(
+            "js_repl kernel reset".to_string(),
+            Some(true),
+        ))
     }
 }
 

codex-rs/core/src/tools/handlers/list_dir.rs

@@ -5,7 +5,6 @@ use std::path::Path;
 use std::path::PathBuf;
 
 use codex_utils_string::take_bytes_at_char_boundary;
-use futures::future::BoxFuture;
 use serde::Deserialize;
 use tokio::fs;
 
@@ -14,7 +13,6 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
@@ -47,73 +45,63 @@ struct ListDirArgs {
 }
 
 impl ToolHandler for ListDirHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                call_id, payload, ..
-            } = invocation;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation { payload, .. } = invocation;
 
-            let payload_for_result = payload.clone();
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "list_dir handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
-
-            let args: ListDirArgs = parse_arguments(&arguments)?;
-
-            let ListDirArgs {
-                dir_path,
-                offset,
-                limit,
-                depth,
-            } = args;
-
-            if offset == 0 {
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
                 return Err(FunctionCallError::RespondToModel(
-                    "offset must be a 1-indexed entry number".to_string(),
+                    "list_dir handler received unsupported payload".to_string(),
                 ));
             }
+        };
 
-            if limit == 0 {
-                return Err(FunctionCallError::RespondToModel(
-                    "limit must be greater than zero".to_string(),
-                ));
-            }
+        let args: ListDirArgs = parse_arguments(&arguments)?;
 
-            if depth == 0 {
-                return Err(FunctionCallError::RespondToModel(
-                    "depth must be greater than zero".to_string(),
-                ));
-            }
+        let ListDirArgs {
+            dir_path,
+            offset,
+            limit,
+            depth,
+        } = args;
 
-            let path = PathBuf::from(&dir_path);
-            if !path.is_absolute() {
-                return Err(FunctionCallError::RespondToModel(
-                    "dir_path must be an absolute path".to_string(),
-                ));
-            }
+        if offset == 0 {
+            return Err(FunctionCallError::RespondToModel(
+                "offset must be a 1-indexed entry number".to_string(),
+            ));
+        }
 
-            let entries = list_dir_slice(&path, offset, limit, depth).await?;
-            let mut output = Vec::with_capacity(entries.len() + 1);
-            output.push(format!("Absolute path: {}", path.display()));
-            output.extend(entries);
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(FunctionToolOutput::from_text(output.join("\n"), Some(true))),
-            })
-        })
+        if limit == 0 {
+            return Err(FunctionCallError::RespondToModel(
+                "limit must be greater than zero".to_string(),
+            ));
+        }
+
+        if depth == 0 {
+            return Err(FunctionCallError::RespondToModel(
+                "depth must be greater than zero".to_string(),
+            ));
+        }
+
+        let path = PathBuf::from(&dir_path);
+        if !path.is_absolute() {
+            return Err(FunctionCallError::RespondToModel(
+                "dir_path must be an absolute path".to_string(),
+            ));
+        }
+
+        let entries = list_dir_slice(&path, offset, limit, depth).await?;
+        let mut output = Vec::with_capacity(entries.len() + 1);
+        output.push(format!("Absolute path: {}", path.display()));
+        output.extend(entries);
+        Ok(FunctionToolOutput::from_text(output.join("\n"), Some(true)))
     }
 }
 

codex-rs/core/src/tools/handlers/mcp.rs

@@ -1,66 +1,56 @@
-use futures::future::BoxFuture;
 use std::sync::Arc;
 
 use crate::function_tool::FunctionCallError;
 use crate::mcp_tool_call::handle_mcp_tool_call;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
+use codex_protocol::mcp::CallToolResult;
 
 pub struct McpHandler;
-
 impl ToolHandler for McpHandler {
+    type Output = CallToolResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Mcp
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                payload,
-                ..
-            } = invocation;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            payload,
+            ..
+        } = invocation;
 
-            let payload_for_result = payload.clone();
-            let payload = match payload {
-                ToolPayload::Mcp {
-                    server,
-                    tool,
-                    raw_arguments,
-                } => (server, tool, raw_arguments),
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "mcp handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
-
-            let (server, tool, raw_arguments) = payload;
-            let arguments_str = raw_arguments;
-
-            let output = handle_mcp_tool_call(
-                Arc::clone(&session),
-                &turn,
-                call_id.clone(),
+        let payload = match payload {
+            ToolPayload::Mcp {
                 server,
                 tool,
-                arguments_str,
-            )
-            .await;
+                raw_arguments,
+            } => (server, tool, raw_arguments),
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "mcp handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(output),
-            })
-        })
+        let (server, tool, raw_arguments) = payload;
+        let arguments_str = raw_arguments;
+
+        let output = handle_mcp_tool_call(
+            Arc::clone(&session),
+            &turn,
+            call_id.clone(),
+            server,
+            tool,
+            arguments_str,
+        )
+        .await;
+
+        Ok(output)
     }
 }

codex-rs/core/src/tools/handlers/mcp_resource.rs

@@ -23,14 +23,12 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::McpInvocation;
 use codex_protocol::protocol::McpToolCallBeginEvent;
 use codex_protocol::protocol::McpToolCallEndEvent;
-use futures::future::BoxFuture;
 
 pub struct McpResourceHandler;
 
@@ -180,75 +178,65 @@ struct ReadResourcePayload {
 }
 
 impl ToolHandler for McpResourceHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "mcp_resource handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "mcp_resource handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            let arguments_value = parse_arguments(arguments.as_str())?;
+        let arguments_value = parse_arguments(arguments.as_str())?;
 
-            let result = match tool_name.as_str() {
-                "list_mcp_resources" => {
-                    handle_list_resources(
-                        Arc::clone(&session),
-                        Arc::clone(&turn),
-                        call_id.clone(),
-                        arguments_value.clone(),
-                    )
-                    .await
-                }
-                "list_mcp_resource_templates" => {
-                    handle_list_resource_templates(
-                        Arc::clone(&session),
-                        Arc::clone(&turn),
-                        call_id.clone(),
-                        arguments_value.clone(),
-                    )
-                    .await
-                }
-                "read_mcp_resource" => {
-                    handle_read_resource(
-                        Arc::clone(&session),
-                        Arc::clone(&turn),
-                        call_id.clone(),
-                        arguments_value,
-                    )
-                    .await
-                }
-                other => Err(FunctionCallError::RespondToModel(format!(
-                    "unsupported MCP resource tool: {other}"
-                ))),
-            }?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+        match tool_name.as_str() {
+            "list_mcp_resources" => {
+                handle_list_resources(
+                    Arc::clone(&session),
+                    Arc::clone(&turn),
+                    call_id.clone(),
+                    arguments_value.clone(),
+                )
+                .await
+            }
+            "list_mcp_resource_templates" => {
+                handle_list_resource_templates(
+                    Arc::clone(&session),
+                    Arc::clone(&turn),
+                    call_id.clone(),
+                    arguments_value.clone(),
+                )
+                .await
+            }
+            "read_mcp_resource" => {
+                handle_read_resource(
+                    Arc::clone(&session),
+                    Arc::clone(&turn),
+                    call_id,
+                    arguments_value,
+                )
+                .await
+            }
+            other => Err(FunctionCallError::RespondToModel(format!(
+                "unsupported MCP resource tool: {other}"
+            ))),
+        }
     }
 }
 

codex-rs/core/src/tools/handlers/multi_agents.rs

@@ -15,7 +15,6 @@ use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 pub(crate) use crate::tools::handlers::multi_agents_common::*;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::ThreadId;
@@ -33,7 +32,6 @@ use codex_protocol::protocol::CollabResumeEndEvent;
 use codex_protocol::protocol::CollabWaitingBeginEvent;
 use codex_protocol::protocol::CollabWaitingEndEvent;
 use codex_protocol::user_input::UserInput;
-use futures::future::BoxFuture;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value as JsonValue;

codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs

@@ -3,6 +3,8 @@ use super::*;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = CloseAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -11,94 +13,84 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: CloseAgentArgs = parse_arguments(&arguments)?;
-            let agent_id = parse_agent_id_target(&args.target)?;
-            let receiver_agent = session
-                .services
-                .agent_control
-                .get_agent_metadata(agent_id)
-                .unwrap_or_default();
-            session
-                .send_event(
-                    &turn,
-                    CollabCloseBeginEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id: agent_id,
-                    }
-                    .into(),
-                )
-                .await;
-            let status = match session
-                .services
-                .agent_control
-                .subscribe_status(agent_id)
-                .await
-            {
-                Ok(mut status_rx) => status_rx.borrow_and_update().clone(),
-                Err(err) => {
-                    let status = session.services.agent_control.get_status(agent_id).await;
-                    session
-                        .send_event(
-                            &turn,
-                            CollabCloseEndEvent {
-                                call_id: call_id.clone(),
-                                sender_thread_id: session.conversation_id,
-                                receiver_thread_id: agent_id,
-                                receiver_agent_nickname: receiver_agent.agent_nickname.clone(),
-                                receiver_agent_role: receiver_agent.agent_role.clone(),
-                                status,
-                            }
-                            .into(),
-                        )
-                        .await;
-                    return Err(collab_agent_error(agent_id, err));
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: CloseAgentArgs = parse_arguments(&arguments)?;
+        let agent_id = parse_agent_id_target(&args.target)?;
+        let receiver_agent = session
+            .services
+            .agent_control
+            .get_agent_metadata(agent_id)
+            .unwrap_or_default();
+        session
+            .send_event(
+                &turn,
+                CollabCloseBeginEvent {
+                    call_id: call_id.clone(),
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id: agent_id,
                 }
-            };
-            let result = session
-                .services
-                .agent_control
-                .close_agent(agent_id)
-                .await
-                .map_err(|err| collab_agent_error(agent_id, err))
-                .map(|_| ());
-            session
-                .send_event(
-                    &turn,
-                    CollabCloseEndEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id: agent_id,
-                        receiver_agent_nickname: receiver_agent.agent_nickname,
-                        receiver_agent_role: receiver_agent.agent_role,
-                        status: status.clone(),
-                    }
-                    .into(),
-                )
-                .await;
-            result?;
+                .into(),
+            )
+            .await;
+        let status = match session
+            .services
+            .agent_control
+            .subscribe_status(agent_id)
+            .await
+        {
+            Ok(mut status_rx) => status_rx.borrow_and_update().clone(),
+            Err(err) => {
+                let status = session.services.agent_control.get_status(agent_id).await;
+                session
+                    .send_event(
+                        &turn,
+                        CollabCloseEndEvent {
+                            call_id: call_id.clone(),
+                            sender_thread_id: session.conversation_id,
+                            receiver_thread_id: agent_id,
+                            receiver_agent_nickname: receiver_agent.agent_nickname.clone(),
+                            receiver_agent_role: receiver_agent.agent_role.clone(),
+                            status,
+                        }
+                        .into(),
+                    )
+                    .await;
+                return Err(collab_agent_error(agent_id, err));
+            }
+        };
+        let result = session
+            .services
+            .agent_control
+            .close_agent(agent_id)
+            .await
+            .map_err(|err| collab_agent_error(agent_id, err))
+            .map(|_| ());
+        session
+            .send_event(
+                &turn,
+                CollabCloseEndEvent {
+                    call_id,
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id: agent_id,
+                    receiver_agent_nickname: receiver_agent.agent_nickname,
+                    receiver_agent_role: receiver_agent.agent_role,
+                    status: status.clone(),
+                }
+                .into(),
+            )
+            .await;
+        result?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(CloseAgentResult {
-                    previous_status: status,
-                }),
-            })
+        Ok(CloseAgentResult {
+            previous_status: status,
         })
     }
 }

codex-rs/core/src/tools/handlers/multi_agents/resume_agent.rs

@@ -5,6 +5,8 @@ use std::sync::Arc;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = ResumeAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -13,114 +15,102 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: ResumeAgentArgs = parse_arguments(&arguments)?;
-            let receiver_thread_id = ThreadId::from_string(&args.id).map_err(|err| {
-                FunctionCallError::RespondToModel(format!("invalid agent id {}: {err:?}", args.id))
-            })?;
-            let receiver_agent = session
-                .services
-                .agent_control
-                .get_agent_metadata(receiver_thread_id)
-                .unwrap_or_default();
-            let child_depth = next_thread_spawn_depth(&turn.session_source);
-            let max_depth = turn.config.agent_max_depth;
-            if exceeds_thread_spawn_depth_limit(child_depth, max_depth) {
-                return Err(FunctionCallError::RespondToModel(
-                    "Agent depth limit reached. Solve the task yourself.".to_string(),
-                ));
-            }
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: ResumeAgentArgs = parse_arguments(&arguments)?;
+        let receiver_thread_id = ThreadId::from_string(&args.id).map_err(|err| {
+            FunctionCallError::RespondToModel(format!("invalid agent id {}: {err:?}", args.id))
+        })?;
+        let receiver_agent = session
+            .services
+            .agent_control
+            .get_agent_metadata(receiver_thread_id)
+            .unwrap_or_default();
+        let child_depth = next_thread_spawn_depth(&turn.session_source);
+        let max_depth = turn.config.agent_max_depth;
+        if exceeds_thread_spawn_depth_limit(child_depth, max_depth) {
+            return Err(FunctionCallError::RespondToModel(
+                "Agent depth limit reached. Solve the task yourself.".to_string(),
+            ));
+        }
 
-            session
-                .send_event(
-                    &turn,
-                    CollabResumeBeginEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id,
-                        receiver_agent_nickname: receiver_agent.agent_nickname.clone(),
-                        receiver_agent_role: receiver_agent.agent_role.clone(),
-                    }
-                    .into(),
-                )
-                .await;
-
-            let mut status = session
-                .services
-                .agent_control
-                .get_status(receiver_thread_id)
-                .await;
-            let (receiver_agent, error) = if matches!(status, AgentStatus::NotFound) {
-                match try_resume_closed_agent(&session, &turn, receiver_thread_id, child_depth)
-                    .await
-                {
-                    Ok(()) => {
-                        status = session
-                            .services
-                            .agent_control
-                            .get_status(receiver_thread_id)
-                            .await;
-                        (
-                            session
-                                .services
-                                .agent_control
-                                .get_agent_metadata(receiver_thread_id)
-                                .unwrap_or(receiver_agent),
-                            None,
-                        )
-                    }
-                    Err(err) => {
-                        status = session
-                            .services
-                            .agent_control
-                            .get_status(receiver_thread_id)
-                            .await;
-                        (receiver_agent, Some(err))
-                    }
+        session
+            .send_event(
+                &turn,
+                CollabResumeBeginEvent {
+                    call_id: call_id.clone(),
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id,
+                    receiver_agent_nickname: receiver_agent.agent_nickname.clone(),
+                    receiver_agent_role: receiver_agent.agent_role.clone(),
                 }
-            } else {
-                (receiver_agent, None)
-            };
-            session
-                .send_event(
-                    &turn,
-                    CollabResumeEndEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id,
-                        receiver_agent_nickname: receiver_agent.agent_nickname,
-                        receiver_agent_role: receiver_agent.agent_role,
-                        status: status.clone(),
-                    }
-                    .into(),
-                )
-                .await;
+                .into(),
+            )
+            .await;
 
-            if let Some(err) = error {
-                return Err(err);
+        let mut status = session
+            .services
+            .agent_control
+            .get_status(receiver_thread_id)
+            .await;
+        let (receiver_agent, error) = if matches!(status, AgentStatus::NotFound) {
+            match try_resume_closed_agent(&session, &turn, receiver_thread_id, child_depth).await {
+                Ok(()) => {
+                    status = session
+                        .services
+                        .agent_control
+                        .get_status(receiver_thread_id)
+                        .await;
+                    (
+                        session
+                            .services
+                            .agent_control
+                            .get_agent_metadata(receiver_thread_id)
+                            .unwrap_or(receiver_agent),
+                        None,
+                    )
+                }
+                Err(err) => {
+                    status = session
+                        .services
+                        .agent_control
+                        .get_status(receiver_thread_id)
+                        .await;
+                    (receiver_agent, Some(err))
+                }
             }
-            turn.session_telemetry
-                .counter("codex.multi_agent.resume", /*inc*/ 1, &[]);
+        } else {
+            (receiver_agent, None)
+        };
+        session
+            .send_event(
+                &turn,
+                CollabResumeEndEvent {
+                    call_id,
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id,
+                    receiver_agent_nickname: receiver_agent.agent_nickname,
+                    receiver_agent_role: receiver_agent.agent_role,
+                    status: status.clone(),
+                }
+                .into(),
+            )
+            .await;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(ResumeAgentResult { status }),
-            })
-        })
+        if let Some(err) = error {
+            return Err(err);
+        }
+        turn.session_telemetry
+            .counter("codex.multi_agent.resume", /*inc*/ 1, &[]);
+
+        Ok(ResumeAgentResult { status })
     }
 }
 

