fix: clear CodeQL alerts on agent_tools tool registration

apps/api/app/mcp/dynamic_tools.py

@@ -24,7 +24,6 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from shared.services.retrieval.agent_tools import REGISTRY, ToolContext, ToolSpec
-from shared.services.retrieval.agent_tools import tools as _agent_tools_registered  # noqa: F401
 
 DbFactory = Callable[[], AsyncContextManager[AsyncSession]]
 

packages/shared-python/shared/services/retrieval/agent_explore/harness/base.py

@@ -39,4 +39,4 @@ async def run_episode(
         so concurrent tool calls (a real Cursor SDK behavior, not just a
         theoretical one — see ``harness/cursor_harness.py``) are always safe.
         """
-        ...
+        raise NotImplementedError

packages/shared-python/shared/services/retrieval/agent_explore/harness/cursor_harness.py

@@ -93,7 +93,6 @@
     ToolResult,
     load_corpus_schema_text,
 )
-from shared.services.retrieval.agent_tools import tools as _agent_tools_registered  # noqa: F401
 
 # Grace period for the underlying agent run to actually stop, after a
 # best-effort run.cancel() following a wall_clock timeout, before this

packages/shared-python/shared/services/retrieval/agent_explore/harness/openai_harness.py

@@ -77,7 +77,6 @@
 )
 from shared.services.retrieval.agent_explore.types import AgentStep, EpisodeResult
 from shared.services.retrieval.agent_tools import REGISTRY, ToolBudget, load_corpus_schema_text
-from shared.services.retrieval.agent_tools import tools as _agent_tools_registered  # noqa: F401
 
 # A tool-role message is kept in full for the turn it was produced plus this
 # many additional turns, then collapsed to a placeholder — see module

packages/shared-python/shared/services/retrieval/agent_tools/__init__.py

@@ -9,7 +9,9 @@
 The same ``REGISTRY`` is meant to be consumed by two harnesses (Phase 3):
 the API ``/mcp`` server (Cursor/Codex/Claude) and the in-process
 ``agent_explore`` tool-loop. Importing ``agent_tools.tools`` registers every
-tool as a side effect.
+tool as a side effect; this package performs that import itself (below), so
+any consumer importing a name here (e.g. ``REGISTRY``) is guaranteed a fully
+populated registry.
 """
 
 from __future__ import annotations
@@ -26,7 +28,17 @@
 )
 from shared.services.retrieval.agent_tools.schema_doc import load_corpus_schema_text
 
+# Register every ``corpus.*`` tool into ``REGISTRY`` as an import side effect:
+# each module under ``tools/`` calls ``@register_tool`` at import time. Kept
+# here — not in ``registry.py``, which the tool modules import and would
+# therefore create a cycle — so consumers importing any name from this package
+# no longer need their own side-effect import of ``tools``. ``_tools`` is
+# intentionally never referenced (listed in ``__all__`` as a deliberate
+# re-export so tooling does not flag it as unused).
+from shared.services.retrieval.agent_tools import tools as _tools
+
 __all__ = [
+    "_tools",
     "REGISTRY",
     "ToolBudget",
     "ToolContext",