fix(web-chat): let an operator choose the chat agent, and stop a raw web_fetch buying an LLM summary of markup

crates/openhuman-core/src/agent/session_host/builder/factory.rs

@@ -23,6 +23,14 @@ use tinytools_agent::dialect::{
 };
 
 impl OpenHumanSessionHost {
+    /// Returns whether `agent_id` resolves to a runnable definition for this
+    /// configuration. This is deliberately the same resolution path used by
+    /// [`Self::from_config_for_agent`], so configuration writers cannot save
+    /// a web-chat route that the session factory would later reject.
+    pub(crate) fn is_runnable_agent_id(config: &Config, agent_id: &str) -> bool {
+        resolve_target_definition(config, agent_id).is_ok()
+    }
+
     /// Constructs an `OpenHumanSessionHost` instance from a global system configuration.
     ///
     /// Thin wrapper around [`OpenHumanSessionHost::from_config_for_agent`] that always

crates/openhuman-core/src/agent/tinyagents/middleware/tool_output.rs

@@ -129,6 +129,37 @@ pub(crate) fn is_truncation_exempt(name: &str) -> bool {
     COMPACTION_EXEMPT_TOOLS.contains(&name) || DISCOVERY_TOOLS.contains(&name)
 }
 
+/// Whether this call is a `web_fetch` that asked for the body **as sent**
+/// (`raw: true`), following `use_skill` into the tool it wraps exactly as
+/// [`artifact_read_target`] does.
+///
+/// Such a result is exempt from the payload summarizer (step 2). `web_fetch`
+/// normally returns HTML as Markdown — `tinyjuice::compressors::html::
+/// html_to_markdown`, which drops scripts and styling — and `raw: true` turns
+/// that off, so the payload is unconverted markup. Paying a full-price,
+/// *uncached* model call to have an LLM paraphrase minified JS and CSS is the
+/// worst trade in the ladder: one observed `raw: true` fetch of a 183 KB page
+/// cost 44,561 prompt tokens, over half that turn's entire summarizer budget,
+/// to re-describe a page the same turn had already read as clean Markdown.
+///
+/// It is also the wrong answer to the question asked. A caller who wants the
+/// body as sent wants the bytes, not a summary of them; steps 3–4 still bound
+/// the result and spill the remainder to an artifact the model pages with
+/// `file_read`, which returns the real markup, losslessly and without a model
+/// call.
+fn is_raw_fetch(tool_name: &str, args: &serde_json::Value) -> bool {
+    const FETCH_TOOL: &str = "web_fetch";
+    let (name, args) = if tool_name == "use_skill" {
+        match (args.get("tool").and_then(|t| t.as_str()), args.get("args")) {
+            (Some(inner), Some(inner_args)) => (inner, inner_args),
+            _ => return false,
+        }
+    } else {
+        (tool_name, args)
+    };
+    name == FETCH_TOOL && args.get("raw").and_then(|r| r.as_bool()).unwrap_or(false)
+}
+
 /// `after_tool`: apply the semantic payload summarizer (when configured) and
 /// then the hard per-tool-result byte cap to each tool result's model-facing
 /// content, before it enters the transcript. The graph analogue of the byte cap
@@ -160,6 +191,11 @@ pub(crate) struct ToolOutputMiddleware {
     /// their calls lose the argument; any other tool with a parameter of the
     /// same name (an MCP server's, say) keeps it.
     pub(crate) summary_focus_tools: HashSet<String>,
+    /// Calls that asked `web_fetch` for the raw body, keyed by call id. Filled
+    /// in `before_tool`, where the arguments are visible, and consumed in
+    /// `after_tool`, where they are not — the same seam `artifact_reads` uses,
+    /// and for the same reason. See [`is_raw_fetch`].
+    pub(crate) raw_fetches: Mutex<std::collections::HashSet<String>>,
 }
 
 impl ToolOutputMiddleware {
@@ -251,6 +287,16 @@ impl Middleware<(), crate::agent::tinyagents::host::OpenHumanRunContext> for Too
                 reads.insert(call.id.clone(), read);
             }
         }
+        if is_raw_fetch(&call.name, &call.arguments) {
+            tracing::debug!(
+                tool = %call.name,
+                call_id = %call.id,
+                "[tinyagents::mw] raw fetch: exempting the result from the payload summarizer"
+            );
+            if let Ok(mut raw) = self.raw_fetches.lock() {
+                raw.insert(call.id.clone());
+            }
+        }
         Ok(())
     }
 
