feat: gate dedicated memories tools in config (#24600)

## Why

The memories extension already has dedicated `list`, `read`, `search`,
and `add_ad_hoc_note` tools, but app-server registration was still
disabled. The memories app collaborator needs an explicit config switch
so those native extension tools can be exposed intentionally, without
making ordinary memory prompt usage automatically register the dedicated
tool surface.

## What changed

- Added `[memories].dedicated_tools`, defaulting to `false`, to
`MemoriesToml` / `MemoriesConfig`.
- Regenerated `core/config.schema.json` for the new setting.
- Registered the memories extension as a `ToolContributor`, while
keeping tool contribution gated on both memories being enabled and
`dedicated_tools = true`.
- Added tests for the disabled default, the enabled dedicated-tools
path, and installer registration.

## Verification

- `just test -p codex-config -p codex-memories-extension`

codex-rs/ext/memories/src/extension.rs

@@ -32,6 +32,7 @@ impl MemoriesExtension {
 #[derive(Clone, Debug)]
 pub(crate) struct MemoriesExtensionConfig {
     pub(crate) enabled: bool,
+    pub(crate) dedicated_tools: bool,
     pub(crate) codex_home: AbsolutePathBuf,
 }
 
@@ -39,6 +40,7 @@ impl MemoriesExtensionConfig {
     fn from_config(config: &Config) -> Self {
         Self {
             enabled: config.features.enabled(Feature::MemoryTool) && config.memories.use_memories,
+            dedicated_tools: config.memories.dedicated_tools,
             codex_home: config.codex_home.clone(),
         }
     }
@@ -97,7 +99,7 @@ impl ToolContributor for MemoriesExtension {
         let Some(config) = thread_store.get::<MemoriesExtensionConfig>() else {
             return Vec::new();
         };
-        if !config.enabled {
+        if !config.enabled || !config.dedicated_tools {
             return Vec::new();
         }
 
@@ -116,7 +118,6 @@ pub fn install(
     let extension = Arc::new(MemoriesExtension::new(metrics_client));
     registry.thread_lifecycle_contributor(extension.clone());
     registry.config_contributor(extension.clone());
-    registry.prompt_contributor(extension);
-    // Keep the read/retrieval tools out of app-server until that rollout is intentional.
-    // registry.tool_contributor(extension);
+    registry.prompt_contributor(extension.clone());
+    registry.tool_contributor(extension);
 }

codex-rs/ext/memories/src/tests.rs

@@ -3,6 +3,7 @@ use std::sync::Arc;
 
 use codex_extension_api::ContextContributor;
 use codex_extension_api::ExtensionData;
+use codex_extension_api::ExtensionRegistryBuilder;
 use codex_extension_api::PromptSlot;
 use codex_extension_api::ToolCall;
 use codex_extension_api::ToolContributor;
@@ -41,6 +42,7 @@ fn tools_are_not_contributed_when_disabled() {
     let thread_store = ExtensionData::new("thread");
     thread_store.insert(MemoriesExtensionConfig {
         enabled: false,
+        dedicated_tools: true,
         codex_home: test_path_buf("/tmp/codex-home").abs(),
     });
 
@@ -52,11 +54,29 @@ fn tools_are_not_contributed_when_disabled() {
 }
 
 #[test]
-fn tools_are_contributed_when_enabled() {
+fn tools_are_not_contributed_when_dedicated_tools_disabled() {
     let extension = MemoriesExtension::default();
     let thread_store = ExtensionData::new("thread");
     thread_store.insert(MemoriesExtensionConfig {
         enabled: true,
+        dedicated_tools: false,
+        codex_home: test_path_buf("/tmp/codex-home").abs(),
+    });
+
+    assert!(
+        extension
+            .tools(&ExtensionData::new("session"), &thread_store)
+            .is_empty()
+    );
+}
+
+#[test]
+fn tools_are_contributed_when_enabled_with_dedicated_tools() {
+    let extension = MemoriesExtension::default();
+    let thread_store = ExtensionData::new("thread");
+    thread_store.insert(MemoriesExtensionConfig {
+        enabled: true,
+        dedicated_tools: true,
         codex_home: test_path_buf("/tmp/codex-home").abs(),
     });
 
@@ -77,6 +97,36 @@ fn tools_are_contributed_when_enabled() {
     );
 }
 
+#[test]
+fn install_registers_dedicated_tool_contributor() {
+    let mut builder = ExtensionRegistryBuilder::<codex_core::config::Config>::new();
+    crate::install(&mut builder, /*metrics_client*/ None);
+    let registry = builder.build();
+    let thread_store = ExtensionData::new("thread");
+    thread_store.insert(MemoriesExtensionConfig {
+        enabled: true,
+        dedicated_tools: true,
+        codex_home: test_path_buf("/tmp/codex-home").abs(),
+    });
+
+    let tool_names = registry
+        .tool_contributors()
+        .iter()
+        .flat_map(|contributor| contributor.tools(&ExtensionData::new("session"), &thread_store))
+        .map(|tool| tool.tool_name())
+        .collect::<Vec<_>>();
+
+    assert_eq!(
+        tool_names,
+        vec![
+            memory_tool_name(crate::ADD_AD_HOC_NOTE_TOOL_NAME),
+            memory_tool_name(crate::LIST_TOOL_NAME),
+            memory_tool_name(crate::READ_TOOL_NAME),
+            memory_tool_name(crate::SEARCH_TOOL_NAME),
+        ]
+    );
+}
+
 #[test]
 fn ad_hoc_tool_definition_includes_filename_contract() {
     let tool = memory_tool(
@@ -115,6 +165,7 @@ async fn prompt_contribution_uses_memory_summary_when_enabled() {
     let thread_store = ExtensionData::new("thread");
     thread_store.insert(MemoriesExtensionConfig {
         enabled: true,
+        dedicated_tools: false,
         codex_home: tempdir.path().abs(),
     });