codex-rs/core/src/tools/handlers/multi_agents/send_input.rs

@@ -4,6 +4,8 @@ use crate::agent::control::render_input_preview;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = SendInputResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -12,82 +14,72 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: SendInputArgs = parse_arguments(&arguments)?;
-            let receiver_thread_id = parse_agent_id_target(&args.target)?;
-            let input_items = parse_collab_input(args.message, args.items)?;
-            let prompt = render_input_preview(&input_items);
-            let receiver_agent = session
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: SendInputArgs = parse_arguments(&arguments)?;
+        let receiver_thread_id = parse_agent_id_target(&args.target)?;
+        let input_items = parse_collab_input(args.message, args.items)?;
+        let prompt = render_input_preview(&input_items);
+        let receiver_agent = session
+            .services
+            .agent_control
+            .get_agent_metadata(receiver_thread_id)
+            .unwrap_or_default();
+        if args.interrupt {
+            session
                 .services
                 .agent_control
-                .get_agent_metadata(receiver_thread_id)
-                .unwrap_or_default();
-            if args.interrupt {
-                session
-                    .services
-                    .agent_control
-                    .interrupt_agent(receiver_thread_id)
-                    .await
-                    .map_err(|err| collab_agent_error(receiver_thread_id, err))?;
-            }
-            session
-                .send_event(
-                    &turn,
-                    CollabAgentInteractionBeginEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id,
-                        prompt: prompt.clone(),
-                    }
-                    .into(),
-                )
-                .await;
-            let agent_control = session.services.agent_control.clone();
-            let result = agent_control
-                .send_input(receiver_thread_id, input_items)
+                .interrupt_agent(receiver_thread_id)
                 .await
-                .map_err(|err| collab_agent_error(receiver_thread_id, err));
-            let status = session
-                .services
-                .agent_control
-                .get_status(receiver_thread_id)
-                .await;
-            session
-                .send_event(
-                    &turn,
-                    CollabAgentInteractionEndEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id,
-                        receiver_agent_nickname: receiver_agent.agent_nickname,
-                        receiver_agent_role: receiver_agent.agent_role,
-                        prompt,
-                        status,
-                    }
-                    .into(),
-                )
-                .await;
-            let submission_id = result?;
+                .map_err(|err| collab_agent_error(receiver_thread_id, err))?;
+        }
+        session
+            .send_event(
+                &turn,
+                CollabAgentInteractionBeginEvent {
+                    call_id: call_id.clone(),
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id,
+                    prompt: prompt.clone(),
+                }
+                .into(),
+            )
+            .await;
+        let agent_control = session.services.agent_control.clone();
+        let result = agent_control
+            .send_input(receiver_thread_id, input_items)
+            .await
+            .map_err(|err| collab_agent_error(receiver_thread_id, err));
+        let status = session
+            .services
+            .agent_control
+            .get_status(receiver_thread_id)
+            .await;
+        session
+            .send_event(
+                &turn,
+                CollabAgentInteractionEndEvent {
+                    call_id,
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id,
+                    receiver_agent_nickname: receiver_agent.agent_nickname,
+                    receiver_agent_role: receiver_agent.agent_role,
+                    prompt,
+                    status,
+                }
+                .into(),
+            )
+            .await;
+        let submission_id = result?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(SendInputResult { submission_id }),
-            })
-        })
+        Ok(SendInputResult { submission_id })
     }
 }
 

codex-rs/core/src/tools/handlers/multi_agents/spawn.rs

@@ -11,6 +11,8 @@ use crate::agent::next_thread_spawn_depth;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = SpawnAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -19,159 +21,149 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: SpawnAgentArgs = parse_arguments(&arguments)?;
-            let role_name = args
-                .agent_type
-                .as_deref()
-                .map(str::trim)
-                .filter(|role| !role.is_empty());
-            let input_items = parse_collab_input(args.message, args.items)?;
-            let prompt = render_input_preview(&input_items);
-            let session_source = turn.session_source.clone();
-            let child_depth = next_thread_spawn_depth(&session_source);
-            let max_depth = turn.config.agent_max_depth;
-            if exceeds_thread_spawn_depth_limit(child_depth, max_depth) {
-                return Err(FunctionCallError::RespondToModel(
-                    "Agent depth limit reached. Solve the task yourself.".to_string(),
-                ));
-            }
-            session
-                .send_event(
-                    &turn,
-                    CollabAgentSpawnBeginEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        prompt: prompt.clone(),
-                        model: args.model.clone().unwrap_or_default(),
-                        reasoning_effort: args.reasoning_effort.unwrap_or_default(),
-                    }
-                    .into(),
-                )
-                .await;
-            let mut config =
-                build_agent_spawn_config(&session.get_base_instructions().await, turn.as_ref())?;
-            apply_requested_spawn_agent_model_overrides(
-                &session,
-                turn.as_ref(),
-                &mut config,
-                args.model.as_deref(),
-                args.reasoning_effort,
-            )
-            .await?;
-            apply_role_to_config(&mut config, role_name)
-                .await
-                .map_err(FunctionCallError::RespondToModel)?;
-            apply_spawn_agent_runtime_overrides(&mut config, turn.as_ref())?;
-            apply_spawn_agent_overrides(&mut config, child_depth);
-
-            let result = session
-                .services
-                .agent_control
-                .spawn_agent_with_metadata(
-                    config,
-                    input_items,
-                    Some(thread_spawn_source(
-                        session.conversation_id,
-                        &turn.session_source,
-                        child_depth,
-                        role_name,
-                        /*task_name*/ None,
-                    )?),
-                    SpawnAgentOptions {
-                        fork_parent_spawn_call_id: args.fork_context.then(|| call_id.clone()),
-                        fork_mode: args.fork_context.then_some(SpawnAgentForkMode::FullHistory),
-                    },
-                )
-                .await
-                .map_err(collab_spawn_error);
-            let (new_thread_id, new_agent_metadata, status) = match &result {
-                Ok(spawned_agent) => (
-                    Some(spawned_agent.thread_id),
-                    Some(spawned_agent.metadata.clone()),
-                    spawned_agent.status.clone(),
-                ),
-                Err(_) => (None, None, AgentStatus::NotFound),
-            };
-            let agent_snapshot = match new_thread_id {
-                Some(thread_id) => {
-                    session
-                        .services
-                        .agent_control
-                        .get_agent_config_snapshot(thread_id)
-                        .await
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: SpawnAgentArgs = parse_arguments(&arguments)?;
+        let role_name = args
+            .agent_type
+            .as_deref()
+            .map(str::trim)
+            .filter(|role| !role.is_empty());
+        let input_items = parse_collab_input(args.message, args.items)?;
+        let prompt = render_input_preview(&input_items);
+        let session_source = turn.session_source.clone();
+        let child_depth = next_thread_spawn_depth(&session_source);
+        let max_depth = turn.config.agent_max_depth;
+        if exceeds_thread_spawn_depth_limit(child_depth, max_depth) {
+            return Err(FunctionCallError::RespondToModel(
+                "Agent depth limit reached. Solve the task yourself.".to_string(),
+            ));
+        }
+        session
+            .send_event(
+                &turn,
+                CollabAgentSpawnBeginEvent {
+                    call_id: call_id.clone(),
+                    sender_thread_id: session.conversation_id,
+                    prompt: prompt.clone(),
+                    model: args.model.clone().unwrap_or_default(),
+                    reasoning_effort: args.reasoning_effort.unwrap_or_default(),
                 }
-                None => None,
-            };
-            let (_new_agent_path, new_agent_nickname, new_agent_role) =
-                match (&agent_snapshot, new_agent_metadata) {
-                    (Some(snapshot), _) => (
-                        snapshot.session_source.get_agent_path().map(String::from),
-                        snapshot.session_source.get_nickname(),
-                        snapshot.session_source.get_agent_role(),
-                    ),
-                    (None, Some(metadata)) => (
-                        metadata.agent_path.map(String::from),
-                        metadata.agent_nickname,
-                        metadata.agent_role,
-                    ),
-                    (None, None) => (None, None, None),
-                };
-            let effective_model = agent_snapshot
-                .as_ref()
-                .map(|snapshot| snapshot.model.clone())
-                .unwrap_or_else(|| args.model.clone().unwrap_or_default());
-            let effective_reasoning_effort = agent_snapshot
-                .as_ref()
-                .and_then(|snapshot| snapshot.reasoning_effort)
-                .unwrap_or(args.reasoning_effort.unwrap_or_default());
-            let nickname = new_agent_nickname.clone();
-            session
-                .send_event(
-                    &turn,
-                    CollabAgentSpawnEndEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        new_thread_id,
-                        new_agent_nickname,
-                        new_agent_role,
-                        prompt,
-                        model: effective_model,
-                        reasoning_effort: effective_reasoning_effort,
-                        status,
-                    }
-                    .into(),
-                )
-                .await;
-            let new_thread_id = result?.thread_id;
-            let role_tag = role_name.unwrap_or(DEFAULT_ROLE_NAME);
-            turn.session_telemetry.counter(
-                "codex.multi_agent.spawn",
-                /*inc*/ 1,
-                &[("role", role_tag)],
-            );
+                .into(),
+            )
+            .await;
+        let mut config =
+            build_agent_spawn_config(&session.get_base_instructions().await, turn.as_ref())?;
+        apply_requested_spawn_agent_model_overrides(
+            &session,
+            turn.as_ref(),
+            &mut config,
+            args.model.as_deref(),
+            args.reasoning_effort,
+        )
+        .await?;
+        apply_role_to_config(&mut config, role_name)
+            .await
+            .map_err(FunctionCallError::RespondToModel)?;
+        apply_spawn_agent_runtime_overrides(&mut config, turn.as_ref())?;
+        apply_spawn_agent_overrides(&mut config, child_depth);
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(SpawnAgentResult {
-                    agent_id: new_thread_id.to_string(),
-                    nickname,
-                }),
-            })
+        let result = session
+            .services
+            .agent_control
+            .spawn_agent_with_metadata(
+                config,
+                input_items,
+                Some(thread_spawn_source(
+                    session.conversation_id,
+                    &turn.session_source,
+                    child_depth,
+                    role_name,
+                    /*task_name*/ None,
+                )?),
+                SpawnAgentOptions {
+                    fork_parent_spawn_call_id: args.fork_context.then(|| call_id.clone()),
+                    fork_mode: args.fork_context.then_some(SpawnAgentForkMode::FullHistory),
+                },
+            )
+            .await
+            .map_err(collab_spawn_error);
+        let (new_thread_id, new_agent_metadata, status) = match &result {
+            Ok(spawned_agent) => (
+                Some(spawned_agent.thread_id),
+                Some(spawned_agent.metadata.clone()),
+                spawned_agent.status.clone(),
+            ),
+            Err(_) => (None, None, AgentStatus::NotFound),
+        };
+        let agent_snapshot = match new_thread_id {
+            Some(thread_id) => {
+                session
+                    .services
+                    .agent_control
+                    .get_agent_config_snapshot(thread_id)
+                    .await
+            }
+            None => None,
+        };
+        let (_new_agent_path, new_agent_nickname, new_agent_role) =
+            match (&agent_snapshot, new_agent_metadata) {
+                (Some(snapshot), _) => (
+                    snapshot.session_source.get_agent_path().map(String::from),
+                    snapshot.session_source.get_nickname(),
+                    snapshot.session_source.get_agent_role(),
+                ),
+                (None, Some(metadata)) => (
+                    metadata.agent_path.map(String::from),
+                    metadata.agent_nickname,
+                    metadata.agent_role,
+                ),
+                (None, None) => (None, None, None),
+            };
+        let effective_model = agent_snapshot
+            .as_ref()
+            .map(|snapshot| snapshot.model.clone())
+            .unwrap_or_else(|| args.model.clone().unwrap_or_default());
+        let effective_reasoning_effort = agent_snapshot
+            .as_ref()
+            .and_then(|snapshot| snapshot.reasoning_effort)
+            .unwrap_or(args.reasoning_effort.unwrap_or_default());
+        let nickname = new_agent_nickname.clone();
+        session
+            .send_event(
+                &turn,
+                CollabAgentSpawnEndEvent {
+                    call_id,
+                    sender_thread_id: session.conversation_id,
+                    new_thread_id,
+                    new_agent_nickname,
+                    new_agent_role,
+                    prompt,
+                    model: effective_model,
+                    reasoning_effort: effective_reasoning_effort,
+                    status,
+                }
+                .into(),
+            )
+            .await;
+        let new_thread_id = result?.thread_id;
+        let role_tag = role_name.unwrap_or(DEFAULT_ROLE_NAME);
+        turn.session_telemetry.counter(
+            "codex.multi_agent.spawn",
+            /*inc*/ 1,
+            &[("role", role_tag)],
+        );
+
+        Ok(SpawnAgentResult {
+            agent_id: new_thread_id.to_string(),
+            nickname,
         })
     }
 }

codex-rs/core/src/tools/handlers/multi_agents/wait.rs

@@ -15,6 +15,8 @@ use tokio::time::timeout_at;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = WaitAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -23,172 +25,162 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: WaitArgs = parse_arguments(&arguments)?;
-            let receiver_thread_ids = parse_agent_id_targets(args.targets)?;
-            let mut receiver_agents = Vec::with_capacity(receiver_thread_ids.len());
-            let mut target_by_thread_id = HashMap::with_capacity(receiver_thread_ids.len());
-            for receiver_thread_id in &receiver_thread_ids {
-                let agent_metadata = session
-                    .services
-                    .agent_control
-                    .get_agent_metadata(*receiver_thread_id)
-                    .unwrap_or_default();
-                target_by_thread_id.insert(
-                    *receiver_thread_id,
-                    agent_metadata
-                        .agent_path
-                        .as_ref()
-                        .map(ToString::to_string)
-                        .unwrap_or_else(|| receiver_thread_id.to_string()),
-                );
-                receiver_agents.push(CollabAgentRef {
-                    thread_id: *receiver_thread_id,
-                    agent_nickname: agent_metadata.agent_nickname,
-                    agent_role: agent_metadata.agent_role,
-                });
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: WaitArgs = parse_arguments(&arguments)?;
+        let receiver_thread_ids = parse_agent_id_targets(args.targets)?;
+        let mut receiver_agents = Vec::with_capacity(receiver_thread_ids.len());
+        let mut target_by_thread_id = HashMap::with_capacity(receiver_thread_ids.len());
+        for receiver_thread_id in &receiver_thread_ids {
+            let agent_metadata = session
+                .services
+                .agent_control
+                .get_agent_metadata(*receiver_thread_id)
+                .unwrap_or_default();
+            target_by_thread_id.insert(
+                *receiver_thread_id,
+                agent_metadata
+                    .agent_path
+                    .as_ref()
+                    .map(ToString::to_string)
+                    .unwrap_or_else(|| receiver_thread_id.to_string()),
+            );
+            receiver_agents.push(CollabAgentRef {
+                thread_id: *receiver_thread_id,
+                agent_nickname: agent_metadata.agent_nickname,
+                agent_role: agent_metadata.agent_role,
+            });
+        }
+
+        let timeout_ms = args.timeout_ms.unwrap_or(DEFAULT_WAIT_TIMEOUT_MS);
+        let timeout_ms = match timeout_ms {
+            ms if ms <= 0 => {
+                return Err(FunctionCallError::RespondToModel(
+                    "timeout_ms must be greater than zero".to_owned(),
+                ));
             }
+            ms => ms.clamp(MIN_WAIT_TIMEOUT_MS, MAX_WAIT_TIMEOUT_MS),
+        };
 
-            let timeout_ms = args.timeout_ms.unwrap_or(DEFAULT_WAIT_TIMEOUT_MS);
-            let timeout_ms = match timeout_ms {
-                ms if ms <= 0 => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "timeout_ms must be greater than zero".to_owned(),
-                    ));
+        session
+            .send_event(
+                &turn,
+                CollabWaitingBeginEvent {
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_ids: receiver_thread_ids.clone(),
+                    receiver_agents: receiver_agents.clone(),
+                    call_id: call_id.clone(),
                 }
-                ms => ms.clamp(MIN_WAIT_TIMEOUT_MS, MAX_WAIT_TIMEOUT_MS),
-            };
+                .into(),
+            )
+            .await;
 
-            session
-                .send_event(
-                    &turn,
-                    CollabWaitingBeginEvent {
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_ids: receiver_thread_ids.clone(),
-                        receiver_agents: receiver_agents.clone(),
-                        call_id: call_id.clone(),
-                    }
-                    .into(),
-                )
-                .await;
-
-            let mut status_rxs = Vec::with_capacity(receiver_thread_ids.len());
-            let mut initial_final_statuses = Vec::new();
-            for id in &receiver_thread_ids {
-                match session.services.agent_control.subscribe_status(*id).await {
-                    Ok(rx) => {
-                        let status = rx.borrow().clone();
-                        if is_final(&status) {
-                            initial_final_statuses.push((*id, status));
-                        }
-                        status_rxs.push((*id, rx));
-                    }
-                    Err(CodexErr::ThreadNotFound(_)) => {
-                        initial_final_statuses.push((*id, AgentStatus::NotFound));
-                    }
-                    Err(err) => {
-                        let mut statuses = HashMap::with_capacity(1);
-                        statuses.insert(*id, session.services.agent_control.get_status(*id).await);
-                        session
-                            .send_event(
-                                &turn,
-                                CollabWaitingEndEvent {
-                                    sender_thread_id: session.conversation_id,
-                                    call_id: call_id.clone(),
-                                    agent_statuses: build_wait_agent_statuses(
-                                        &statuses,
-                                        &receiver_agents,
-                                    ),
-                                    statuses,
-                                }
-                                .into(),
-                            )
-                            .await;
-                        return Err(collab_agent_error(*id, err));
+        let mut status_rxs = Vec::with_capacity(receiver_thread_ids.len());
+        let mut initial_final_statuses = Vec::new();
+        for id in &receiver_thread_ids {
+            match session.services.agent_control.subscribe_status(*id).await {
+                Ok(rx) => {
+                    let status = rx.borrow().clone();
+                    if is_final(&status) {
+                        initial_final_statuses.push((*id, status));
                     }
+                    status_rxs.push((*id, rx));
+                }
+                Err(CodexErr::ThreadNotFound(_)) => {
+                    initial_final_statuses.push((*id, AgentStatus::NotFound));
+                }
+                Err(err) => {
+                    let mut statuses = HashMap::with_capacity(1);
+                    statuses.insert(*id, session.services.agent_control.get_status(*id).await);
+                    session
+                        .send_event(
+                            &turn,
+                            CollabWaitingEndEvent {
+                                sender_thread_id: session.conversation_id,
+                                call_id: call_id.clone(),
+                                agent_statuses: build_wait_agent_statuses(
+                                    &statuses,
+                                    &receiver_agents,
+                                ),
+                                statuses,
+                            }
+                            .into(),
+                        )
+                        .await;
+                    return Err(collab_agent_error(*id, err));
                 }
             }
+        }
 
