perf: bound tool I/O and trim tool surface

[huytg2610]

Bounded I/O and a smaller default tool surface

Motivation

Several high-volume tools could do substantial work before their output reached the normal tool-result truncation layer. In practice, this meant a large file, PDF, or slow HTTP response could consume unnecessary memory, latency, and context budget even when the final result was eventually shortened.

At the same time, every agent turn exposed the full tool catalog by default. This increased schema and prompt size for ordinary coding tasks and made it easier for the model to reason about tools that were not relevant to the current task.

This PR moves those limits and decisions closer to the source of the data.

What changed

Bounded input handling

• Read now processes files incrementally and enforces byte limits while preserving logical line boundaries, including CRLF handling.
• WebFetch and WebSearch now enforce:
  • response byte limits;
  • a bounded redirect chain;
  • identity-only content encoding;
  • one cancellable deadline covering connection, redirects, and response-body streaming.
• PDF extraction and large-file summarization now have explicit limits for source size, extracted text, page count, chunk output, and reduce-stage input.
• Large-file redirects no longer suggest SummarizeLargeFile when that tool is not available in the active profile.

Tool profiles

The default standard profile contains the common coding tools only. Research, orchestration, and full tool surfaces are explicit opt-ins.

The selected profile is now applied consistently across:

• tool schemas sent to the provider;
• runtime dispatch;
• prompt instructions;
• web settings;
• /config validation; and
• cache keys for profile-sensitive tool results.

Existing configuration files without tool_profile now use the compact standard default. Users who need the complete legacy surface can explicitly select full.

Prompt and cache correctness

• The system prompt lists the active tool surface instead of maintaining a broad static catalog.
• Planning guidance is included only when EnterPlanMode and ExitPlanMode are active.
• Tmux guidance is included only when the corresponding registered tool is active.
• Read-only tool cache entries are invalidated before and after file mutations to avoid returning stale data during an in-flight write.
• Output truncation is bounded even when a tool result contains an unusually long path.

Design notes

The goal is not to make every tool artificially restrictive. The limits are applied at the point where input is read or streamed, before that work can become an avoidable memory, latency, or token cost.

For web tools, the request deadline is enforced over the entire operation rather than reset at each redirect. The regression suite includes a local slow-drip HTTP server to verify that a response which stalls after sending initial bytes is cancelled near the configured deadline.

Validation

• GitHub Actions CI passes on Python 3.10, 3.11, 3.12, and 3.13.
• Package smoke tests pass on Python 3.10 and 3.13.
• Focused regression coverage includes:
  • bounded file reads and CRLF boundaries;
  • oversized and compressed HTTP responses;
  • redirect and slow-drip deadline handling;
  • PDF and summarization limits;
  • tool-profile filtering and cache isolation;
  • prompt assembly and planning guidance;
  • Web API profile configuration.
• compileall and git diff --check pass.