@@ -270,6 +316,13 @@ impl Middleware<(), crate::agent::tinyagents::host::OpenHumanRunContext> for Too
         // compacts it, and the byte budget persists it as a *new* artifact with
         // the same bounded preview — a loop that never reaches the data (#6284).
         // Serve it verbatim, one bounded page at a time.
+        // Consumed unconditionally so the entry cannot outlive its call, even on
+        // the artifact-read early return below.
+        let raw_fetch = self
+            .raw_fetches
+            .lock()
+            .ok()
+            .is_some_and(|mut raw| raw.remove(&call_id));
         let artifact_read = self
             .artifact_reads
             .lock()
@@ -311,7 +364,7 @@ impl Middleware<(), crate::agent::tinyagents::host::OpenHumanRunContext> for Too
             tracing::debug!(
                 tool = tool_name,
                 bytes = content.len(),
-                "[tinyagents::mw] compaction-exempt: skipping payload summarizer + tokenjuice"
+                "[tinyagents::mw] compaction-exempt: skipping tokenjuice + payload summarizer"
             );
         }
         if truncation_exempt {
@@ -386,7 +439,29 @@ impl Middleware<(), crate::agent::tinyagents::host::OpenHumanRunContext> for Too
             .and_then(|mut focus| focus.remove(&call_id));
         let wants_tinyjuice =
             self.tokenjuice_compaction_enabled || self.payload_summarizer.is_some();
-        if !compaction_exempt && wants_tinyjuice && (tool_cap.is_none() || focus.is_some()) {
+        //      A `raw: true` `web_fetch` is excluded outright, `summary_focus`
+        //      or not: it asked for the body *as sent*, which switches off the
+        //      HTML→Markdown conversion, so the payload is unconverted markup
+        //      and a summary of it is an uncached model call spent paraphrasing
+        //      minified JS. One observed such fetch cost 44,561 prompt tokens —
+        //      over half that turn's summarizer budget — to re-describe a page
+        //      the same turn had already read as clean Markdown. Step 3 still
+        //      bounds it and spills the rest to an artifact, which hands back
+        //      the real markup losslessly and for no model call. See
+        //      [`is_raw_fetch`].
+        if raw_fetch {
+            tracing::info!(
+                tool = tool_name,
+                bytes = content.len(),
+                "[tinyagents::mw] raw fetch: skipping the tinyjuice summary, \
+                 capping and spilling to an artifact instead"
+            );
+        }
+        if !raw_fetch
+            && !compaction_exempt
+            && wants_tinyjuice
+            && (tool_cap.is_none() || focus.is_some())
+        {
             // Bind a summary call to this turn only when the result is big
             // enough for TinyJuice to want one; building the child context for
             // every small result would be waste.

crates/openhuman-core/src/agent/tinyagents/middleware/tool_output_tests.rs

@@ -25,6 +25,7 @@ async fn same_tool_calls_persist_artifacts_under_distinct_call_ids() {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     };
     let mut ctx = context();
 