-            let statuses = if !initial_final_statuses.is_empty() {
-                initial_final_statuses
-            } else {
-                let mut futures = FuturesUnordered::new();
-                for (id, rx) in status_rxs.into_iter() {
-                    let session = session.clone();
-                    futures.push(wait_for_final_status(session, id, rx));
+        let statuses = if !initial_final_statuses.is_empty() {
+            initial_final_statuses
+        } else {
+            let mut futures = FuturesUnordered::new();
+            for (id, rx) in status_rxs.into_iter() {
+                let session = session.clone();
+                futures.push(wait_for_final_status(session, id, rx));
+            }
+            let mut results = Vec::new();
+            let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
+            loop {
+                match timeout_at(deadline, futures.next()).await {
+                    Ok(Some(Some(result))) => {
+                        results.push(result);
+                        break;
+                    }
+                    Ok(Some(None)) => continue,
+                    Ok(None) | Err(_) => break,
                 }
-                let mut results = Vec::new();
-                let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
+            }
+            if !results.is_empty() {
                 loop {
-                    match timeout_at(deadline, futures.next()).await {
-                        Ok(Some(Some(result))) => {
-                            results.push(result);
-                            break;
-                        }
-                        Ok(Some(None)) => continue,
-                        Ok(None) | Err(_) => break,
+                    match futures.next().now_or_never() {
+                        Some(Some(Some(result))) => results.push(result),
+                        Some(Some(None)) => continue,
+                        Some(None) | None => break,
                     }
                 }
-                if !results.is_empty() {
-                    loop {
-                        match futures.next().now_or_never() {
-                            Some(Some(Some(result))) => results.push(result),
-                            Some(Some(None)) => continue,
-                            Some(None) | None => break,
-                        }
-                    }
+            }
+            results
+        };
+
+        let timed_out = statuses.is_empty();
+        let statuses_by_id = statuses.clone().into_iter().collect::<HashMap<_, _>>();
+        let agent_statuses = build_wait_agent_statuses(&statuses_by_id, &receiver_agents);
+        let result = WaitAgentResult {
+            status: statuses
+                .into_iter()
+                .filter_map(|(thread_id, status)| {
+                    target_by_thread_id
+                        .get(&thread_id)
+                        .cloned()
+                        .map(|target| (target, status))
+                })
+                .collect(),
+            timed_out,
+        };
+
+        session
+            .send_event(
+                &turn,
+                CollabWaitingEndEvent {
+                    sender_thread_id: session.conversation_id,
+                    call_id,
+                    agent_statuses,
+                    statuses: statuses_by_id,
                 }
-                results
-            };
+                .into(),
+            )
+            .await;
 
-            let timed_out = statuses.is_empty();
-            let statuses_by_id = statuses.clone().into_iter().collect::<HashMap<_, _>>();
-            let agent_statuses = build_wait_agent_statuses(&statuses_by_id, &receiver_agents);
-            let result = WaitAgentResult {
-                status: statuses
-                    .into_iter()
-                    .filter_map(|(thread_id, status)| {
-                        target_by_thread_id
-                            .get(&thread_id)
-                            .cloned()
-                            .map(|target| (target, status))
-                    })
-                    .collect(),
-                timed_out,
-            };
-
-            session
-                .send_event(
-                    &turn,
-                    CollabWaitingEndEvent {
-                        sender_thread_id: session.conversation_id,
-                        call_id: call_id.clone(),
-                        agent_statuses,
-                        statuses: statuses_by_id,
-                    }
-                    .into(),
-                )
-                .await;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+        Ok(result)
     }
 }
 

codex-rs/core/src/tools/handlers/multi_agents_tests.rs

@@ -115,7 +115,6 @@ fn history_contains_inter_agent_communication(
 #[derive(Clone, Copy)]
 struct NeverEndingTask;
 
-#[async_trait::async_trait]
 impl SessionTask for NeverEndingTask {
     fn kind(&self) -> TaskKind {
         TaskKind::Regular

codex-rs/core/src/tools/handlers/multi_agents_v2.rs

@@ -9,7 +9,6 @@ use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::multi_agents_common::*;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::AgentPath;
@@ -24,7 +23,6 @@ use codex_protocol::protocol::CollabCloseEndEvent;
 use codex_protocol::protocol::CollabWaitingBeginEvent;
 use codex_protocol::protocol::CollabWaitingEndEvent;
 use codex_protocol::user_input::UserInput;
-use futures::future::BoxFuture;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value as JsonValue;

codex-rs/core/src/tools/handlers/multi_agents_v2/close_agent.rs

@@ -3,6 +3,8 @@ use super::*;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = CloseAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -11,103 +13,93 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: CloseAgentArgs = parse_arguments(&arguments)?;
-            let agent_id = resolve_agent_target(&session, &turn, &args.target).await?;
-            let receiver_agent = session
-                .services
-                .agent_control
-                .get_agent_metadata(agent_id)
-                .unwrap_or_default();
-            if receiver_agent
-                .agent_path
-                .as_ref()
-                .is_some_and(AgentPath::is_root)
-            {
-                return Err(FunctionCallError::RespondToModel(
-                    "root is not a spawned agent".to_string(),
-                ));
-            }
-            session
-                .send_event(
-                    &turn,
-                    CollabCloseBeginEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id: agent_id,
-                    }
-                    .into(),
-                )
-                .await;
-            let status = match session
-                .services
-                .agent_control
-                .subscribe_status(agent_id)
-                .await
-            {
-                Ok(mut status_rx) => status_rx.borrow_and_update().clone(),
-                Err(err) => {
-                    let status = session.services.agent_control.get_status(agent_id).await;
-                    session
-                        .send_event(
-                            &turn,
-                            CollabCloseEndEvent {
-                                call_id: call_id.clone(),
-                                sender_thread_id: session.conversation_id,
-                                receiver_thread_id: agent_id,
-                                receiver_agent_nickname: receiver_agent.agent_nickname.clone(),
-                                receiver_agent_role: receiver_agent.agent_role.clone(),
-                                status,
-                            }
-                            .into(),
-                        )
-                        .await;
-                    return Err(collab_agent_error(agent_id, err));
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: CloseAgentArgs = parse_arguments(&arguments)?;
+        let agent_id = resolve_agent_target(&session, &turn, &args.target).await?;
+        let receiver_agent = session
+            .services
+            .agent_control
+            .get_agent_metadata(agent_id)
+            .unwrap_or_default();
+        if receiver_agent
+            .agent_path
+            .as_ref()
+            .is_some_and(AgentPath::is_root)
+        {
+            return Err(FunctionCallError::RespondToModel(
+                "root is not a spawned agent".to_string(),
+            ));
+        }
+        session
+            .send_event(
+                &turn,
+                CollabCloseBeginEvent {
+                    call_id: call_id.clone(),
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id: agent_id,
                 }
-            };
-            let result = session
-                .services
-                .agent_control
-                .close_agent(agent_id)
-                .await
-                .map_err(|err| collab_agent_error(agent_id, err))
-                .map(|_| ());
-            session
-                .send_event(
-                    &turn,
-                    CollabCloseEndEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_id: agent_id,
-                        receiver_agent_nickname: receiver_agent.agent_nickname,
-                        receiver_agent_role: receiver_agent.agent_role,
-                        status: status.clone(),
-                    }
-                    .into(),
-                )
-                .await;
-            result?;
+                .into(),
+            )
+            .await;
+        let status = match session
+            .services
+            .agent_control
+            .subscribe_status(agent_id)
+            .await
+        {
+            Ok(mut status_rx) => status_rx.borrow_and_update().clone(),
+            Err(err) => {
+                let status = session.services.agent_control.get_status(agent_id).await;
+                session
+                    .send_event(
+                        &turn,
+                        CollabCloseEndEvent {
+                            call_id: call_id.clone(),
+                            sender_thread_id: session.conversation_id,
+                            receiver_thread_id: agent_id,
+                            receiver_agent_nickname: receiver_agent.agent_nickname.clone(),
+                            receiver_agent_role: receiver_agent.agent_role.clone(),
+                            status,
+                        }
+                        .into(),
+                    )
+                    .await;
+                return Err(collab_agent_error(agent_id, err));
+            }
+        };
+        let result = session
+            .services
+            .agent_control
+            .close_agent(agent_id)
+            .await
+            .map_err(|err| collab_agent_error(agent_id, err))
+            .map(|_| ());
+        session
+            .send_event(
+                &turn,
+                CollabCloseEndEvent {
+                    call_id,
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_id: agent_id,
+                    receiver_agent_nickname: receiver_agent.agent_nickname,
+                    receiver_agent_role: receiver_agent.agent_role,
+                    status: status.clone(),
+                }
+                .into(),
+            )
+            .await;
+        result?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(CloseAgentResult {
-                    previous_status: status,
-                }),
-            })
+        Ok(CloseAgentResult {
+            previous_status: status,
         })
     }
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/followup_task.rs

@@ -1,11 +1,14 @@
 use super::message_tool::FollowupTaskArgs;
 use super::message_tool::MessageDeliveryMode;
+use super::message_tool::MessageToolResult;
 use super::message_tool::handle_message_string_tool;
 use super::*;
 
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = MessageToolResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -14,29 +17,16 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let call_id = invocation.call_id.clone();
-            let payload_for_result = invocation.payload.clone();
-            let arguments = function_arguments(invocation.payload.clone())?;
-            let args: FollowupTaskArgs = parse_arguments(&arguments)?;
-            let result = handle_message_string_tool(
-                invocation,
-                MessageDeliveryMode::TriggerTurn,
-                args.target,
-                args.message,
-                args.interrupt,
-            )
-            .await?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let arguments = function_arguments(invocation.payload.clone())?;
+        let args: FollowupTaskArgs = parse_arguments(&arguments)?;
+        handle_message_string_tool(
+            invocation,
+            MessageDeliveryMode::TriggerTurn,
+            args.target,
+            args.message,
+            args.interrupt,
+        )
+        .await
     }
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/list_agents.rs

@@ -4,6 +4,8 @@ use crate::agent::control::ListedAgent;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = ListAgentsResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -12,38 +14,27 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: ListAgentsArgs = parse_arguments(&arguments)?;
-            session
-                .services
-                .agent_control
-                .register_session_root(session.conversation_id, &turn.session_source);
-            let agents = session
-                .services
-                .agent_control
-                .list_agents(&turn.session_source, args.path_prefix.as_deref())
-                .await
-                .map_err(collab_spawn_error)?;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: ListAgentsArgs = parse_arguments(&arguments)?;
+        session
+            .services
+            .agent_control
+            .register_session_root(session.conversation_id, &turn.session_source);
+        let agents = session
+            .services
+            .agent_control
+            .list_agents(&turn.session_source, args.path_prefix.as_deref())
+            .await
+            .map_err(collab_spawn_error)?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(ListAgentsResult { agents }),
-            })
-        })
+        Ok(ListAgentsResult { agents })
     }
 }
 

codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs

@@ -1,4 +1,5 @@
 use super::message_tool::MessageDeliveryMode;
+use super::message_tool::MessageToolResult;
 use super::message_tool::SendMessageArgs;
 use super::message_tool::handle_message_string_tool;
 use super::*;
@@ -6,6 +7,8 @@ use super::*;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = MessageToolResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -14,29 +17,16 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let call_id = invocation.call_id.clone();
-            let payload_for_result = invocation.payload.clone();
-            let arguments = function_arguments(invocation.payload.clone())?;
-            let args: SendMessageArgs = parse_arguments(&arguments)?;
-            let result = handle_message_string_tool(
-                invocation,
-                MessageDeliveryMode::QueueOnly,
-                args.target,
-                args.message,
-                /*interrupt*/ false,
-            )
-            .await?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let arguments = function_arguments(invocation.payload.clone())?;
+        let args: SendMessageArgs = parse_arguments(&arguments)?;
+        handle_message_string_tool(
+            invocation,
+            MessageDeliveryMode::QueueOnly,
+            args.target,
+            args.message,
+            /*interrupt*/ false,
+        )
+        .await
     }
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs

@@ -12,6 +12,8 @@ use codex_protocol::protocol::Op;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = SpawnAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -20,188 +22,178 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: SpawnAgentArgs = parse_arguments(&arguments)?;
-            let fork_mode = args.fork_mode()?;
-            let role_name = args
-                .agent_type
-                .as_deref()
-                .map(str::trim)
-                .filter(|role| !role.is_empty());
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: SpawnAgentArgs = parse_arguments(&arguments)?;
+        let fork_mode = args.fork_mode()?;
+        let role_name = args
+            .agent_type
+            .as_deref()
+            .map(str::trim)
+            .filter(|role| !role.is_empty());
 
-            let initial_operation = parse_collab_input(Some(args.message), /*items*/ None)?;
-            let prompt = render_input_preview(&initial_operation);
+        let initial_operation = parse_collab_input(Some(args.message), /*items*/ None)?;
+        let prompt = render_input_preview(&initial_operation);
 
-            let session_source = turn.session_source.clone();
-            let child_depth = next_thread_spawn_depth(&session_source);
-            let max_depth = turn.config.agent_max_depth;
-            if exceeds_thread_spawn_depth_limit(child_depth, max_depth) {
-                return Err(FunctionCallError::RespondToModel(
-                    "Agent depth limit reached. Solve the task yourself.".to_string(),
-                ));
-            }
-            session
-                .send_event(
-                    &turn,
-                    CollabAgentSpawnBeginEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        prompt: prompt.clone(),
-                        model: args.model.clone().unwrap_or_default(),
-                        reasoning_effort: args.reasoning_effort.unwrap_or_default(),
-                    }
-                    .into(),
-                )
-                .await;
-            let mut config =
-                build_agent_spawn_config(&session.get_base_instructions().await, turn.as_ref())?;
-            apply_requested_spawn_agent_model_overrides(
-                &session,
-                turn.as_ref(),
-                &mut config,
-                args.model.as_deref(),
-                args.reasoning_effort,
-            )
-            .await?;
-            apply_role_to_config(&mut config, role_name)
-                .await
-                .map_err(FunctionCallError::RespondToModel)?;
-            apply_spawn_agent_runtime_overrides(&mut config, turn.as_ref())?;
-            apply_spawn_agent_overrides(&mut config, child_depth);
-
-            let spawn_source = thread_spawn_source(
-                session.conversation_id,
-                &turn.session_source,
-                child_depth,
-                role_name,
-                Some(args.task_name.clone()),
-            )?;
-            let result = session
-                .services
-                .agent_control
-                .spawn_agent_with_metadata(
-                    config,
-                    match (spawn_source.get_agent_path(), initial_operation) {
-                        (Some(recipient), Op::UserInput { items, .. })
-                            if items
-                                .iter()
-                                .all(|item| matches!(item, UserInput::Text { .. })) =>
-                        {
-                            Op::InterAgentCommunication {
-                                communication: InterAgentCommunication::new(
-                                    turn.session_source
-                                        .get_agent_path()
-                                        .unwrap_or_else(AgentPath::root),
-                                    recipient,
-                                    Vec::new(),
-                                    prompt.clone(),
-                                    /*trigger_turn*/ true,
-                                ),
-                            }
-                        }
-                        (_, initial_operation) => initial_operation,
-                    },
-                    Some(spawn_source),
-                    SpawnAgentOptions {
-                        fork_parent_spawn_call_id: fork_mode.as_ref().map(|_| call_id.clone()),
-                        fork_mode,
-                    },
-                )
-                .await
-                .map_err(collab_spawn_error);
-            let (new_thread_id, new_agent_metadata, status) = match &result {
-                Ok(spawned_agent) => (
-                    Some(spawned_agent.thread_id),
-                    Some(spawned_agent.metadata.clone()),
-                    spawned_agent.status.clone(),
-                ),
-                Err(_) => (None, None, AgentStatus::NotFound),
-            };
-            let agent_snapshot = match new_thread_id {
-                Some(thread_id) => {
-                    session
-                        .services
-                        .agent_control
-                        .get_agent_config_snapshot(thread_id)
-                        .await
+        let session_source = turn.session_source.clone();
+        let child_depth = next_thread_spawn_depth(&session_source);
+        let max_depth = turn.config.agent_max_depth;
+        if exceeds_thread_spawn_depth_limit(child_depth, max_depth) {
+            return Err(FunctionCallError::RespondToModel(
+                "Agent depth limit reached. Solve the task yourself.".to_string(),
+            ));
+        }
+        session
+            .send_event(
+                &turn,
+                CollabAgentSpawnBeginEvent {
+                    call_id: call_id.clone(),
+                    sender_thread_id: session.conversation_id,
+                    prompt: prompt.clone(),
+                    model: args.model.clone().unwrap_or_default(),
+                    reasoning_effort: args.reasoning_effort.unwrap_or_default(),
                 }
-                None => None,
-            };
-            let (new_agent_path, new_agent_nickname, new_agent_role) =
-                match (&agent_snapshot, new_agent_metadata) {
-                    (Some(snapshot), _) => (
-                        snapshot.session_source.get_agent_path().map(String::from),
-                        snapshot.session_source.get_nickname(),
-                        snapshot.session_source.get_agent_role(),
-                    ),
-                    (None, Some(metadata)) => (
-                        metadata.agent_path.map(String::from),
-                        metadata.agent_nickname,
-                        metadata.agent_role,
-                    ),
-                    (None, None) => (None, None, None),
-                };
-            let effective_model = agent_snapshot
-                .as_ref()
-                .map(|snapshot| snapshot.model.clone())
-                .unwrap_or_else(|| args.model.clone().unwrap_or_default());
-            let effective_reasoning_effort = agent_snapshot
-                .as_ref()
-                .and_then(|snapshot| snapshot.reasoning_effort)
-                .unwrap_or(args.reasoning_effort.unwrap_or_default());
-            let nickname = new_agent_nickname.clone();
-            session
-                .send_event(
-                    &turn,
-                    CollabAgentSpawnEndEvent {
-                        call_id: call_id.clone(),
-                        sender_thread_id: session.conversation_id,
-                        new_thread_id,
-                        new_agent_nickname,
-                        new_agent_role,
-                        prompt,
-                        model: effective_model,
-                        reasoning_effort: effective_reasoning_effort,
-                        status,
-                    }
-                    .into(),
-                )
-                .await;
-            let _ = result?;
-            let role_tag = role_name.unwrap_or(DEFAULT_ROLE_NAME);
-            turn.session_telemetry.counter(
-                "codex.multi_agent.spawn",
-                /*inc*/ 1,
-                &[("role", role_tag)],
-            );
-            let task_name = new_agent_path.ok_or_else(|| {
-                FunctionCallError::RespondToModel(
-                    "spawned agent is missing a canonical task name".to_string(),
-                )
-            })?;
+                .into(),
+            )
+            .await;
+        let mut config =
+            build_agent_spawn_config(&session.get_base_instructions().await, turn.as_ref())?;
+        apply_requested_spawn_agent_model_overrides(
+            &session,
+            turn.as_ref(),
+            &mut config,
+            args.model.as_deref(),
+            args.reasoning_effort,
+        )
+        .await?;
+        apply_role_to_config(&mut config, role_name)
+            .await
+            .map_err(FunctionCallError::RespondToModel)?;
+        apply_spawn_agent_runtime_overrides(&mut config, turn.as_ref())?;
+        apply_spawn_agent_overrides(&mut config, child_depth);
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(SpawnAgentResult {
-                    agent_id: None,
-                    task_name,
-                    nickname,
-                }),
-            })
+        let spawn_source = thread_spawn_source(
+            session.conversation_id,
+            &turn.session_source,
+            child_depth,
+            role_name,
+            Some(args.task_name.clone()),
+        )?;
+        let result = session
+            .services
+            .agent_control
+            .spawn_agent_with_metadata(
+                config,
+                match (spawn_source.get_agent_path(), initial_operation) {
+                    (Some(recipient), Op::UserInput { items, .. })
+                        if items
+                            .iter()
+                            .all(|item| matches!(item, UserInput::Text { .. })) =>
+                    {
+                        Op::InterAgentCommunication {
+                            communication: InterAgentCommunication::new(
+                                turn.session_source
+                                    .get_agent_path()
+                                    .unwrap_or_else(AgentPath::root),
+                                recipient,
+                                Vec::new(),
+                                prompt.clone(),
+                                /*trigger_turn*/ true,
+                            ),
+                        }
+                    }
+                    (_, initial_operation) => initial_operation,
+                },
+                Some(spawn_source),
+                SpawnAgentOptions {
+                    fork_parent_spawn_call_id: fork_mode.as_ref().map(|_| call_id.clone()),
+                    fork_mode,
+                },
+            )
+            .await
+            .map_err(collab_spawn_error);
+        let (new_thread_id, new_agent_metadata, status) = match &result {
+            Ok(spawned_agent) => (
+                Some(spawned_agent.thread_id),
+                Some(spawned_agent.metadata.clone()),
+                spawned_agent.status.clone(),
+            ),
+            Err(_) => (None, None, AgentStatus::NotFound),
+        };
+        let agent_snapshot = match new_thread_id {
+            Some(thread_id) => {
+                session
+                    .services
+                    .agent_control
+                    .get_agent_config_snapshot(thread_id)
+                    .await
+            }
+            None => None,
+        };
+        let (new_agent_path, new_agent_nickname, new_agent_role) =
+            match (&agent_snapshot, new_agent_metadata) {
+                (Some(snapshot), _) => (
+                    snapshot.session_source.get_agent_path().map(String::from),
+                    snapshot.session_source.get_nickname(),
+                    snapshot.session_source.get_agent_role(),
+                ),
+                (None, Some(metadata)) => (
+                    metadata.agent_path.map(String::from),
+                    metadata.agent_nickname,
+                    metadata.agent_role,
+                ),
+                (None, None) => (None, None, None),
+            };
+        let effective_model = agent_snapshot
+            .as_ref()
+            .map(|snapshot| snapshot.model.clone())
+            .unwrap_or_else(|| args.model.clone().unwrap_or_default());
+        let effective_reasoning_effort = agent_snapshot
+            .as_ref()
+            .and_then(|snapshot| snapshot.reasoning_effort)
+            .unwrap_or(args.reasoning_effort.unwrap_or_default());
+        let nickname = new_agent_nickname.clone();
+        session
+            .send_event(
+                &turn,
+                CollabAgentSpawnEndEvent {
+                    call_id,
+                    sender_thread_id: session.conversation_id,
+                    new_thread_id,
+                    new_agent_nickname,
+                    new_agent_role,
+                    prompt,
+                    model: effective_model,
+                    reasoning_effort: effective_reasoning_effort,
+                    status,
+                }
+                .into(),
+            )
+            .await;
+        let _ = result?;
+        let role_tag = role_name.unwrap_or(DEFAULT_ROLE_NAME);
+        turn.session_telemetry.counter(
+            "codex.multi_agent.spawn",
+            /*inc*/ 1,
+            &[("role", role_tag)],
+        );
+        let task_name = new_agent_path.ok_or_else(|| {
+            FunctionCallError::RespondToModel(
+                "spawned agent is missing a canonical task name".to_string(),
+            )
+        })?;
+
+        Ok(SpawnAgentResult {
+            agent_id: None,
+            task_name,
+            nickname,
         })
     }
 }

codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs

@@ -7,6 +7,8 @@ use tokio::time::timeout_at;
 pub(crate) struct Handler;
 
 impl ToolHandler for Handler {
+    type Output = WaitAgentResult;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -15,69 +17,59 @@ impl ToolHandler for Handler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-            let arguments = function_arguments(payload)?;
-            let args: WaitArgs = parse_arguments(&arguments)?;
-            let timeout_ms = args.timeout_ms.unwrap_or(DEFAULT_WAIT_TIMEOUT_MS);
-            let timeout_ms = match timeout_ms {
-                ms if ms <= 0 => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "timeout_ms must be greater than zero".to_owned(),
-                    ));
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+        let arguments = function_arguments(payload)?;
+        let args: WaitArgs = parse_arguments(&arguments)?;
+        let timeout_ms = args.timeout_ms.unwrap_or(DEFAULT_WAIT_TIMEOUT_MS);
+        let timeout_ms = match timeout_ms {
+            ms if ms <= 0 => {
+                return Err(FunctionCallError::RespondToModel(
+                    "timeout_ms must be greater than zero".to_owned(),
+                ));
+            }
+            ms => ms.clamp(MIN_WAIT_TIMEOUT_MS, MAX_WAIT_TIMEOUT_MS),
+        };
+
+        let mut mailbox_seq_rx = session.subscribe_mailbox_seq();
+
+        session
+            .send_event(
+                &turn,
+                CollabWaitingBeginEvent {
+                    sender_thread_id: session.conversation_id,
+                    receiver_thread_ids: Vec::new(),
+                    receiver_agents: Vec::new(),
+                    call_id: call_id.clone(),
                 }
-                ms => ms.clamp(MIN_WAIT_TIMEOUT_MS, MAX_WAIT_TIMEOUT_MS),
-            };
+                .into(),
+            )
+            .await;
 
-            let mut mailbox_seq_rx = session.subscribe_mailbox_seq();
+        let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
+        let timed_out = !wait_for_mailbox_change(&mut mailbox_seq_rx, deadline).await;
+        let result = WaitAgentResult::from_timed_out(timed_out);
 
-            session
-                .send_event(
-                    &turn,
-                    CollabWaitingBeginEvent {
-                        sender_thread_id: session.conversation_id,
-                        receiver_thread_ids: Vec::new(),
-                        receiver_agents: Vec::new(),
-                        call_id: call_id.clone(),
-                    }
-                    .into(),
-                )
-                .await;
+        session
+            .send_event(
+                &turn,
+                CollabWaitingEndEvent {
+                    sender_thread_id: session.conversation_id,
+                    call_id,
+                    agent_statuses: Vec::new(),
+                    statuses: HashMap::new(),
+                }
+                .into(),
+            )
+            .await;
 
-            let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
-            let timed_out = !wait_for_mailbox_change(&mut mailbox_seq_rx, deadline).await;
-            let result = WaitAgentResult::from_timed_out(timed_out);
-
-            session
-                .send_event(
-                    &turn,
-                    CollabWaitingEndEvent {
-                        sender_thread_id: session.conversation_id,
-                        call_id: call_id.clone(),
-                        agent_statuses: Vec::new(),
-                        statuses: HashMap::new(),
-                    }
-                    .into(),
-                )
-                .await;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(result),
-            })
-        })
+        Ok(result)
     }
 }
 

codex-rs/core/src/tools/handlers/plan.rs

@@ -4,7 +4,6 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::config_types::ModeKind;
@@ -12,7 +11,6 @@ use codex_protocol::models::FunctionCallOutputPayload;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::plan_tool::UpdatePlanArgs;
 use codex_protocol::protocol::EventMsg;
-use futures::future::BoxFuture;
 use serde_json::Value as JsonValue;
 
 pub struct PlanHandler;
@@ -46,41 +44,33 @@ impl ToolOutput for PlanToolOutput {
 }
 
 impl ToolHandler for PlanHandler {
+    type Output = PlanToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                payload,
-                ..
-            } = invocation;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            payload,
+            ..
+        } = invocation;
 
-            let payload_for_result = payload.clone();
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "update_plan handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "update_plan handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            handle_update_plan(session.as_ref(), turn.as_ref(), arguments, call_id.clone()).await?;
+        handle_update_plan(session.as_ref(), turn.as_ref(), arguments, call_id).await?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(PlanToolOutput),
-            })
-        })
+        Ok(PlanToolOutput)
     }
 }
 

codex-rs/core/src/tools/handlers/request_permissions.rs

@@ -1,77 +1,67 @@
 use codex_protocol::request_permissions::RequestPermissionsArgs;
 use codex_sandboxing::policy_transforms::normalize_additional_permissions;
-use futures::future::BoxFuture;
 
 use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments_with_base_path;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
 pub struct RequestPermissionsHandler;
 
 impl ToolHandler for RequestPermissionsHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                payload,
-                ..
-            } = invocation;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            payload,
+            ..
+        } = invocation;
 
-            let payload_for_result = payload.clone();
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "request_permissions handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
-
-            let mut args: RequestPermissionsArgs =
-                parse_arguments_with_base_path(&arguments, turn.cwd.as_path())?;
-            args.permissions = normalize_additional_permissions(args.permissions.into())
-                .map(codex_protocol::request_permissions::RequestPermissionProfile::from)
-                .map_err(FunctionCallError::RespondToModel)?;
-            if args.permissions.is_empty() {
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
                 return Err(FunctionCallError::RespondToModel(
-                    "request_permissions requires at least one permission".to_string(),
+                    "request_permissions handler received unsupported payload".to_string(),
                 ));
             }
+        };
 
-            let response = session
-                .request_permissions(turn.as_ref(), call_id.clone(), args)
-                .await
-                .ok_or_else(|| {
-                    FunctionCallError::RespondToModel(
-                        "request_permissions was cancelled before receiving a response".to_string(),
-                    )
-                })?;
+        let mut args: RequestPermissionsArgs =
+            parse_arguments_with_base_path(&arguments, turn.cwd.as_path())?;
+        args.permissions = normalize_additional_permissions(args.permissions.into())
+            .map(codex_protocol::request_permissions::RequestPermissionProfile::from)
+            .map_err(FunctionCallError::RespondToModel)?;
+        if args.permissions.is_empty() {
+            return Err(FunctionCallError::RespondToModel(
+                "request_permissions requires at least one permission".to_string(),
+            ));
+        }
 
-            let content = serde_json::to_string(&response).map_err(|err| {
-                FunctionCallError::Fatal(format!(
-                    "failed to serialize request_permissions response: {err}"
-                ))
+        let response = session
+            .request_permissions(turn.as_ref(), call_id, args)
+            .await
+            .ok_or_else(|| {
+                FunctionCallError::RespondToModel(
+                    "request_permissions was cancelled before receiving a response".to_string(),
+                )
             })?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(FunctionToolOutput::from_text(content, Some(true))),
-            })
-        })
+        let content = serde_json::to_string(&response).map_err(|err| {
+            FunctionCallError::Fatal(format!(
+                "failed to serialize request_permissions response: {err}"
+            ))
+        })?;
+
+        Ok(FunctionToolOutput::from_text(content, Some(true)))
     }
 }

codex-rs/core/src/tools/handlers/request_user_input.rs

@@ -3,77 +3,67 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::request_user_input::RequestUserInputArgs;
 use codex_tools::REQUEST_USER_INPUT_TOOL_NAME;
 use codex_tools::normalize_request_user_input_args;
 use codex_tools::request_user_input_unavailable_message;
-use futures::future::BoxFuture;
 
 pub struct RequestUserInputHandler {
     pub default_mode_request_user_input: bool,
 }
 
 impl ToolHandler for RequestUserInputHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                call_id,
-                payload,
-                ..
-            } = invocation;
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            call_id,
+            payload,
+            ..
+        } = invocation;
 
-            let payload_for_result = payload.clone();
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(format!(
-                        "{REQUEST_USER_INPUT_TOOL_NAME} handler received unsupported payload"
-                    )));
-                }
-            };
-
-            let mode = session.collaboration_mode().await.mode;
-            if let Some(message) =
-                request_user_input_unavailable_message(mode, self.default_mode_request_user_input)
-            {
-                return Err(FunctionCallError::RespondToModel(message));
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(format!(
+                    "{REQUEST_USER_INPUT_TOOL_NAME} handler received unsupported payload"
+                )));
             }
+        };
 
-            let args: RequestUserInputArgs = parse_arguments(&arguments)?;
-            let args = normalize_request_user_input_args(args)
-                .map_err(FunctionCallError::RespondToModel)?;
-            let response = session
-                .request_user_input(turn.as_ref(), call_id.clone(), args)
-                .await
-                .ok_or_else(|| {
-                    FunctionCallError::RespondToModel(format!(
-                        "{REQUEST_USER_INPUT_TOOL_NAME} was cancelled before receiving a response"
-                    ))
-                })?;
+        let mode = session.collaboration_mode().await.mode;
+        if let Some(message) =
+            request_user_input_unavailable_message(mode, self.default_mode_request_user_input)
+        {
+            return Err(FunctionCallError::RespondToModel(message));
+        }
 
-            let content = serde_json::to_string(&response).map_err(|err| {
-                FunctionCallError::Fatal(format!(
-                    "failed to serialize {REQUEST_USER_INPUT_TOOL_NAME} response: {err}"
+        let args: RequestUserInputArgs = parse_arguments(&arguments)?;
+        let args =
+            normalize_request_user_input_args(args).map_err(FunctionCallError::RespondToModel)?;
+        let response = session
+            .request_user_input(turn.as_ref(), call_id, args)
+            .await
+            .ok_or_else(|| {
+                FunctionCallError::RespondToModel(format!(
+                    "{REQUEST_USER_INPUT_TOOL_NAME} was cancelled before receiving a response"
                 ))
             })?;
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(FunctionToolOutput::from_text(content, Some(true))),
-            })
-        })
+        let content = serde_json::to_string(&response).map_err(|err| {
+            FunctionCallError::Fatal(format!(
+                "failed to serialize {REQUEST_USER_INPUT_TOOL_NAME} response: {err}"
+            ))
+        })?;
+
+        Ok(FunctionToolOutput::from_text(content, Some(true)))
     }
 }

codex-rs/core/src/tools/handlers/shell.rs

@@ -26,7 +26,6 @@ use crate::tools::handlers::parse_arguments;
 use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::handlers::resolve_workdir_base_path;
 use crate::tools::orchestrator::ToolOrchestrator;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolHandler;
@@ -40,7 +39,6 @@ use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::ExecCommandSource;
 use codex_shell_command::is_safe_command::is_known_safe_command;
 use codex_tools::ShellCommandBackendConfig;
-use futures::future::BoxFuture;
 
 pub struct ShellHandler;
 
@@ -180,6 +178,8 @@ impl From<ShellCommandBackendConfig> for ShellCommandHandler {
 }
 
 impl ToolHandler for ShellHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -191,7 +191,7 @@ impl ToolHandler for ShellHandler {
         )
     }
 
