Keep history extension tools out of Guardian reviews (#41861)

## What changed

- Initialize Guardian reviewer subthreads with empty extension data.
- Remove the special registration that exposed inherited read-only `history`
  tools in the Guardian tool plan.

GitOrigin-RevId: 7700f033faab125d59d11bc2d82955c67689e3c3

codex-rs/core/src/codex_delegate.rs

@@ -42,10 +42,6 @@ use codex_protocol::turn_input::TurnStartOptions;
 #[cfg(test)]
 use crate::session::completed_session_loop_termination;
 
-pub(crate) struct GuardianReadOnlyHistoryTools(
-    pub(crate) Vec<Arc<dyn for<'call> codex_tools::ToolExecutor<codex_tools::ToolCall<'call>>>>,
-);
-
 /// Start an interactive sub-Codex thread and return its runtime and IO channels.
 ///
 /// Delegates never request approvals, and the returned IO yields their public events.
@@ -85,27 +81,6 @@ pub(crate) async fn run_codex_thread_interactive(
     };
     let session_source = SessionSource::SubAgent(subagent_source.clone());
     let is_guardian_reviewer = crate::guardian::is_basic_session_source(&session_source);
-    let mut thread_extension_init = codex_extension_api::ExtensionDataInit::default();
-    if is_guardian_reviewer {
-        let history_tools = crate::tools::spec_plan::extension_tool_executors(
-            parent_session.as_ref(),
-            parent_ctx.extension_data.as_ref(),
-        )
-        .filter(|executor| {
-            let name = executor.tool_name();
-            matches!(
-                (name.namespace.as_deref(), name.name.as_str()),
-                (
-                    Some("history"),
-                    "list_windows" | "list_items" | "read_item" | "search_contents"
-                )
-            )
-        })
-        .collect::<Vec<_>>();
-        if !history_tools.is_empty() {
-            thread_extension_init.insert(GuardianReadOnlyHistoryTools(history_tools));
-        }
-    }
     let extensions = if is_guardian_reviewer {
         codex_extension_api::empty_extension_registry()
     } else {
@@ -148,7 +123,7 @@ pub(crate) async fn run_codex_thread_interactive(
         parent_rollout_thread_trace: codex_rollout_trace::ThreadTraceContext::disabled(),
         parent_trace: None,
         environment_selections: parent_environments.to_selections(),
-        thread_extension_init,
+        thread_extension_init: codex_extension_api::ExtensionDataInit::default(),
         client_mcp_extensions: parent_session.services.client_mcp_extensions.clone(),
         reserved_thread_id: None,
         analytics_events_client: Some(parent_session.services.analytics_events_client.clone()),

codex-rs/core/src/tools/spec_plan.rs

@@ -153,18 +153,6 @@ pub(crate) fn build_tool_router(
     add_core_tool_sources(&context, &mut registry);
 
     let hosted_specs = if crate::guardian::is_basic_session_source(&turn_context.session_source) {
-        if let Some(history_tools) = session
-            .services
-            .thread_extension_data
-            .get::<crate::codex_delegate::GuardianReadOnlyHistoryTools>()
-        {
-            append_extension_tool_executors(
-                turn_context,
-                model_info,
-                history_tools.0.iter().cloned(),
-                &mut registry,
-            );
-        }
         Vec::new()
     } else {
         let registered_mcp_tools = session.services.mcp_handler_cache.append_mcp_tools(