@@ -54,3 +55,66 @@ async fn same_tool_calls_persist_artifacts_under_distinct_call_ids() {
         "second result is deliberately oversized"
     );
 }
+
+/// `raw: true` asks `web_fetch` for the body as sent, which switches off the
+/// HTML→Markdown conversion — so the payload is unconverted markup, and handing
+/// it to the summarizer buys an uncached model call to paraphrase minified JS.
+/// One observed fetch cost 44,561 prompt tokens that way. These pin which calls
+/// earn the exemption, not what the ladder then does with them.
+#[test]
+fn only_a_raw_web_fetch_is_exempt_from_the_payload_summarizer() {
+    use serde_json::json;
+
+    assert!(is_raw_fetch(
+        "web_fetch",
+        &json!({"url": "https://x", "raw": true})
+    ));
+
+    // A converted fetch is the normal path and stays summarizer-eligible: its
+    // Markdown is prose the summarizer compresses well.
+    for args in [
+        json!({"url": "https://x"}),
+        json!({"url": "https://x", "raw": false}),
+        json!({"url": "https://x", "raw": null}),
+        // `raw` is a bool on the wire; a string is not a request for raw bytes.
+        json!({"url": "https://x", "raw": "true"}),
+    ] {
+        assert!(
+            !is_raw_fetch("web_fetch", &args),
+            "{args} is a converted fetch"
+        );
+    }
+
+    // The exemption is about `web_fetch`'s conversion, so a `raw` argument on
+    // any other tool means nothing here.
+    for tool in ["file_read", "shell", "http_request"] {
+        assert!(
+            !is_raw_fetch(tool, &json!({"raw": true})),
+            "{tool} has no HTML conversion to switch off"
+        );
+    }
+}
+
+/// `use_skill` forwards the wrapped tool's result verbatim, so a raw fetch
+/// reached through it is still a raw fetch — the same wrapper-following
+/// `artifact_read_target` does.
+#[test]
+fn a_raw_fetch_wrapped_in_use_skill_is_still_a_raw_fetch() {
+    use serde_json::json;
+
+    assert!(is_raw_fetch(
+        "use_skill",
+        &json!({"skill": "web", "tool": "web_fetch", "args": {"url": "https://x", "raw": true}})
+    ));
+    assert!(!is_raw_fetch(
+        "use_skill",
+        &json!({"skill": "web", "tool": "web_fetch", "args": {"url": "https://x"}})
+    ));
+    // A wrapper naming some other tool, and a malformed one, are not raw
+    // fetches — neither may silently inherit the exemption.
+    assert!(!is_raw_fetch(
+        "use_skill",
+        &json!({"skill": "files", "tool": "file_read", "args": {"raw": true}})
+    ));
+    assert!(!is_raw_fetch("use_skill", &json!({"raw": true})));
+}

crates/openhuman-core/src/agent/tinyagents/middleware/turn_context.rs

@@ -432,6 +432,7 @@ impl TurnContextMiddleware {
                 artifact_reads: Default::default(),
                 focus_by_call: Default::default(),
                 summary_focus_tools,
+                raw_fetches: Default::default(),
             }));
         }
         // Push the handoff LAST (so its `after_tool` runs FIRST): it observes the

crates/openhuman-core/src/agent/tinyagents/middleware_tests.rs

@@ -107,6 +107,7 @@ fn summarizer_mw(ps: Arc<dyn PayloadSummarizer>) -> ToolOutputMiddleware {
         focus_by_call: Default::default(),
         // `web_fetch` declares `summary_focus` in production.
         summary_focus_tools: ["web_fetch".to_string()].into(),
+        raw_fetches: Default::default(),
     }
 }
 
@@ -220,6 +221,7 @@ fn compaction_enabled_mw() -> ToolOutputMiddleware {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     }
 }
 
@@ -270,6 +272,7 @@ fn truncation_probe_mw() -> ToolOutputMiddleware {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     }
 }
 

crates/openhuman-core/src/agent/tinyagents/middleware_tool_output_artifact_tests.rs

@@ -24,6 +24,7 @@ fn artifact_mw(
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     }
 }
 

crates/openhuman-core/src/agent/tinyagents/middleware_tool_output_tests.rs

@@ -468,6 +468,7 @@ async fn tool_output_truncates_over_the_flat_budget() {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     };
     let mut result = tool_result("echo", &"x".repeat(5_000));
     mw.after_tool(
@@ -502,6 +503,7 @@ async fn tool_output_leaves_small_results_untouched() {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     };
     let mut result = tool_result("echo", "tiny");
     mw.after_tool(
@@ -543,6 +545,7 @@ fn tool_char_cap_reads_the_tools_own_declared_cap() {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     };
     // Tool declares its own char cap → surfaced for the per-tool truncation.
     assert_eq!(mw.tool_char_cap("big"), Some(10));
@@ -647,6 +650,36 @@ async fn a_tool_that_caps_itself_is_summarized_when_the_caller_gives_a_focus() {
     assert!(result_text(&result).contains("focused"));
 }
 