-    fn is_mutating(&self, invocation: &ToolInvocation) -> bool {
+    async fn is_mutating(&self, invocation: &ToolInvocation) -> bool {
         match &invocation.payload {
             ToolPayload::Function { arguments } => {
                 serde_json::from_str::<ShellToolCallParams>(arguments)
@@ -220,78 +220,66 @@ impl ToolHandler for ShellHandler {
         })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                tracker,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tracker,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let output = match payload {
-                ToolPayload::Function { arguments } => {
-                    let cwd = resolve_workdir_base_path(&arguments, turn.cwd.as_path())?;
-                    let params: ShellToolCallParams =
-                        parse_arguments_with_base_path(&arguments, cwd.as_path())?;
-                    let prefix_rule = params.prefix_rule.clone();
-                    let exec_params =
-                        Self::to_exec_params(&params, turn.as_ref(), session.conversation_id);
-                    Self::run_exec_like(RunExecLikeArgs {
-                        tool_name: tool_name.clone(),
-                        exec_params,
-                        additional_permissions: params.additional_permissions.clone(),
-                        prefix_rule,
-                        session,
-                        turn,
-                        tracker,
-                        call_id: call_id.clone(),
-                        freeform: false,
-                        shell_runtime_backend: ShellRuntimeBackend::Generic,
-                    })
-                    .await?
-                }
-                ToolPayload::LocalShell { params } => {
-                    let exec_params =
-                        Self::to_exec_params(&params, turn.as_ref(), session.conversation_id);
-                    Self::run_exec_like(RunExecLikeArgs {
-                        tool_name: tool_name.clone(),
-                        exec_params,
-                        additional_permissions: None,
-                        prefix_rule: None,
-                        session,
-                        turn,
-                        tracker,
-                        call_id: call_id.clone(),
-                        freeform: false,
-                        shell_runtime_backend: ShellRuntimeBackend::Generic,
-                    })
-                    .await?
-                }
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(format!(
-                        "unsupported payload for shell handler: {tool_name}"
-                    )));
-                }
-            };
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(output),
-            })
-        })
+        match payload {
+            ToolPayload::Function { arguments } => {
+                let cwd = resolve_workdir_base_path(&arguments, turn.cwd.as_path())?;
+                let params: ShellToolCallParams =
+                    parse_arguments_with_base_path(&arguments, cwd.as_path())?;
+                let prefix_rule = params.prefix_rule.clone();
+                let exec_params =
+                    Self::to_exec_params(&params, turn.as_ref(), session.conversation_id);
+                Self::run_exec_like(RunExecLikeArgs {
+                    tool_name: tool_name.clone(),
+                    exec_params,
+                    additional_permissions: params.additional_permissions.clone(),
+                    prefix_rule,
+                    session,
+                    turn,
+                    tracker,
+                    call_id,
+                    freeform: false,
+                    shell_runtime_backend: ShellRuntimeBackend::Generic,
+                })
+                .await
+            }
+            ToolPayload::LocalShell { params } => {
+                let exec_params =
+                    Self::to_exec_params(&params, turn.as_ref(), session.conversation_id);
+                Self::run_exec_like(RunExecLikeArgs {
+                    tool_name: tool_name.clone(),
+                    exec_params,
+                    additional_permissions: None,
+                    prefix_rule: None,
+                    session,
+                    turn,
+                    tracker,
+                    call_id,
+                    freeform: false,
+                    shell_runtime_backend: ShellRuntimeBackend::Generic,
+                })
+                .await
+            }
+            _ => Err(FunctionCallError::RespondToModel(format!(
+                "unsupported payload for shell handler: {tool_name}"
+            ))),
+        }
     }
 }
 
 impl ToolHandler for ShellCommandHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -300,7 +288,7 @@ impl ToolHandler for ShellCommandHandler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn is_mutating(&self, invocation: &ToolInvocation) -> bool {
+    async fn is_mutating(&self, invocation: &ToolInvocation) -> bool {
         let ToolPayload::Function { arguments } = &invocation.payload else {
             return true;
         };
@@ -339,67 +327,55 @@ impl ToolHandler for ShellCommandHandler {
         })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                tracker,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tracker,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let ToolPayload::Function { arguments } = payload else {
-                return Err(FunctionCallError::RespondToModel(format!(
-                    "unsupported payload for shell_command handler: {tool_name}"
-                )));
-            };
+        let ToolPayload::Function { arguments } = payload else {
+            return Err(FunctionCallError::RespondToModel(format!(
+                "unsupported payload for shell_command handler: {tool_name}"
+            )));
+        };
 
-            let cwd = resolve_workdir_base_path(&arguments, turn.cwd.as_path())?;
-            let params: ShellCommandToolCallParams =
-                parse_arguments_with_base_path(&arguments, cwd.as_path())?;
-            let workdir = turn.resolve_path(params.workdir.clone());
-            maybe_emit_implicit_skill_invocation(
-                session.as_ref(),
-                turn.as_ref(),
-                &params.command,
-                &workdir,
-            )
-            .await;
-            let prefix_rule = params.prefix_rule.clone();
-            let exec_params = Self::to_exec_params(
-                &params,
-                session.as_ref(),
-                turn.as_ref(),
-                session.conversation_id,
-                turn.tools_config.allow_login_shell,
-            )?;
-            let output = ShellHandler::run_exec_like(RunExecLikeArgs {
-                tool_name,
-                exec_params,
-                additional_permissions: params.additional_permissions.clone(),
-                prefix_rule,
-                session,
-                turn,
-                tracker,
-                call_id: call_id.clone(),
-                freeform: true,
-                shell_runtime_backend: self.shell_runtime_backend(),
-            })
-            .await?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(output),
-            })
+        let cwd = resolve_workdir_base_path(&arguments, turn.cwd.as_path())?;
+        let params: ShellCommandToolCallParams =
+            parse_arguments_with_base_path(&arguments, cwd.as_path())?;
+        let workdir = turn.resolve_path(params.workdir.clone());
+        maybe_emit_implicit_skill_invocation(
+            session.as_ref(),
+            turn.as_ref(),
+            &params.command,
+            &workdir,
+        )
+        .await;
+        let prefix_rule = params.prefix_rule.clone();
+        let exec_params = Self::to_exec_params(
+            &params,
+            session.as_ref(),
+            turn.as_ref(),
+            session.conversation_id,
+            turn.tools_config.allow_login_shell,
+        )?;
+        ShellHandler::run_exec_like(RunExecLikeArgs {
+            tool_name,
+            exec_params,
+            additional_permissions: params.additional_permissions.clone(),
+            prefix_rule,
+            session,
+            turn,
+            tracker,
+            call_id,
+            freeform: true,
+            shell_runtime_backend: self.shell_runtime_backend(),
         })
+        .await
     }
 }
 

codex-rs/core/src/tools/handlers/test_sync.rs

@@ -4,7 +4,6 @@ use std::sync::Arc;
 use std::sync::OnceLock;
 use std::time::Duration;
 
-use futures::future::BoxFuture;
 use serde::Deserialize;
 use tokio::sync::Barrier;
 use tokio::time::sleep;
@@ -14,7 +13,6 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
@@ -56,53 +54,43 @@ fn barrier_map() -> &'static tokio::sync::Mutex<HashMap<String, BarrierState>> {
 }
 
 impl ToolHandler for TestSyncHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                call_id, payload, ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation { payload, .. } = invocation;
 
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "test_sync_tool handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
-
-            let args: TestSyncArgs = parse_arguments(&arguments)?;
-
-            if let Some(delay) = args.sleep_before_ms
-                && delay > 0
-            {
-                sleep(Duration::from_millis(delay)).await;
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "test_sync_tool handler received unsupported payload".to_string(),
+                ));
             }
+        };
 
-            if let Some(barrier) = args.barrier {
-                wait_on_barrier(barrier).await?;
-            }
+        let args: TestSyncArgs = parse_arguments(&arguments)?;
 
-            if let Some(delay) = args.sleep_after_ms
-                && delay > 0
-            {
-                sleep(Duration::from_millis(delay)).await;
-            }
+        if let Some(delay) = args.sleep_before_ms
+            && delay > 0
+        {
+            sleep(Duration::from_millis(delay)).await;
+        }
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(FunctionToolOutput::from_text("ok".to_string(), Some(true))),
-            })
-        })
+        if let Some(barrier) = args.barrier {
+            wait_on_barrier(barrier).await?;
+        }
+
+        if let Some(delay) = args.sleep_after_ms
+            && delay > 0
+        {
+            sleep(Duration::from_millis(delay)).await;
+        }
+
+        Ok(FunctionToolOutput::from_text("ok".to_string(), Some(true)))
     }
 }
 

codex-rs/core/src/tools/handlers/tool_search.rs

@@ -2,7 +2,6 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::context::ToolSearchOutput;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use bm25::Document;
@@ -13,7 +12,6 @@ use codex_tools::TOOL_SEARCH_DEFAULT_LIMIT;
 use codex_tools::TOOL_SEARCH_TOOL_NAME;
 use codex_tools::ToolSearchResultSource;
 use codex_tools::collect_tool_search_output_tools;
-use futures::future::BoxFuture;
 use std::collections::HashMap;
 
 pub struct ToolSearchHandler {
@@ -27,84 +25,76 @@ impl ToolSearchHandler {
 }
 
 impl ToolHandler for ToolSearchHandler {
+    type Output = ToolSearchOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                call_id, payload, ..
-            } = invocation;
+    ) -> Result<ToolSearchOutput, FunctionCallError> {
+        let ToolInvocation { payload, .. } = invocation;
 
-            let payload_for_result = payload.clone();
-            let args = match payload {
-                ToolPayload::ToolSearch { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::Fatal(format!(
-                        "{TOOL_SEARCH_TOOL_NAME} handler received unsupported payload"
-                    )));
-                }
-            };
-
-            let query = args.query.trim();
-            if query.is_empty() {
-                return Err(FunctionCallError::RespondToModel(
-                    "query must not be empty".to_string(),
-                ));
+        let args = match payload {
+            ToolPayload::ToolSearch { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::Fatal(format!(
+                    "{TOOL_SEARCH_TOOL_NAME} handler received unsupported payload"
+                )));
             }
-            let limit = args.limit.unwrap_or(TOOL_SEARCH_DEFAULT_LIMIT);
+        };
 
-            if limit == 0 {
-                return Err(FunctionCallError::RespondToModel(
-                    "limit must be greater than zero".to_string(),
-                ));
-            }
+        let query = args.query.trim();
+        if query.is_empty() {
+            return Err(FunctionCallError::RespondToModel(
+                "query must not be empty".to_string(),
+            ));
+        }
+        let limit = args.limit.unwrap_or(TOOL_SEARCH_DEFAULT_LIMIT);
 
-            let mut entries: Vec<(String, ToolInfo)> = self.tools.clone().into_iter().collect();
-            entries.sort_by(|a, b| a.0.cmp(&b.0));
+        if limit == 0 {
+            return Err(FunctionCallError::RespondToModel(
+                "limit must be greater than zero".to_string(),
+            ));
+        }
 
-            let tools = if entries.is_empty() {
-                Vec::new()
-            } else {
-                let documents: Vec<Document<usize>> = entries
-                    .iter()
-                    .enumerate()
-                    .map(|(idx, (name, info))| Document::new(idx, build_search_text(name, info)))
-                    .collect();
-                let search_engine =
-                    SearchEngineBuilder::<usize>::with_documents(Language::English, documents)
-                        .build();
-                let results = search_engine.search(query, limit);
+        let mut entries: Vec<(String, ToolInfo)> = self.tools.clone().into_iter().collect();
+        entries.sort_by(|a, b| a.0.cmp(&b.0));
 
-                collect_tool_search_output_tools(
-                    results
-                        .into_iter()
-                        .filter_map(|result| entries.get(result.document.id))
-                        .map(|(_name, tool)| ToolSearchResultSource {
-                            tool_namespace: tool.tool_namespace.as_str(),
-                            tool_name: tool.tool_name.as_str(),
-                            tool: &tool.tool,
-                            connector_name: tool.connector_name.as_deref(),
-                            connector_description: tool.connector_description.as_deref(),
-                        }),
-                )
-                .map_err(|err| {
-                    FunctionCallError::Fatal(format!(
-                        "failed to encode {TOOL_SEARCH_TOOL_NAME} output: {err}"
-                    ))
-                })?
-            };
+        if entries.is_empty() {
+            return Ok(ToolSearchOutput { tools: Vec::new() });
+        }
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(ToolSearchOutput { tools }),
-            })
-        })
+        let documents: Vec<Document<usize>> = entries
+            .iter()
+            .enumerate()
+            .map(|(idx, (name, info))| Document::new(idx, build_search_text(name, info)))
+            .collect();
+        let search_engine =
+            SearchEngineBuilder::<usize>::with_documents(Language::English, documents).build();
+        let results = search_engine.search(query, limit);
+
+        let tools = collect_tool_search_output_tools(
+            results
+                .into_iter()
+                .filter_map(|result| entries.get(result.document.id))
+                .map(|(_name, tool)| ToolSearchResultSource {
+                    tool_namespace: tool.tool_namespace.as_str(),
+                    tool_name: tool.tool_name.as_str(),
+                    tool: &tool.tool,
+                    connector_name: tool.connector_name.as_deref(),
+                    connector_description: tool.connector_description.as_deref(),
+                }),
+        )
+        .map_err(|err| {
+            FunctionCallError::Fatal(format!(
+                "failed to encode {TOOL_SEARCH_TOOL_NAME} output: {err}"
+            ))
+        })?;
+
+        Ok(ToolSearchOutput { tools })
     }
 }
 

codex-rs/core/src/tools/handlers/tool_suggest.rs

@@ -22,145 +22,135 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
-use futures::future::BoxFuture;
 
 pub struct ToolSuggestHandler;
 
 impl ToolHandler for ToolSuggestHandler {
+    type Output = FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                payload,
-                session,
-                turn,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            payload,
+            session,
+            turn,
+            call_id,
+            ..
+        } = invocation;
 
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::Fatal(format!(
-                        "{TOOL_SUGGEST_TOOL_NAME} handler received unsupported payload"
-                    )));
-                }
-            };
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::Fatal(format!(
+                    "{TOOL_SUGGEST_TOOL_NAME} handler received unsupported payload"
+                )));
+            }
+        };
 
-            let args: ToolSuggestArgs = parse_arguments(&arguments)?;
-            let suggest_reason = args.suggest_reason.trim();
-            if suggest_reason.is_empty() {
-                return Err(FunctionCallError::RespondToModel(
-                    "suggest_reason must not be empty".to_string(),
-                ));
-            }
-            if args.action_type != DiscoverableToolAction::Install {
-                return Err(FunctionCallError::RespondToModel(
-                    "tool suggestions currently support only action_type=\"install\"".to_string(),
-                ));
-            }
-            if args.tool_type == DiscoverableToolType::Plugin
-                && turn.app_server_client_name.as_deref() == Some("codex-tui")
-            {
-                return Err(FunctionCallError::RespondToModel(
-                    "plugin tool suggestions are not available in codex-tui yet".to_string(),
-                ));
-            }
+        let args: ToolSuggestArgs = parse_arguments(&arguments)?;
+        let suggest_reason = args.suggest_reason.trim();
+        if suggest_reason.is_empty() {
+            return Err(FunctionCallError::RespondToModel(
+                "suggest_reason must not be empty".to_string(),
+            ));
+        }
+        if args.action_type != DiscoverableToolAction::Install {
+            return Err(FunctionCallError::RespondToModel(
+                "tool suggestions currently support only action_type=\"install\"".to_string(),
+            ));
+        }
+        if args.tool_type == DiscoverableToolType::Plugin
+            && turn.app_server_client_name.as_deref() == Some("codex-tui")
+        {
+            return Err(FunctionCallError::RespondToModel(
+                "plugin tool suggestions are not available in codex-tui yet".to_string(),
+            ));
+        }
 
-            let auth = session.services.auth_manager.auth().await;
-            let manager = session.services.mcp_connection_manager.read().await;
-            let mcp_tools = manager.list_all_tools().await;
-            drop(manager);
-            let accessible_connectors = connectors::with_app_enabled_state(
-                connectors::accessible_connectors_from_mcp_tools(&mcp_tools),
-                &turn.config,
-            );
-            let discoverable_tools = connectors::list_tool_suggest_discoverable_tools_with_auth(
-                &turn.config,
-                auth.as_ref(),
-                &accessible_connectors,
+        let auth = session.services.auth_manager.auth().await;
+        let manager = session.services.mcp_connection_manager.read().await;
+        let mcp_tools = manager.list_all_tools().await;
+        drop(manager);
+        let accessible_connectors = connectors::with_app_enabled_state(
+            connectors::accessible_connectors_from_mcp_tools(&mcp_tools),
+            &turn.config,
+        );
+        let discoverable_tools = connectors::list_tool_suggest_discoverable_tools_with_auth(
+            &turn.config,
+            auth.as_ref(),
+            &accessible_connectors,
+        )
+        .await
+        .map(|discoverable_tools| {
+            filter_tool_suggest_discoverable_tools_for_client(
+                discoverable_tools,
+                turn.app_server_client_name.as_deref(),
             )
-            .await
-            .map(|discoverable_tools| {
-                filter_tool_suggest_discoverable_tools_for_client(
-                    discoverable_tools,
-                    turn.app_server_client_name.as_deref(),
-                )
-            })
-            .map_err(|err| {
-                FunctionCallError::RespondToModel(format!(
-                    "tool suggestions are unavailable right now: {err}"
-                ))
-            })?;
-
-            let tool = discoverable_tools
-                .into_iter()
-                .find(|tool| tool.tool_type() == args.tool_type && tool.id() == args.tool_id)
-                .ok_or_else(|| {
-                    FunctionCallError::RespondToModel(format!(
-                        "tool_id must match one of the discoverable tools exposed by {TOOL_SUGGEST_TOOL_NAME}"
-                    ))
-                })?;
-
-            let request_id = RequestId::String(format!("tool_suggestion_{call_id}").into());
-            let params = build_tool_suggestion_elicitation_request(
-                CODEX_APPS_MCP_SERVER_NAME,
-                session.conversation_id.to_string(),
-                turn.sub_id.clone(),
-                &args,
-                suggest_reason,
-                &tool,
-            );
-            let response = session
-                .request_mcp_server_elicitation(turn.as_ref(), request_id, params)
-                .await;
-            let user_confirmed = response
-                .as_ref()
-                .is_some_and(|response| response.action == ElicitationAction::Accept);
-
-            let completed = if user_confirmed {
-                verify_tool_suggestion_completed(&session, &turn, &tool, auth.as_ref()).await
-            } else {
-                false
-            };
-
-            if completed && let DiscoverableTool::Connector(connector) = &tool {
-                session
-                    .merge_connector_selection(HashSet::from([connector.id.clone()]))
-                    .await;
-            }
-
-            let content = serde_json::to_string(&ToolSuggestResult {
-                completed,
-                user_confirmed,
-                tool_type: args.tool_type,
-                action_type: args.action_type,
-                tool_id: tool.id().to_string(),
-                tool_name: tool.name().to_string(),
-                suggest_reason: suggest_reason.to_string(),
-            })
-            .map_err(|err| {
-                FunctionCallError::Fatal(format!(
-                    "failed to serialize {TOOL_SUGGEST_TOOL_NAME} response: {err}"
-                ))
-            })?;
-
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(FunctionToolOutput::from_text(content, Some(true))),
-            })
         })
+        .map_err(|err| {
+            FunctionCallError::RespondToModel(format!(
+                "tool suggestions are unavailable right now: {err}"
+            ))
+        })?;
+
+        let tool = discoverable_tools
+            .into_iter()
+            .find(|tool| tool.tool_type() == args.tool_type && tool.id() == args.tool_id)
+            .ok_or_else(|| {
+                FunctionCallError::RespondToModel(format!(
+                    "tool_id must match one of the discoverable tools exposed by {TOOL_SUGGEST_TOOL_NAME}"
+                ))
+            })?;
+
+        let request_id = RequestId::String(format!("tool_suggestion_{call_id}").into());
+        let params = build_tool_suggestion_elicitation_request(
+            CODEX_APPS_MCP_SERVER_NAME,
+            session.conversation_id.to_string(),
+            turn.sub_id.clone(),
+            &args,
+            suggest_reason,
+            &tool,
+        );
+        let response = session
+            .request_mcp_server_elicitation(turn.as_ref(), request_id, params)
+            .await;
+        let user_confirmed = response
+            .as_ref()
+            .is_some_and(|response| response.action == ElicitationAction::Accept);
+
+        let completed = if user_confirmed {
+            verify_tool_suggestion_completed(&session, &turn, &tool, auth.as_ref()).await
+        } else {
+            false
+        };
+
+        if completed && let DiscoverableTool::Connector(connector) = &tool {
+            session
+                .merge_connector_selection(HashSet::from([connector.id.clone()]))
+                .await;
+        }
+
+        let content = serde_json::to_string(&ToolSuggestResult {
+            completed,
+            user_confirmed,
+            tool_type: args.tool_type,
+            action_type: args.action_type,
+            tool_id: tool.id().to_string(),
+            tool_name: tool.name().to_string(),
+            suggest_reason: suggest_reason.to_string(),
+        })
+        .map_err(|err| {
+            FunctionCallError::Fatal(format!(
+                "failed to serialize {TOOL_SUGGEST_TOOL_NAME} response: {err}"
+            ))
+        })?;
+
+        Ok(FunctionToolOutput::from_text(content, Some(true)))
     }
 }
 

codex-rs/core/src/tools/handlers/unified_exec.rs

@@ -14,7 +14,6 @@ use crate::tools::handlers::normalize_and_validate_additional_permissions;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::handlers::resolve_workdir_base_path;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolHandler;
@@ -31,7 +30,6 @@ use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::TerminalInteractionEvent;
 use codex_shell_command::is_safe_command::is_known_safe_command;
 use codex_tools::UnifiedExecShellMode;
-use futures::future::BoxFuture;
 use serde::Deserialize;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -88,6 +86,8 @@ fn default_tty() -> bool {
 }
 
 impl ToolHandler for UnifiedExecHandler {
+    type Output = ExecCommandToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
@@ -96,7 +96,7 @@ impl ToolHandler for UnifiedExecHandler {
         matches!(payload, ToolPayload::Function { .. })
     }
 
