fix(agent): honor explicit web search requests

Promote explicit web-search phrasing to tool use and keep web_search/web_fetch available for that turn even when the stale web toggle is false.

tests/test_action_intents.py

@@ -49,6 +49,13 @@ def test_research_action_promotes_to_agent():
     assert message_needs_tools("can you look into GPU hosting options")
 
 
+def test_explicit_web_search_promotes_to_agent():
+    assert message_needs_tools("use web search and find a recipe for chocolate chip cookies")
+    assert message_needs_tools("do a web search for the best chocolate chip cookies")
+    assert message_needs_tools("search the web for current RTX 3090 prices")
+    assert classify_tool_intent("use web search and find a recipe").category == "web"
+
+
 def test_explanatory_calendar_questions_stay_plain_chat():
     assert not message_needs_tools("How do I add an entry to my calendar?")
     assert not message_needs_tools("What about the built-in Odysseus calendar, is that linked to email?")

tests/test_chat_route_tool_policy.py

@@ -89,6 +89,9 @@ def test_disabled_tools_does_not_bash_when_allow_bash_is_none():
     assert "allow_web_search is not None" in source, (
         "disabled_tools check must guard against allow_web_search being None"
     )
+    assert "_explicit_web_intent" in source and "not _explicit_web_intent" in source, (
+        "explicit web-search requests must override an off web toggle for that turn"
+    )
 
 
 # ── Functional tests of the disabled-tools logic ───────────────
@@ -99,6 +102,7 @@ def _build_disabled_tools(
     allow_web_search=None,
     can_use_bash=True,
     can_use_browser=True,
+    explicit_web_intent=False,
 ):
     """Replicate the disabled-tools logic from chat_stream for unit testing.
 
@@ -109,7 +113,11 @@ def _build_disabled_tools(
     # Issue #3229 fix: only disable when explicitly set to a falsy value.
     if allow_bash is not None and str(allow_bash).lower() != "true":
         disabled_tools.add("bash")
-    if allow_web_search is not None and str(allow_web_search).lower() != "true":
+    if (
+        allow_web_search is not None
+        and str(allow_web_search).lower() != "true"
+        and not explicit_web_intent
+    ):
         disabled_tools.add("web_search")
         disabled_tools.add("web_fetch")
 
@@ -148,6 +156,17 @@ def test_json_body_allow_web_search_false_disables_web():
     assert "web_fetch" in disabled
 
 
+def test_explicit_web_intent_overrides_false_web_toggle_for_turn():
+    """A stale/off web toggle must not remove web tools when the message
+    explicitly asks to use web search."""
+    disabled = _build_disabled_tools(
+        allow_web_search="false",
+        explicit_web_intent=True,
+    )
+    assert "web_search" not in disabled
+    assert "web_fetch" not in disabled
+
+
 def test_admin_user_gets_bash_enabled_by_default():
     """When allow_bash is not set and user has can_use_bash privilege,
     bash must NOT be disabled.

tests/test_tool_rag_keyword_hints.py

@@ -40,6 +40,14 @@ def test_tell_in_web_query_does_not_force_email_tools():
     assert "web_search" in tools and "web_fetch" in tools
 
 
+def test_explicit_web_search_query_gets_web_tools_without_retrieval():
+    """Explicit web-search phrasing must surface web tools even if embeddings
+    return nothing."""
+    ti = _index_without_embeddings()
+    tools = ti.get_tools_for_query("use web search and find a recipe for chocolate chip cookies")
+    assert "web_search" in tools and "web_fetch" in tools
+
+
 def test_genuine_email_query_still_gets_email_tools():
     """Removing 'tell' must not break real email intent — the actual email
     keywords still force-include the toolset."""