+#[tokio::test]
+async fn a_raw_web_fetch_never_prepares_a_payload_summary() {
+    let stub = StubSummarizer::replying(Ok("must remain unused".into()));
+    let mw = summarizer_mw(stub.clone());
+    let mut call = TaToolCall::new(
+        "raw-fetch",
+        "web_fetch",
+        json!({"url": "https://example.test", "raw": true}),
+    );
+    let mut ctx = ctx();
+    mw.before_tool(&mut ctx, &(), &mut call)
+        .await
+        .expect("raw fetch is recorded before execution");
+
+    let mut result = tool_result("web_fetch", &"<html>markup</html>".repeat(300));
+    let (outcome, requests) = with_module(mw.after_tool(
+        &mut ctx,
+        &(),
+        &invocation("raw-fetch", "web_fetch"),
+        &mut result,
+    ))
+    .await;
+
+    outcome.expect("raw fetch result is processed");
+    assert!(
+        !stub.was_prepared() && requests.is_empty(),
+        "raw fetches must bypass the payload summarizer and TinyJuice"
+    );
+}
+
 #[tokio::test]
 async fn tool_output_honors_a_tools_own_cap() {
     let mut tool_policies = HashMap::new();
@@ -675,6 +708,7 @@ async fn tool_output_honors_a_tools_own_cap() {
         artifact_reads: Default::default(),
         focus_by_call: Default::default(),
         summary_focus_tools: Default::default(),
+        raw_fetches: Default::default(),
     };
     let mut result = tool_result("capped", &"y".repeat(500));
     mw.after_tool(

crates/openhuman-core/src/config/ops/agent.rs

@@ -46,6 +46,16 @@ pub struct AgentSettingsPatch {
     /// Tool/action wall-clock timeout in seconds. Validated to
     /// `tool_timeout::MIN_TIMEOUT_SECS..=tool_timeout::MAX_TIMEOUT_SECS`.
     pub agent_timeout_secs: Option<u64>,
+    /// Agent the web-chat path routes a turn to (`[agent] chat_agent_id`).
+    /// `Some("")`/whitespace clears the override and reverts to the
+    /// orchestrator; `Some(id)` sets it; `None` leaves it unchanged.
+    ///
+    /// Settable over RPC and not only in the TOML because the file on disk is
+    /// not reliably the file the core reads: once a user dir is active its
+    /// per-user `config.toml` takes precedence, so a value pre-written to the
+    /// root (or to a guessed user dir) is silently ignored. Going through the
+    /// running core writes wherever `Config::save` actually points.
+    pub chat_agent_id: Option<String>,
 }
 
 /// Partial update for the agent's editable filesystem roots.
@@ -217,9 +227,32 @@ pub async fn apply_agent_settings(
                 "agent_timeout_secs must be between {MIN_TIMEOUT_SECS} and {MAX_TIMEOUT_SECS} seconds (got {timeout_secs})"
             ));
         }
+    }
+
+    if let Some(chat_agent_id) = update.chat_agent_id.as_deref() {
+        let trimmed = chat_agent_id.trim();
+        if !trimmed.is_empty()
+            && !crate::agent::OpenHumanSessionHost::is_runnable_agent_id(config, trimmed)
+        {
+            return Err(format!(
+                "chat_agent_id '{trimmed}' is not a runnable agent definition"
+            ));
+        }
+    }
+
+    if let Some(timeout_secs) = update.agent_timeout_secs {
         config.agent.agent_timeout_secs = timeout_secs;
     }
 
+    if let Some(chat_agent_id) = update.chat_agent_id {
+        let trimmed = chat_agent_id.trim();
+        config.agent.chat_agent_id = (!trimmed.is_empty()).then(|| trimmed.to_string());
+        log::debug!(
+            "[config][agent] chat_agent_id -> {:?}",
+            config.agent.chat_agent_id
+        );
+    }
+
     config.save().await.map_err(|e| e.to_string())?;
 
     let effective = crate::tools::timeout::set_tool_timeout_secs(config.agent.agent_timeout_secs);