-    fn is_mutating(&self, invocation: &ToolInvocation) -> bool {
+    async fn is_mutating(&self, invocation: &ToolInvocation) -> bool {
         let ToolPayload::Function { arguments } = &invocation.payload else {
             tracing::error!(
                 "This should never happen, invocation payload is wrong: {:?}",
@@ -156,226 +156,211 @@ impl ToolHandler for UnifiedExecHandler {
         })
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let ToolInvocation {
-                session,
-                turn,
-                tracker,
-                call_id,
-                tool_name,
-                payload,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        let ToolInvocation {
+            session,
+            turn,
+            tracker,
+            call_id,
+            tool_name,
+            payload,
+            ..
+        } = invocation;
 
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "unified_exec handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
+                return Err(FunctionCallError::RespondToModel(
+                    "unified_exec handler received unsupported payload".to_string(),
+                ));
+            }
+        };
 
-            let manager: &UnifiedExecProcessManager = &session.services.unified_exec_manager;
-            let context = UnifiedExecContext::new(session.clone(), turn.clone(), call_id.clone());
+        let manager: &UnifiedExecProcessManager = &session.services.unified_exec_manager;
+        let context = UnifiedExecContext::new(session.clone(), turn.clone(), call_id.clone());
 
-            let response = match tool_name.as_str() {
-                "exec_command" => {
-                    let cwd = resolve_workdir_base_path(&arguments, context.turn.cwd.as_path())?;
-                    let args: ExecCommandArgs =
-                        parse_arguments_with_base_path(&arguments, cwd.as_path())?;
-                    let workdir = context.turn.resolve_path(args.workdir.clone());
-                    maybe_emit_implicit_skill_invocation(
-                        session.as_ref(),
-                        context.turn.as_ref(),
-                        &args.cmd,
-                        &workdir,
+        let response = match tool_name.as_str() {
+            "exec_command" => {
+                let cwd = resolve_workdir_base_path(&arguments, context.turn.cwd.as_path())?;
+                let args: ExecCommandArgs =
+                    parse_arguments_with_base_path(&arguments, cwd.as_path())?;
+                let workdir = context.turn.resolve_path(args.workdir.clone());
+                maybe_emit_implicit_skill_invocation(
+                    session.as_ref(),
+                    context.turn.as_ref(),
+                    &args.cmd,
+                    &workdir,
+                )
+                .await;
+                let process_id = manager.allocate_process_id().await;
+                let command = get_command(
+                    &args,
+                    session.user_shell(),
+                    &turn.tools_config.unified_exec_shell_mode,
+                    turn.tools_config.allow_login_shell,
+                )
+                .map_err(FunctionCallError::RespondToModel)?;
+                let command_for_display = codex_shell_command::parse_command::shlex_join(&command);
+
+                let ExecCommandArgs {
+                    workdir,
+                    tty,
+                    yield_time_ms,
+                    max_output_tokens,
+                    sandbox_permissions,
+                    additional_permissions,
+                    justification,
+                    prefix_rule,
+                    ..
+                } = args;
+
+                let exec_permission_approvals_enabled =
+                    session.features().enabled(Feature::ExecPermissionApprovals);
+                let requested_additional_permissions = additional_permissions.clone();
+                let effective_additional_permissions = apply_granted_turn_permissions(
+                    context.session.as_ref(),
+                    sandbox_permissions,
+                    additional_permissions,
+                )
+                .await;
+                let additional_permissions_allowed = exec_permission_approvals_enabled
+                    || (session.features().enabled(Feature::RequestPermissionsTool)
+                        && effective_additional_permissions.permissions_preapproved);
+
+                // Sticky turn permissions have already been approved, so they should
+                // continue through the normal exec approval flow for the command.
+                if effective_additional_permissions
+                    .sandbox_permissions
+                    .requests_sandbox_override()
+                    && !effective_additional_permissions.permissions_preapproved
+                    && !matches!(
+                        context.turn.approval_policy.value(),
+                        codex_protocol::protocol::AskForApproval::OnRequest
                     )
-                    .await;
-                    let process_id = manager.allocate_process_id().await;
-                    let command = get_command(
-                        &args,
-                        session.user_shell(),
-                        &turn.tools_config.unified_exec_shell_mode,
-                        turn.tools_config.allow_login_shell,
-                    )
-                    .map_err(FunctionCallError::RespondToModel)?;
-                    let command_for_display =
-                        codex_shell_command::parse_command::shlex_join(&command);
-
-                    let ExecCommandArgs {
-                        workdir,
-                        tty,
-                        yield_time_ms,
-                        max_output_tokens,
-                        sandbox_permissions,
-                        additional_permissions,
-                        justification,
-                        prefix_rule,
-                        ..
-                    } = args;
-
-                    let exec_permission_approvals_enabled =
-                        session.features().enabled(Feature::ExecPermissionApprovals);
-                    let requested_additional_permissions = additional_permissions.clone();
-                    let effective_additional_permissions = apply_granted_turn_permissions(
-                        context.session.as_ref(),
-                        sandbox_permissions,
-                        additional_permissions,
-                    )
-                    .await;
-                    let additional_permissions_allowed = exec_permission_approvals_enabled
-                        || (session.features().enabled(Feature::RequestPermissionsTool)
-                            && effective_additional_permissions.permissions_preapproved);
-
-                    // Sticky turn permissions have already been approved, so they should
-                    // continue through the normal exec approval flow for the command.
-                    if effective_additional_permissions
-                        .sandbox_permissions
-                        .requests_sandbox_override()
-                        && !effective_additional_permissions.permissions_preapproved
-                        && !matches!(
-                            context.turn.approval_policy.value(),
-                            codex_protocol::protocol::AskForApproval::OnRequest
-                        )
-                    {
-                        let approval_policy = context.turn.approval_policy.value();
-                        manager.release_process_id(process_id).await;
-                        return Err(FunctionCallError::RespondToModel(format!(
-                            "approval policy is {approval_policy:?}; reject command — you cannot ask for escalated permissions if the approval policy is {approval_policy:?}"
-                        )));
-                    }
-
-                    let workdir = workdir.filter(|value| !value.is_empty());
-
-                    let workdir = workdir.map(|dir| context.turn.resolve_path(Some(dir)));
-                    let cwd = workdir.clone().unwrap_or(cwd);
-                    let normalized_additional_permissions = match implicit_granted_permissions(
-                        sandbox_permissions,
-                        requested_additional_permissions.as_ref(),
-                        &effective_additional_permissions,
-                    )
-                    .map_or_else(
-                        || {
-                            normalize_and_validate_additional_permissions(
-                                additional_permissions_allowed,
-                                context.turn.approval_policy.value(),
-                                effective_additional_permissions.sandbox_permissions,
-                                effective_additional_permissions.additional_permissions,
-                                effective_additional_permissions.permissions_preapproved,
-                                &cwd,
-                            )
-                        },
-                        |permissions| Ok(Some(permissions)),
-                    ) {
-                        Ok(normalized) => normalized,
-                        Err(err) => {
-                            manager.release_process_id(process_id).await;
-                            return Err(FunctionCallError::RespondToModel(err));
-                        }
-                    };
-
-                    if let Some(output) = intercept_apply_patch(
-                        &command,
-                        &cwd,
-                        Some(yield_time_ms),
-                        context.session.clone(),
-                        context.turn.clone(),
-                        Some(&tracker),
-                        &context.call_id,
-                        tool_name.as_str(),
-                    )
-                    .await?
-                    {
-                        manager.release_process_id(process_id).await;
-                        return Ok(AnyToolResult {
-                            call_id,
-                            payload: payload_for_result,
-                            result: Box::new(ExecCommandToolOutput {
-                                event_call_id: String::new(),
-                                chunk_id: String::new(),
-                                wall_time: std::time::Duration::ZERO,
-                                raw_output: output.into_text().into_bytes(),
-                                max_output_tokens: None,
-                                process_id: None,
-                                exit_code: None,
-                                original_token_count: None,
-                                session_command: None,
-                            }),
-                        });
-                    }
-
-                    emit_unified_exec_tty_metric(&turn.session_telemetry, tty);
-                    manager
-                        .exec_command(
-                            ExecCommandRequest {
-                                command,
-                                process_id,
-                                yield_time_ms,
-                                max_output_tokens,
-                                workdir,
-                                network: context.turn.network.clone(),
-                                tty,
-                                sandbox_permissions: effective_additional_permissions
-                                    .sandbox_permissions,
-                                additional_permissions: normalized_additional_permissions,
-                                additional_permissions_preapproved:
-                                    effective_additional_permissions.permissions_preapproved,
-                                justification,
-                                prefix_rule,
-                            },
-                            &context,
-                        )
-                        .await
-                        .map_err(|err| {
-                            FunctionCallError::RespondToModel(format!(
-                                "exec_command failed for `{command_for_display}`: {err:?}"
-                            ))
-                        })?
-                }
-                "write_stdin" => {
-                    let args: WriteStdinArgs = parse_arguments(&arguments)?;
-                    let response = manager
-                        .write_stdin(WriteStdinRequest {
-                            process_id: args.session_id,
-                            input: &args.chars,
-                            yield_time_ms: args.yield_time_ms,
-                            max_output_tokens: args.max_output_tokens,
-                        })
-                        .await
-                        .map_err(|err| {
-                            FunctionCallError::RespondToModel(format!("write_stdin failed: {err}"))
-                        })?;
-
-                    let interaction = TerminalInteractionEvent {
-                        call_id: response.event_call_id.clone(),
-                        process_id: args.session_id.to_string(),
-                        stdin: args.chars.clone(),
-                    };
-                    session
-                        .send_event(turn.as_ref(), EventMsg::TerminalInteraction(interaction))
-                        .await;
-
-                    response
-                }
-                other => {
+                {
+                    let approval_policy = context.turn.approval_policy.value();
+                    manager.release_process_id(process_id).await;
                     return Err(FunctionCallError::RespondToModel(format!(
-                        "unsupported unified exec function {other}"
+                        "approval policy is {approval_policy:?}; reject command — you cannot ask for escalated permissions if the approval policy is {approval_policy:?}"
                     )));
                 }
-            };
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(response),
-            })
-        })
+                let workdir = workdir.filter(|value| !value.is_empty());
+
+                let workdir = workdir.map(|dir| context.turn.resolve_path(Some(dir)));
+                let cwd = workdir.clone().unwrap_or(cwd);
+                let normalized_additional_permissions = match implicit_granted_permissions(
+                    sandbox_permissions,
+                    requested_additional_permissions.as_ref(),
+                    &effective_additional_permissions,
+                )
+                .map_or_else(
+                    || {
+                        normalize_and_validate_additional_permissions(
+                            additional_permissions_allowed,
+                            context.turn.approval_policy.value(),
+                            effective_additional_permissions.sandbox_permissions,
+                            effective_additional_permissions.additional_permissions,
+                            effective_additional_permissions.permissions_preapproved,
+                            &cwd,
+                        )
+                    },
+                    |permissions| Ok(Some(permissions)),
+                ) {
+                    Ok(normalized) => normalized,
+                    Err(err) => {
+                        manager.release_process_id(process_id).await;
+                        return Err(FunctionCallError::RespondToModel(err));
+                    }
+                };
+
+                if let Some(output) = intercept_apply_patch(
+                    &command,
+                    &cwd,
+                    Some(yield_time_ms),
+                    context.session.clone(),
+                    context.turn.clone(),
+                    Some(&tracker),
+                    &context.call_id,
+                    tool_name.as_str(),
+                )
+                .await?
+                {
+                    manager.release_process_id(process_id).await;
+                    return Ok(ExecCommandToolOutput {
+                        event_call_id: String::new(),
+                        chunk_id: String::new(),
+                        wall_time: std::time::Duration::ZERO,
+                        raw_output: output.into_text().into_bytes(),
+                        max_output_tokens: None,
+                        process_id: None,
+                        exit_code: None,
+                        original_token_count: None,
+                        session_command: None,
+                    });
+                }
+
+                emit_unified_exec_tty_metric(&turn.session_telemetry, tty);
+                manager
+                    .exec_command(
+                        ExecCommandRequest {
+                            command,
+                            process_id,
+                            yield_time_ms,
+                            max_output_tokens,
+                            workdir,
+                            network: context.turn.network.clone(),
+                            tty,
+                            sandbox_permissions: effective_additional_permissions
+                                .sandbox_permissions,
+                            additional_permissions: normalized_additional_permissions,
+                            additional_permissions_preapproved: effective_additional_permissions
+                                .permissions_preapproved,
+                            justification,
+                            prefix_rule,
+                        },
+                        &context,
+                    )
+                    .await
+                    .map_err(|err| {
+                        FunctionCallError::RespondToModel(format!(
+                            "exec_command failed for `{command_for_display}`: {err:?}"
+                        ))
+                    })?
+            }
+            "write_stdin" => {
+                let args: WriteStdinArgs = parse_arguments(&arguments)?;
+                let response = manager
+                    .write_stdin(WriteStdinRequest {
+                        process_id: args.session_id,
+                        input: &args.chars,
+                        yield_time_ms: args.yield_time_ms,
+                        max_output_tokens: args.max_output_tokens,
+                    })
+                    .await
+                    .map_err(|err| {
+                        FunctionCallError::RespondToModel(format!("write_stdin failed: {err}"))
+                    })?;
+
+                let interaction = TerminalInteractionEvent {
+                    call_id: response.event_call_id.clone(),
+                    process_id: args.session_id.to_string(),
+                    stdin: args.chars.clone(),
+                };
+                session
+                    .send_event(turn.as_ref(), EventMsg::TerminalInteraction(interaction))
+                    .await;
+
+                response
+            }
+            other => {
+                return Err(FunctionCallError::RespondToModel(format!(
+                    "unsupported unified exec function {other}"
+                )));
+            }
+        };
+
+        Ok(response)
     }
 }
 

codex-rs/core/src/tools/handlers/view_image.rs

@@ -15,12 +15,10 @@ use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ViewImageToolCallEvent;
-use futures::future::BoxFuture;
 
 pub struct ViewImageHandler;
 
@@ -39,136 +37,125 @@ enum ViewImageDetail {
 }
 
 impl ToolHandler for ViewImageHandler {
+    type Output = ViewImageOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            if !invocation
-                .turn
-                .model_info
-                .input_modalities
-                .contains(&InputModality::Image)
-            {
+    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        if !invocation
+            .turn
+            .model_info
+            .input_modalities
+            .contains(&InputModality::Image)
+        {
+            return Err(FunctionCallError::RespondToModel(
+                VIEW_IMAGE_UNSUPPORTED_MESSAGE.to_string(),
+            ));
+        }
+
+        let ToolInvocation {
+            session,
+            turn,
+            payload,
+            call_id,
+            ..
+        } = invocation;
+
+        let arguments = match payload {
+            ToolPayload::Function { arguments } => arguments,
+            _ => {
                 return Err(FunctionCallError::RespondToModel(
-                    VIEW_IMAGE_UNSUPPORTED_MESSAGE.to_string(),
+                    "view_image handler received unsupported payload".to_string(),
                 ));
             }
+        };
 
