Best possible solution:

Refresh the branch against current main, keep the snapshot-boundary design, preserve current metadata contracts, replace unsafe error formatting with no-throw formatting, and have maintainers explicitly accept the per-tool quarantine compatibility change.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection gives a high-confidence path: construct an AgentTool or ToolDefinition with throwing name/parameters getters and call toToolDefinitions(), createAgentSession(), or extension registerTool(); I did not execute that repro in this read-only review.

Is this the best way to solve the issue?

No as written. Snapshotting at the session/tool boundary is the right fix shape, but this implementation needs metadata preservation, no-throw error formatting, and an explicit maintainer compatibility decision first.

Full review comments:

• [P1] Preserve tool metadata in adapter snapshots — src/agents/agent-tool-definition-adapter.ts:396-400
  Current main and its adjacent test preserve prepareArguments and executionMode when toToolDefinitions() mirrors an AgentTool, but this snapshot return only carries name/label/description/parameters. A refreshed merge would silently drop argument preparation and sequential execution metadata for tools using this adapter.
  Confidence: 0.9
• [P2] Use no-throw formatting for skipped-tool errors — src/agents/sessions/tools/tool-definition-wrapper.ts:31
  The new quarantine catch falls back to String(err) for non-Error thrown values. A malformed plugin or custom tool getter can throw an object whose string conversion also throws, making the catch throw instead of skipping only the bad tool; use a no-throw formatter here and in the matching adapter helper.
  Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6830aa39eaa1.

Label justifications:

• P2: This is a bounded agent/session robustness fix with concrete blockers and compatibility review needs, but the blast radius is limited to tool-definition ingress paths.
• merge-risk: 🚨 compatibility: The branch changes malformed plugin/custom/base tool handling from fail-fast direct reads to per-tool quarantine, affecting existing plugin and session behavior.
• merge-risk: 🚨 security-boundary: The diff is meant to contain hostile tool descriptors, but unsafe error formatting can still let hostile thrown values escape the containment path.
• merge-risk: 🚨 availability: A malformed tool can still abort registration or adaptation through the PR's new catch path when stringifying a hostile thrown value fails.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦞 diamond lobster and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor proof gate does not apply to this member-authored PR, though the body includes focused local Vitest, lint, format, and autoreview proof.

PR surface:

Source +410, Tests +294. Total +704 across 9 files.

Security concerns:

• [medium] Hostile thrown value can escape quarantine logging — src/agents/sessions/tools/tool-definition-wrapper.ts:31
  A plugin-owned getter can throw a non-Error value whose string conversion throws; the new catch then throws while building the skip log message, turning a recoverable malformed-tool quarantine into a registration or adaptation failure.
  Confidence: 0.84

Acceptance criteria:

• [P1] node scripts/run-vitest.mjs run src/agents/agent-tool-definition-adapter.test.ts src/agents/sessions/tools/tool-definition-wrapper.test.ts --reporter=dot.
• [P1] git diff --check.
• [P1] .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main.

What I checked:

• Repository policy applied: Root AGENTS.md and scoped src/agents/AGENTS.md were read fully; their review guidance makes agent/session runtime, plugin API behavior, and compatibility-sensitive fail-closed changes relevant to this verdict. (AGENTS.md:10, 6830aa39eaa1)
• Current main lacks the central snapshot behavior: Current main still maps tools by directly reading tool.name, tool.label, tool.description, tool.parameters, prepareArguments, and executionMode in toToolDefinitions(). (src/agents/agent-tool-definition-adapter.ts:363, 6830aa39eaa1)
• Current main preserves adapter metadata: The current adapter preserves prepareArguments and executionMode, and the adjacent current-main test asserts that contract for sequential tools. (src/agents/agent-tool-definition-adapter.test.ts:55, 6830aa39eaa1)
• PR head drops adapter metadata: The PR-head snapshot return for toToolDefinitions() includes name, label, description, parameters, and execute, but does not carry prepareArguments or executionMode into the ToolDefinition. (src/agents/agent-tool-definition-adapter.ts:396, 1c7b5aa10a67)
• PR head unsafe error formatting: The new skipped-tool error formatter falls back to String(err), so a non-Error thrown value with hostile string conversion can escape the intended quarantine path. (src/agents/sessions/tools/tool-definition-wrapper.ts:27, 1c7b5aa10a67)
• Live PR state: Live GitHub metadata shows the PR is open, maintainer-labeled, mergeable CONFLICTING / DIRTY, and still on head 1c7b5aa. (1c7b5aa10a67)

Likely related people:

• vincentkoc: Recent current-main commits touched agent tool adapter exports, and this PR is cherry-picked from the same author's larger hardening stack. (role: recent adjacent contributor and likely follow-up owner; confidence: high; commits: b832dd27e1cc, e7e686db2d00, 815a7c0ff862; files: src/agents/agent-tool-definition-adapter.ts, src/agents/sessions/sdk.ts, src/agents/sessions/tools/tool-definition-wrapper.ts)
• steipete: GitHub history shows steipete authored the major agent runtime internalization and session tool documentation commits that shaped the affected session/tool wrapper surfaces. (role: current base surface history holder; confidence: high; commits: bb46b79d3c14, 600a57e60f1e, 60e0d2a7b910; files: src/agents/agent-tool-definition-adapter.ts, src/agents/sessions/tools/tool-definition-wrapper.ts, src/agents/sessions/extensions/loader.ts)
• fuller-stack-dev: Recent current-main history includes adjacent tool-search directory mode work in the same adapter surface and tool-schema flow. (role: adjacent tool-schema contributor; confidence: medium; commits: 965fa05df38b; files: src/agents/agent-tool-definition-adapter.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.