# feat\(server\): honor withheld agent browser access in the v2 runtime · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/dbc99cb0044f121734b5aeca463f02f0a3d9b19d)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: dbc99cb0044f121734b5aeca463f02f0a3d9b19d

Requested commit: dbc99cb0044f121734b5aeca463f02f0a3d9b19d

Commit: dbc99cb0044f121734b5aeca463f02f0a3d9b19d

Tree: fd0cc538862d20b41be8f860479373040d13d704

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
feat(server): honor withheld agent browser access in the v2 runtime

Ports #7083 into the v2 session path, which replaced the v1
ProviderService where main's gate lives. Instead of withholding the whole
t3-code MCP credential — on this branch it also carries the thread
orchestration and worktree toolkits — the credential is minted without
the "preview" capability when enableAgentBrowserAccess is off, so every
preview tool call rejects while orchestration stays available.

ProviderSessionManager reads the setting at prepare time (deny on an
unreadable settings file, matching main), rotates a reused credential
whose capability set no longer reflects the setting, and the session
config now carries browserToolsAvailable so the Codex adapter keeps its
developer instructions truthful via main's parameterized instruction
builders instead of the removed constants.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

```

## Parents

- [8e123d5f761bba962aa3d5ae80daaac33af8cc67](https://git.cafe/pingdotgg/t3code/commit/8e123d5f761bba962aa3d5ae80daaac33af8cc67?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/dbc99cb0044f121734b5aeca463f02f0a3d9b19d?format=markdown)