-            let ToolInvocation {
-                session,
-                turn,
-                payload,
-                call_id,
-                ..
-            } = invocation;
-            let payload_for_result = payload.clone();
-
-            let arguments = match payload {
-                ToolPayload::Function { arguments } => arguments,
-                _ => {
-                    return Err(FunctionCallError::RespondToModel(
-                        "view_image handler received unsupported payload".to_string(),
-                    ));
-                }
-            };
-
-            let args: ViewImageArgs = parse_arguments(&arguments)?;
-            // `view_image` accepts only its documented detail values: omit
-            // `detail` for the default path or set it to `original`.
-            // Other string values remain invalid rather than being silently
-            // reinterpreted.
-            let detail = match args.detail.as_deref() {
-                None => None,
-                Some("original") => Some(ViewImageDetail::Original),
-                Some(detail) => {
-                    return Err(FunctionCallError::RespondToModel(format!(
-                        "view_image.detail only supports `original`; omit `detail` for default resized behavior, got `{detail}`"
-                    )));
-                }
-            };
-
-            let abs_path =
-                AbsolutePathBuf::try_from(turn.resolve_path(Some(args.path))).map_err(|error| {
-                    FunctionCallError::RespondToModel(format!(
-                        "unable to resolve image path: {error}"
-                    ))
-                })?;
-
-            let metadata = turn
-                .environment
-                .get_filesystem()
-                .get_metadata(&abs_path)
-                .await
-                .map_err(|error| {
-                    FunctionCallError::RespondToModel(format!(
-                        "unable to locate image at `{}`: {error}",
-                        abs_path.display()
-                    ))
-                })?;
-
-            if !metadata.is_file {
+        let args: ViewImageArgs = parse_arguments(&arguments)?;
+        // `view_image` accepts only its documented detail values: omit
+        // `detail` for the default path or set it to `original`.
+        // Other string values remain invalid rather than being silently
+        // reinterpreted.
+        let detail = match args.detail.as_deref() {
+            None => None,
+            Some("original") => Some(ViewImageDetail::Original),
+            Some(detail) => {
                 return Err(FunctionCallError::RespondToModel(format!(
-                    "image path `{}` is not a file",
-                    abs_path.display()
+                    "view_image.detail only supports `original`; omit `detail` for default resized behavior, got `{detail}`"
                 )));
             }
-            let file_bytes = turn
-                .environment
-                .get_filesystem()
-                .read_file(&abs_path)
-                .await
-                .map_err(|error| {
-                    FunctionCallError::RespondToModel(format!(
-                        "unable to read image at `{}`: {error}",
-                        abs_path.display()
-                    ))
-                })?;
-            let event_path = abs_path.to_path_buf();
+        };
 
-            let can_request_original_detail =
-                can_request_original_image_detail(turn.features.get(), &turn.model_info);
-            let use_original_detail =
-                can_request_original_detail && matches!(detail, Some(ViewImageDetail::Original));
-            let image_mode = if use_original_detail {
-                PromptImageMode::Original
-            } else {
-                PromptImageMode::ResizeToFit
-            };
-            let image_detail = use_original_detail.then_some(ImageDetail::Original);
+        let abs_path =
+            AbsolutePathBuf::try_from(turn.resolve_path(Some(args.path))).map_err(|error| {
+                FunctionCallError::RespondToModel(format!("unable to resolve image path: {error}"))
+            })?;
 
-            let image = load_for_prompt_bytes(abs_path.as_path(), file_bytes, image_mode).map_err(
-                |error| {
-                    FunctionCallError::RespondToModel(format!(
-                        "unable to process image at `{}`: {error}",
-                        abs_path.display()
-                    ))
-                },
-            )?;
-            let image_url = image.into_data_url();
+        let metadata = turn
+            .environment
+            .get_filesystem()
+            .get_metadata(&abs_path)
+            .await
+            .map_err(|error| {
+                FunctionCallError::RespondToModel(format!(
+                    "unable to locate image at `{}`: {error}",
+                    abs_path.display()
+                ))
+            })?;
 
-            session
-                .send_event(
-                    turn.as_ref(),
-                    EventMsg::ViewImageToolCall(ViewImageToolCallEvent {
-                        call_id: call_id.clone(),
-                        path: event_path,
-                    }),
-                )
-                .await;
+        if !metadata.is_file {
+            return Err(FunctionCallError::RespondToModel(format!(
+                "image path `{}` is not a file",
+                abs_path.display()
+            )));
+        }
+        let file_bytes = turn
+            .environment
+            .get_filesystem()
+            .read_file(&abs_path)
+            .await
+            .map_err(|error| {
+                FunctionCallError::RespondToModel(format!(
+                    "unable to read image at `{}`: {error}",
+                    abs_path.display()
+                ))
+            })?;
+        let event_path = abs_path.to_path_buf();
 
-            Ok(AnyToolResult {
-                call_id,
-                payload: payload_for_result,
-                result: Box::new(ViewImageOutput {
-                    image_url,
-                    image_detail,
+        let can_request_original_detail =
+            can_request_original_image_detail(turn.features.get(), &turn.model_info);
+        let use_original_detail =
+            can_request_original_detail && matches!(detail, Some(ViewImageDetail::Original));
+        let image_mode = if use_original_detail {
+            PromptImageMode::Original
+        } else {
+            PromptImageMode::ResizeToFit
+        };
+        let image_detail = use_original_detail.then_some(ImageDetail::Original);
+
+        let image =
+            load_for_prompt_bytes(abs_path.as_path(), file_bytes, image_mode).map_err(|error| {
+                FunctionCallError::RespondToModel(format!(
+                    "unable to process image at `{}`: {error}",
+                    abs_path.display()
+                ))
+            })?;
+        let image_url = image.into_data_url();
+
+        session
+            .send_event(
+                turn.as_ref(),
+                EventMsg::ViewImageToolCall(ViewImageToolCallEvent {
+                    call_id,
+                    path: event_path,
                 }),
-            })
+            )
+            .await;
+
+        Ok(ViewImageOutput {
+            image_url,
+            image_detail,
         })
     }
 }

codex-rs/core/src/tools/registry.rs

@@ -36,6 +36,8 @@ pub enum ToolKind {
 }
 
 pub trait ToolHandler: Send + Sync {
+    type Output: ToolOutput + 'static;
+
     fn kind(&self) -> ToolKind;
 
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
@@ -51,8 +53,11 @@ pub trait ToolHandler: Send + Sync {
     /// user (through file system, OS operations, ...).
     /// This function must remains defensive and return `true` if a doubt exist on the
     /// exact effect of a ToolInvocation.
-    fn is_mutating(&self, _invocation: &ToolInvocation) -> bool {
-        false
+    fn is_mutating(
+        &self,
+        _invocation: &ToolInvocation,
+    ) -> impl std::future::Future<Output = bool> + Send {
+        async { false }
     }
 
     fn pre_tool_use_payload(&self, _invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
@@ -73,7 +78,7 @@ pub trait ToolHandler: Send + Sync {
     fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>>;
+    ) -> impl std::future::Future<Output = Result<Self::Output, FunctionCallError>> + Send;
 }
 
 pub(crate) struct AnyToolResult {
@@ -82,26 +87,7 @@ pub(crate) struct AnyToolResult {
     pub(crate) result: Box<dyn ToolOutput>,
 }
 
-impl std::fmt::Debug for AnyToolResult {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AnyToolResult")
-            .field("call_id", &self.call_id)
-            .field("payload", &self.payload)
-            .field("log_preview", &self.result.log_preview())
-            .field("success", &self.result.success_for_logging())
-            .finish()
-    }
-}
-
 impl AnyToolResult {
-    pub(crate) fn new(invocation: &ToolInvocation, result: impl ToolOutput + 'static) -> Self {
-        Self {
-            call_id: invocation.call_id.clone(),
-            payload: invocation.payload.clone(),
-            result: Box::new(result),
-        }
-    }
-
     pub(crate) fn into_response(self) -> ResponseInputItem {
         let Self {
             call_id,
@@ -120,28 +106,6 @@ impl AnyToolResult {
     }
 }
 
-impl ToolOutput for AnyToolResult {
-    fn log_preview(&self) -> String {
-        self.result.log_preview()
-    }
-
-    fn success_for_logging(&self) -> bool {
-        self.result.success_for_logging()
-    }
-
-    fn to_response_item(&self, call_id: &str, payload: &ToolPayload) -> ResponseInputItem {
-        self.result.to_response_item(call_id, payload)
-    }
-
-    fn post_tool_use_response(&self, call_id: &str, payload: &ToolPayload) -> Option<Value> {
-        self.result.post_tool_use_response(call_id, payload)
-    }
-
-    fn code_mode_result(&self, payload: &ToolPayload) -> serde_json::Value {
-        self.result.code_mode_result(payload)
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct PreToolUsePayload {
     pub(crate) command: String,
@@ -153,6 +117,68 @@ pub(crate) struct PostToolUsePayload {
     pub(crate) tool_response: Value,
 }
 
+trait AnyToolHandler: Send + Sync {
+    fn matches_kind(&self, payload: &ToolPayload) -> bool;
+
+    fn is_mutating<'a>(&'a self, invocation: &'a ToolInvocation) -> BoxFuture<'a, bool>;
+
+    fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload>;
+
+    fn post_tool_use_payload(
+        &self,
+        call_id: &str,
+        payload: &ToolPayload,
+        result: &dyn ToolOutput,
+    ) -> Option<PostToolUsePayload>;
+
+    fn handle_any<'a>(
+        &'a self,
+        invocation: ToolInvocation,
+    ) -> BoxFuture<'a, Result<AnyToolResult, FunctionCallError>>;
+}
+
+impl<T> AnyToolHandler for T
+where
+    T: ToolHandler,
+{
+    fn matches_kind(&self, payload: &ToolPayload) -> bool {
+        ToolHandler::matches_kind(self, payload)
+    }
+
+    fn is_mutating<'a>(&'a self, invocation: &'a ToolInvocation) -> BoxFuture<'a, bool> {
+        Box::pin(ToolHandler::is_mutating(self, invocation))
+    }
+
+    fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
+        ToolHandler::pre_tool_use_payload(self, invocation)
+    }
+
+    fn post_tool_use_payload(
+        &self,
+        call_id: &str,
+        payload: &ToolPayload,
+        result: &dyn ToolOutput,
+    ) -> Option<PostToolUsePayload> {
+        ToolHandler::post_tool_use_payload(self, call_id, payload, result)
+    }
+
+    fn handle_any<'a>(
+        &'a self,
+        invocation: ToolInvocation,
+    ) -> BoxFuture<'a, Result<AnyToolResult, FunctionCallError>> {
+        Box::pin(async move {
+            let call_id = invocation.call_id.clone();
+            let payload = invocation.payload.clone();
+            let output = self.handle(invocation).await?;
+            Ok(AnyToolResult {
+                call_id,
+                payload,
+                result: Box::new(output),
+            })
+        })
+    }
+}
+
 pub(crate) fn tool_handler_key(tool_name: &str, namespace: Option<&str>) -> String {
     if let Some(namespace) = namespace {
         format!("{namespace}:{tool_name}")
@@ -162,15 +188,15 @@ pub(crate) fn tool_handler_key(tool_name: &str, namespace: Option<&str>) -> Stri
 }
 
 pub struct ToolRegistry {
-    handlers: HashMap<String, Arc<dyn ToolHandler>>,
+    handlers: HashMap<String, Arc<dyn AnyToolHandler>>,
 }
 
 impl ToolRegistry {
-    fn new(handlers: HashMap<String, Arc<dyn ToolHandler>>) -> Self {
+    fn new(handlers: HashMap<String, Arc<dyn AnyToolHandler>>) -> Self {
         Self { handlers }
     }
 
-    fn handler(&self, name: &str, namespace: Option<&str>) -> Option<Arc<dyn ToolHandler>> {
+    fn handler(&self, name: &str, namespace: Option<&str>) -> Option<Arc<dyn AnyToolHandler>> {
         self.handlers
             .get(&tool_handler_key(name, namespace))
             .map(Arc::clone)
@@ -290,7 +316,7 @@ impl ToolRegistry {
             )));
         }
 
-        let is_mutating = handler.is_mutating(&invocation);
+        let is_mutating = handler.is_mutating(&invocation).await;
         let response_cell = tokio::sync::Mutex::new(None);
         let invocation_for_tool = invocation.clone();
 
@@ -312,7 +338,7 @@ impl ToolRegistry {
                             invocation_for_tool.turn.tool_call_gate.wait_ready().await;
                             tracing::trace!("tool gate released");
                         }
-                        match handler.handle(invocation_for_tool).await {
+                        match handler.handle_any(invocation_for_tool).await {
                             Ok(result) => {
                                 let preview = result.result.log_preview();
                                 let success = result.result.success_for_logging();
@@ -417,7 +443,7 @@ impl ToolRegistry {
 }
 
 pub struct ToolRegistryBuilder {
-    handlers: HashMap<String, Arc<dyn ToolHandler>>,
+    handlers: HashMap<String, Arc<dyn AnyToolHandler>>,
     specs: Vec<ConfiguredToolSpec>,
 }
 
@@ -447,7 +473,7 @@ impl ToolRegistryBuilder {
         H: ToolHandler + 'static,
     {
         let name = name.into();
-        let handler: Arc<dyn ToolHandler> = handler;
+        let handler: Arc<dyn AnyToolHandler> = handler;
         if self
             .handlers
             .insert(name.clone(), handler.clone())

codex-rs/core/src/tools/registry_tests.rs

@@ -1,26 +1,24 @@
 use super::*;
-use futures::future::BoxFuture;
 use pretty_assertions::assert_eq;
 
 struct TestHandler;
 
 impl ToolHandler for TestHandler {
+    type Output = crate::tools::context::FunctionToolOutput;
+
     fn kind(&self) -> ToolKind {
         ToolKind::Function
     }
 
-    fn handle(
-        &self,
-        _invocation: ToolInvocation,
-    ) -> BoxFuture<'_, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move { unreachable!("test handler should not be invoked") })
+    async fn handle(&self, _invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+        unreachable!("test handler should not be invoked")
     }
 }
 
 #[test]
 fn handler_looks_up_namespaced_aliases_explicitly() {
-    let plain_handler = Arc::new(TestHandler) as Arc<dyn ToolHandler>;
-    let namespaced_handler = Arc::new(TestHandler) as Arc<dyn ToolHandler>;
+    let plain_handler = Arc::new(TestHandler) as Arc<dyn AnyToolHandler>;
+    let namespaced_handler = Arc::new(TestHandler) as Arc<dyn AnyToolHandler>;
     let namespace = "mcp__codex_apps__gmail";
     let tool_name = "gmail_get_recent_emails";
     let namespaced_name = tool_handler_key(tool_name, Some(namespace));

codex-rs/core/src/tools/router_tests.rs

@@ -59,7 +59,8 @@ async fn js_repl_tools_only_blocks_direct_tool_calls() -> anyhow::Result<()> {
             ToolCallSource::Direct,
         )
         .await
-        .expect_err("direct tool calls should be blocked");
+        .err()
+        .expect("direct tool calls should be blocked");
     let FunctionCallError::RespondToModel(message) = err else {
         panic!("expected RespondToModel, got {err:?}");
     };
@@ -116,7 +117,8 @@ async fn js_repl_tools_only_allows_js_repl_source_calls() -> anyhow::Result<()>
             ToolCallSource::JsRepl,
         )
         .await
-        .expect_err("shell call with empty args should fail");
+        .err()
+        .expect("shell call with empty args should fail");
     let message = err.to_string();
     assert!(
         !message.contains("direct tool calls are disabled"),

codex-rs/login/src/auth/auth_tests.rs

@@ -355,10 +355,12 @@ impl ProviderAuthScript {
     fn new(tokens: &[&str]) -> std::io::Result<Self> {
         let tempdir = tempfile::tempdir()?;
         let token_file = tempdir.path().join("tokens.txt");
+        // `cmd.exe`'s `set /p` treats LF-only input as one line, so use CRLF on Windows.
+        let token_line_ending = if cfg!(windows) { "\r\n" } else { "\n" };
         let mut token_file_contents = String::new();
         for token in tokens {
             token_file_contents.push_str(token);
-            token_file_contents.push('\n');
+            token_file_contents.push_str(token_line_ending);
         }
         std::fs::write(&token_file, token_file_contents)?;
 
@@ -385,23 +387,28 @@ mv tokens.next tokens.txt
 
         #[cfg(windows)]
         let (command, args) = {
-            let script_path = tempdir.path().join("print-token.ps1");
+            let script_path = tempdir.path().join("print-token.cmd");
             std::fs::write(
                 &script_path,
-                r#"$lines = @(Get-Content -Path tokens.txt)
-if ($lines.Count -eq 0) { exit 1 }
-Write-Output $lines[0]
-$lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt
+                r#"@echo off
+setlocal EnableExtensions DisableDelayedExpansion
+set "first_line="
+<tokens.txt set /p "first_line="
+if not defined first_line exit /b 1
+setlocal EnableDelayedExpansion
+echo(!first_line!
+endlocal
+more +1 tokens.txt > tokens.next
+move /y tokens.next tokens.txt >nul
 "#,
             )?;
             (
-                "powershell.exe".to_string(),
+                "cmd.exe".to_string(),
                 vec![
-                    "-NoProfile".to_string(),
-                    "-ExecutionPolicy".to_string(),
-                    "Bypass".to_string(),
-                    "-File".to_string(),
-                    ".\\print-token.ps1".to_string(),
+                    "/d".to_string(),
+                    "/s".to_string(),
+                    "/c".to_string(),
+                    ".\\print-token.cmd".to_string(),
                 ],
             )
         };
@@ -436,13 +443,12 @@ exit 1
 
         #[cfg(windows)]
         let (command, args) = (
-            "powershell.exe".to_string(),
+            "cmd.exe".to_string(),
             vec![
-                "-NoProfile".to_string(),
-                "-ExecutionPolicy".to_string(),
-                "Bypass".to_string(),
-                "-Command".to_string(),
-                "exit 1".to_string(),
+                "/d".to_string(),
+                "/s".to_string(),
+                "/c".to_string(),
+                "exit /b 1".to_string(),
             ],
         );
 
@@ -457,8 +463,8 @@ exit 1
         serde_json::from_value(json!({
             "command": self.command,
             "args": self.args,
-            // `powershell.exe` startup can be slow on loaded Windows CI workers, so leave enough
-            // slack to avoid turning these auth-cache assertions into a process-launch timing test.
+            // Process startup can be slow on loaded Windows CI workers, so leave enough slack to
+            // avoid turning these auth-cache assertions into a process-launch timing test.
             "timeout_ms": 10_000,
             "refresh_interval_ms": 60000,
             "cwd": self.tempdir.path(),

codex-rs/tui/src/tui.rs

@@ -569,11 +569,10 @@ impl Tui {
                 terminal.invalidate_viewport();
             }
 
