Bedrock Runtime provider hides deferred Desktop tools when tool search is disabled

What version of the Codex App are you using (From “About Codex” dialog)?

• Desktop app: 26.908.40834 (Sep 11, 2026)
• Remote Codex app-server: 0.154.0

What subscription do you have?

Amazon Bedrock API, using model_provider = "amazon-bedrock-runtime".

What platform is your computer?

macOS desktop client connected through Codex Desktop SSH to a Linux execution host.

What issue are you seeing?

With Codex app-server 0.154.0 and model_provider = "amazon-bedrock-runtime", a Desktop remote SSH task can have codex_app.read_thread registered as a deferred dynamic tool while neither read_thread nor tool_search is exposed to the model.

The tool exists in the task's registered dynamic tools, but there is no model-visible discovery path to load it. This prevents reading tasks referenced with @ mentions.

Model: us.openai.gpt-5.6-sol.

What steps can reproduce the bug?

1. Open a remote SSH task in Codex Desktop using the provider and model above.
2. Reference another task with an @ mention and ask Codex to read it.
3. Compare the registered dynamic tool metadata with the tools exposed to the model.

Observed metadata, reduced to relevant fields:

namespace: codex_app
read_thread:          deferLoading = true
read_thread_terminal: deferLoading omitted

The model-visible tool inventory contains codex_app.read_thread_terminal, but no read_thread and no tool_search entry point. This is an exposure/discovery failure, before any read_thread invocation or destination access check.

What is the expected behavior?

When tool search is unavailable, deferred dynamic tools should have a supported discovery or direct-call fallback. Alternatively, Desktop should expose an explicit capability limitation instead of registering tools that the model cannot reach.

Additional information

Source evidence in rust-v0.154.0

1. The Bedrock Runtime model catalog explicitly sets supports_search_tool = false for its model variants: runtime_catalog.rs, line 33.
2. search_tool_enabled() requires model_info.supports_search_tool: spec_plan.rs, lines 629 onward.
3. Dynamic tools with defer_loading are assigned ToolExposure::Deferred: dynamic.rs, lines 73 onward.
4. The final model-visible tool list skips tools whose exposure is not direct: spec_plan.rs, lines 530 onward.

Together, these conditions explain the observed missing tools in a session without an alternative discovery surface.

Questions / possible fix

The supports_search_tool = false assignment was introduced in #38470. That PR describes disabling unsupported web search, and the original catalog test was named runtime_catalog_disables_web_search_without_overriding_review_models, although this field gates tool search. Could maintainers clarify whether disabling tool search was intentional because of a separate bedrock-runtime endpoint limitation?

• If tool search is supported by that endpoint, please correct the model capability metadata.
• If it is not supported, please provide a direct-exposure fallback for deferred Desktop dynamic tools.

Related reports

• #26907 reports a similar remote-task symptom: only read_thread_terminal is exposed.
• #42973 and #40865 concern remote SSH task-tool availability and the dynamic-tool/MCP split, but retain read/list tools and may have a different cause.

This report does not establish that the AWS endpoint itself rejects tool search, or that the related reports share this root cause. It identifies the Codex client-side capability/exposure mismatch. No private task contents, host identifiers, filesystem paths, account details, or credentials are included.

Start with codex-rs/model-provider/src/amazon_bedrock/runtime_catalog.rs and the capability checks in codex-rs/core/src/tools/spec_plan.rs, then trace deferred exposure in codex-rs/core/src/tools/handlers/dynamic.rs. Compare the Bedrock capability metadata with the final model-visible tool list. Done means the intended capability is established and deferred Desktop tools have a reachable discovery or direct-call path, or the limitation is explicitly exposed.