-            let area = terminal.viewport_area;
-
             // Update the y position for suspending so Ctrl-Z can place the cursor correctly.
             #[cfg(unix)]
             {
+                let area = terminal.viewport_area;
                 let inline_area_bottom = if self.alt_screen_active.load(Ordering::Relaxed) {
                     self.alt_saved_viewport
                         .map(|r| r.bottom().saturating_sub(1))

personal/starr/skills/codex-applied-devbox/SKILL.md

@@ -0,0 +1,328 @@
+---
+name: codex-applied-devbox
+description: Sync a local Codex worktree from `~/code/codex-worktrees/` to a mirrored path on a remote host, then run a reproducible remote build or exec command there.
+---
+
+# Codex Applied Devbox
+
+Use this skill when you want local file editing/search on your laptop, but want
+the actual build or execution to happen on a remote host such as `dev`.
+
+This skill assumes:
+
+- remote host alias: `dev`
+- local Codex worktree root: `~/code/codex-worktrees`
+- remote mirror root: `/tmp/codex-worktrees`
+
+If the box itself needs to be created, resumed, suspended, or inspected, use
+the `applied-devbox` skill first.
+
+## Objective
+
+1. Create or reuse a local worktree under `~/code/codex-worktrees/`.
+2. Mirror that worktree to the remote host under `/tmp/codex-worktrees/`.
+3. Run one configurable remote Bazel command against the mirrored copy.
+4. Keep the flow reproducible by excluding build artifacts and local repo state.
+
+## Operator Defaults
+
+When using this skill interactively, the operator should bias toward immediate
+execution over setup-heavy preflights.
+
+Default posture:
+
+- If the user asks for a specific PR or branch, create a fresh worktree first.
+- Do not spend time checking whether an equivalent worktree already exists
+  unless the user explicitly asked to reuse one.
+- Assume `dev` is reachable and run the sync directly; only debug SSH or remote
+  prereqs after the real command fails.
+- Avoid separate "can I reach the host?" or "does rsync exist remotely?"
+  checks unless there is a known problem pattern.
+- Prefer one end-to-end attempt over multiple speculative probes.
+
+In practice, that means the operator should usually do this:
+
+1. Fetch the requested PR or ref.
+2. Create a new local worktree under `~/code/codex-worktrees/`.
+3. Run `sync-worktree-and-run` immediately.
+4. Only inspect host reachability, missing tools, or conflicting paths if that
+   end-to-end run fails.
+
+### PR Fast Path
+
+For a request like "build PR 16620 on devbox", prefer this shape:
+
+```bash
+mkdir -p ~/code/codex-worktrees
+git -C ~/code/codex fetch origin pull/16620/head
+git -C ~/code/codex worktree add -b pr-16620 \
+  ~/code/codex-worktrees/pr-16620 FETCH_HEAD
+skills/codex-applied-devbox/scripts/sync-worktree-and-run \
+  ~/code/codex-worktrees/pr-16620
+```
+
+This is intentionally direct. It skips separate validation steps and lets the
+real sync/build path prove whether the environment is healthy.
+
+## Key rule for concurrent builds
+
+- Keep each worktree as its own Bazel workspace path.
+- Let Bazel derive a separate `output_base` per worktree automatically.
+- Reuse the shared caches from `.bazelrc`:
+  - `~/.cache/bazel-disk-cache`
+  - `~/.cache/bazel-repo-cache`
+  - `~/.cache/bazel-repo-contents-cache`
+- Do not force a shared `--output_base` across two live worktrees.
+
+On `dev`, this has already been validated with two mirrored worktrees:
+
+- both builds started at the same second
+- each worktree got its own Bazel server and `output_base`
+- both builds reused shared cache state and completed successfully
+
+## Script
+
+The script lives at:
+
+`skills/codex-applied-devbox/scripts/sync-worktree-and-run`
+
+Default behavior:
+
+- host: `dev`
+- local worktree root: `~/code/codex-worktrees`
+- remote mirror root: `/tmp/codex-worktrees`
+- remote command:
+  `cd codex-rs && export PATH=$HOME/code/openai/project/dotslash-gen/bin:$HOME/.local/bin:$PATH && bazel build --bes_backend= --bes_results_url= //codex-rs/cli:cli`
+- prints the exact copy-paste remote Codex Bazel run command for the mirrored checkout
+- the helper command intentionally stays on the mirrored-worktree Bazel path and uses `//codex-rs/cli:codex`
+
+Example:
+
+```bash
+skills/codex-applied-devbox/scripts/sync-worktree-and-run \
+  ~/code/codex-worktrees/my-feature
+```
+
+This will mirror:
+
+- local: `~/code/codex-worktrees/my-feature`
+- remote: `/tmp/codex-worktrees/my-feature`
+
+It will print:
+
+```bash
+ssh -t dev 'cd /tmp/codex-worktrees/my-feature/codex-rs && export PATH=$HOME/code/openai/project/dotslash-gen/bin:$HOME/.local/bin:$PATH && bazel run --bes_backend= --bes_results_url= //codex-rs/cli:codex --'
+```
+
+Custom host, remote root, and command:
+
+```bash
+skills/codex-applied-devbox/scripts/sync-worktree-and-run \
+  --host dev \
+  --remote-root /tmp/codex-worktrees \
+  --command 'cd codex-rs && export PATH=$HOME/code/openai/project/dotslash-gen/bin:$HOME/.local/bin:$PATH && bazel build --bes_backend= --bes_results_url= //codex-rs/tui:tui' \
+  ~/code/codex-worktrees/my-feature
+```
+
+## Recommended setup
+
+1. Create the local worktree from your main Codex checkout.
+
+```bash
+mkdir -p ~/code/codex-worktrees
+git -C ~/code/codex worktree add -b my-feature \
+  ~/code/codex-worktrees/my-feature origin/main
+```
+
+2. Edit locally or fetch the PR/ref you want to test.
+
+3. Sync and build remotely immediately:
+
+```bash
+skills/codex-applied-devbox/scripts/sync-worktree-and-run \
+  ~/code/codex-worktrees/my-feature
+```
+
+4. Repeat sync/build as needed after local edits.
+
+## Retrospective Notes
+
+The main friction in a real run was not rsync itself. It was operator delay
+before the first real attempt:
+
+- checking whether a matching worktree already existed before simply creating
+  the one needed for the task
+- verifying host reachability before letting the real sync prove it
+- remembering the mirrored remote path after the sync
+- hand-writing the SSH command needed to run Codex in that mirrored checkout
+- waiting through a cold Bazel build with no simple "jump in here yourself"
+  command printed by the script
+
+The current script update addresses the third and fourth issues by printing the
+exact `ssh -t ...` command for running Codex in the mirrored checkout.
+This skill update addresses the first two issues by telling the operator to
+start the end-to-end flow sooner and only investigate after an actual failure.
+
+The next improvements worth making, if you want this flow to feel faster and
+more automatic, are:
+
+- add `--pr <number>` so the script can fetch `pull/<n>/head` and create or
+  reuse `~/code/codex-worktrees/pr-<n>` itself
+- add `--tmux-window <name>` support so the remote command can start in a named
+  tmux session/window and print the exact follow/log command
+- add an optional "sync only changed files" mode driven by git status or
+  `git diff --name-only` for large worktrees
+- add an optional `--bazel-target <label>` shortcut so users do not have to
+  remember the common labels
+
+## Validated run paths on `dev`
+
+What has been verified:
+
+- `sync-worktree-and-run` can mirror the local worktree and complete a remote
+  Bazel build with:
+  `bazel build --bes_backend= --bes_results_url= //codex-rs/cli:cli`
+- on current `main`, `bazel run --bes_backend= --bes_results_url=
+  //codex-rs/cli:codex --` builds successfully on `dev`
+
+Practical note:
+
+- older pre-`#16634` checkouts could fail on `dev` when launching
+  `//codex-rs/cli:codex`; treat current `main` as the baseline before carrying
+  that older caveat forward
+
+## Bazel defaults on the devbox
+
+Use this decision rule:
+
+- Default to Bazel for remote builds in mirrored worktrees.
+- Keep the existing `.bazelrc` cache settings; they already share the useful
+  cache layers across worktrees.
+- On `dev`, clear the BES flags for routine builds:
+  `--bes_backend= --bes_results_url=`
+- Prepend both common Bazel locations to `PATH`:
+  `export PATH=$HOME/code/openai/project/dotslash-gen/bin:$HOME/.local/bin:$PATH`
+- Prefer labels that have already been validated on the host:
+  - `//codex-rs/cli:cli`
+  - `//codex-rs/tui:tui`
+  - `//codex-rs/utils/absolute-path:absolute-path`
+
+Current practical note:
+
+- older pre-`#16634` checkouts could fail on `dev` when launching
+  `//codex-rs/cli:codex`; re-test current `main` before treating that older
+  caveat as still active
+
+What is shared versus isolated:
+
+- Shared across worktrees:
+  - `~/.cache/bazel-disk-cache`
+  - `~/.cache/bazel-repo-cache`
+  - `~/.cache/bazel-repo-contents-cache`
+  - the Bazel install base under `~/.cache/bazel/_bazel_dev-user/install`
+- Still per worktree:
+  - each `output_base`
+  - each Bazel server
+  - mutable workspace-specific state under
+    `~/.cache/bazel/_bazel_dev-user/<hash>`
+
+That means this setup saves disk space compared with giving every worktree its
+own completely separate Bazel root, but it does not eliminate the large
+per-worktree `output_base` directories.
+
+## Fresh default devbox bootstrap
+
+This was validated against a fresh box created with a temporary minimal config
+override, not your personal `~/.config/applied-devbox/config.toml`.
+
+Validated sequence:
+
+1. Create a minimal config file locally and point `APPLIED_DEVBOX_CONFIG` at it.
+   An empty file is enough if you want the CLI's built-in defaults without your
+   personal apt/git/custom-setup additions.
+
+2. Create the box:
+
+```bash
+APPLIED_DEVBOX_CONFIG=/tmp/applied-devbox-default-config.toml \
+  a devbox new codex-bazel-0402-1800 \
+  --sku cpu64 \
+  --home-size 2Ti \
+  --skip-secret-setup \
+  --skip-tool-setup
+```
+
+If you expect large Bazel output trees or long-lived mirrored worktrees, prefer
+`--sku cpu64 --home-size 2Ti` over the smaller defaults.
+
+3. If the first `a devbox ssh` fails on websocket transport, establish
+   connectivity with:
+
+```bash
+APPLIED_DEVBOX_CONFIG=/tmp/applied-devbox-default-config.toml \
+  a devbox ssh codex-bazel-0402-1800 --no-ws --no-tmux -- bash -lc 'hostname && whoami'
+```
+
+After that, direct `ssh codex-bazel-0402-1800` was available on this machine.
+
+4. Install `rsync` once on the new box:
+
+```bash
+ssh codex-bazel-0402-1800 'sudo apt-get update && sudo apt-get install -y rsync'
+```
+
+5. Run the mirrored Bazel build:
+
+```bash
+skills/codex-applied-devbox/scripts/sync-worktree-and-run \
+  --host codex-bazel-0402-1800 \
+  ~/code/codex-worktrees/my-feature
+```
+
+What was validated on the fresh box:
+
+- the box came up from a default-style config override
+- the first websocket-based SSH attempt failed, but `--no-ws` succeeded
+- plain `ssh <box>` worked after the first successful `--no-ws` connection
+- `rsync` was the only package that had to be installed manually
+- Bazel was already available from the default OpenAI clone at
+  `~/code/openai/project/dotslash-gen/bin`
+- the first mirrored `//codex-rs/cli:cli` build completed successfully in
+  `68.24s`
+
+## Sync exclusions
+
+The script excludes:
+
+- `.git`
+- `.sl`
+- `.jj`
+- `target`
+- `node_modules`
+- `.venv`, `venv`
+- `dist`, `build`, `.next`
+- `.pytest_cache`, `.mypy_cache`, `__pycache__`, `.ruff_cache`
+- `.DS_Store`
+
+## Cleanup
+
+Remove a stale remote mirror:
+
+```bash
+ssh dev 'rm -rf /tmp/codex-worktrees/my-feature'
+```
+
+Remove the local worktree when finished:
+
+```bash
+git -C ~/code/codex worktree remove ~/code/codex-worktrees/my-feature
+git -C ~/code/codex branch -D my-feature
+```
+
+## Guardrails
+
+- Treat the local worktree as the editing source of truth.
+- Treat the mirrored remote copy as disposable build state.
+- Do not sync `.git` or build outputs.
+- Keep the local worktree under `~/code/codex-worktrees/` so the mirror path is
+  stable and easy to clean up.

personal/starr/skills/codex-applied-devbox/scripts/sync-worktree-and-run

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  sync-worktree-and-run [options] <local-worktree>
+
+Sync a local Codex worktree to a mirrored path on a remote host, then run a
+command there.
+
+Options:
+  --host <host>               Remote SSH host. Default: dev
+  --local-root <path>         Expected local worktree root.
+                              Default: ~/code/codex-worktrees
+  --remote-root <path>        Remote mirror root.
+                              Default: /tmp/codex-worktrees
+  --command <command>         Command to run on the remote copy.
+                              Default: cd codex-rs &&
+                              export PATH=$HOME/code/openai/project/dotslash-gen/bin:
+                              $HOME/.local/bin:$PATH &&
+                              bazel build --bes_backend= --bes_results_url=
+                              //codex-rs/cli:cli
+  Prints the exact Bazel-backed Codex SSH run command for the mirrored
+  checkout on every run.
+  -h, --help                  Show this help text.
+EOF
+}
+
+shell_single_quote() {
+  local value="$1"
+  value=${value//\'/\'\"\'\"\'}
+  printf "'%s'" "$value"
+}
+
+host="dev"
+local_root="$HOME/code/codex-worktrees"
+remote_root="/tmp/codex-worktrees"
+command_to_run='cd codex-rs && export PATH=$HOME/code/openai/project/dotslash-gen/bin:$HOME/.local/bin:$PATH && bazel build --bes_backend= --bes_results_url= //codex-rs/cli:cli'
+local_worktree=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --host)
+      host="$2"
+      shift 2
+      ;;
+    --local-root)
+      local_root="$2"
+      shift 2
+      ;;
+    --remote-root)
+      remote_root="$2"
+      shift 2
+      ;;
+    --command)
+      command_to_run="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    -*)
+      echo "unknown option: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+    *)
+      if [[ -n "$local_worktree" ]]; then
+        echo "expected exactly one local worktree path" >&2
+        usage >&2
+        exit 2
+      fi
+      local_worktree="$1"
+      shift
+      ;;
+  esac
+done
+
+if [[ -z "$local_worktree" ]]; then
+  echo "missing local worktree path" >&2
+  usage >&2
+  exit 2
+fi
+
+if [[ ! -d "$local_worktree" ]]; then
+  echo "local worktree does not exist: $local_worktree" >&2
+  exit 1
+fi
+
+if [[ ! -d "$local_root" ]]; then
+  echo "local root does not exist: $local_root" >&2
+  exit 1
+fi
+
+local_root_abs="$(cd "$local_root" && pwd -P)"
+local_worktree_abs="$(cd "$local_worktree" && pwd -P)"
+
+case "$local_worktree_abs/" in
+  "$local_root_abs"/*)
+    relative_path="${local_worktree_abs#$local_root_abs/}"
+    ;;
+  *)
+    echo "local worktree must live under local root: $local_root_abs" >&2
+    exit 1
+    ;;
+esac
+
+remote_worktree="${remote_root%/}/$relative_path"
+remote_codex_dir="${remote_worktree%/}/codex-rs"
+remote_codex_run_command="cd $remote_codex_dir && export PATH=\$HOME/code/openai/project/dotslash-gen/bin:\$HOME/.local/bin:\$PATH && bazel run --bes_backend= --bes_results_url= //codex-rs/cli:codex --"
+
+echo "# Shared-worktree Bazel Codex run command:"
+echo "ssh -t $host $(shell_single_quote "$remote_codex_run_command")"
+
+if ! command -v rsync >/dev/null 2>&1; then
+  echo "local rsync is not installed or not on PATH" >&2
+  exit 1
+fi
+
+if ! ssh "$host" 'command -v rsync >/dev/null 2>&1'; then
+  echo "remote rsync is not installed on $host" >&2
+  echo "try: ssh $host 'sudo apt-get update && sudo apt-get install -y rsync'" >&2
+  exit 1
+fi
+
+ssh "$host" bash -s -- "$remote_worktree" <<'EOF'
+set -euo pipefail
+remote_worktree="$1"
+mkdir -p "$remote_worktree"
+EOF
+
+rsync -a --delete \
+  --exclude='.git' \
+  --exclude='.sl' \
+  --exclude='.jj' \
+  --exclude='target' \
+  --exclude='node_modules' \
+  --exclude='.venv' \
+  --exclude='venv' \
+  --exclude='dist' \
+  --exclude='build' \
+  --exclude='.next' \
+  --exclude='.pytest_cache' \
+  --exclude='.mypy_cache' \
+  --exclude='__pycache__' \
+  --exclude='.ruff_cache' \
+  --exclude='.DS_Store' \
+  -e ssh \
+  "$local_worktree_abs/" \
+  "$host:$remote_worktree/"
+
+printf -v remote_worktree_q '%q' "$remote_worktree"
+printf -v command_to_run_q '%q' "$command_to_run"
+
+ssh "$host" "bash -s" <<EOF
+set -euo pipefail
+remote_worktree=$remote_worktree_q
+command_to_run=$command_to_run_q
+
+cd "\$remote_worktree"
+echo "REMOTE_PWD=\$PWD"
+eval "\$command_to_run"
+EOF