Struct ToolRegistry 

pub struct ToolRegistry {
    pub undo: Mutex<UndoStack>,
    pub skill_registry: SkillRegistry,
    pub caps: OutputCaps,
    pub bg_registry: BgRegistry,
    /* private fields */
}

The tool registry: maps tool names to their definitions and handlers.

Fields

undo: Mutex<UndoStack>

Undo stack for file mutations.

skill_registry: SkillRegistry

Discovered skills.

caps: OutputCaps

Context-scaled output caps for all tools.

bg_registry: BgRegistry

Background process registry — tracks processes spawned with background: true. Dropped (SIGTERM all) when the session ends.

Implementations

impl ToolRegistry

pub fn new(project_root: PathBuf, max_context_tokens: usize) -> Self

Create a new registry with all built-in tools.

max_context_tokens scales all output caps (see OutputCaps).

pub fn with_trust( project_root: PathBuf, max_context_tokens: usize, trust: TrustMode, ) -> Self

Create a new registry with a specific trust mode.

pub fn with_shared_cache(self, cache: FileReadCache) -> Self

Share an existing file-read cache (e.g. from the parent agent).

Sub-agents that share the parent’s cache avoid redundant disk reads for files already loaded in the same session.

pub fn with_sandbox_policy(self, policy: SandboxPolicy) -> Self

Override the active sandbox policy.

Phase 5 PR-2 of #934. Builder-style; chains after with_trust (or new). Sub-agent dispatch uses this to install the policy produced by crate::sandbox::policy_for_agent on the child’s registry. The main agent path doesn’t call this and inherits the strict_default() seed from with_trust — byte-for-byte unchanged behavior in PR-2.

pub fn sandbox_policy(&self) -> &SandboxPolicy

Borrow the active sandbox policy. Used by the Bash dispatch path to thread the per-registry policy into crate::sandbox::build.

pub fn set_fs(&mut self, fs: Arc<dyn FileSystem + Send + Sync>)

Inject a custom FileSystem implementation.

Call this after construction to swap LocalFileSystem for SandboxedFileSystem when a sandbox slot is ready (#934).

pub fn file_read_cache(&self) -> FileReadCache

Get a clone of the Arc file-read cache for sharing with sub-agents.

pub fn last_writer_cache(&self) -> LastWriterCache

Get a clone of the last-writer cache for passing to validation.

pub fn last_bash_cache(&self) -> LastBashCache

Get a clone of the last-bash cache for passing to validation.

pub fn set_session(&self, db: Arc<Database>, session_id: String)

Attach database + session for tools that need history access.

pub fn set_mcp_manager(&self, manager: Arc<RwLock<McpManager>>)

Attach an MCP connection manager and register its tools (#662).

Called after MCP servers have connected and discovered their tools. Tool definitions are merged into the registry so the LLM can see them.

pub fn mcp_manager(&self) -> Option<Arc<RwLock<McpManager>>>

Get the MCP manager (if attached).

pub fn set_proxy_port(&self, port: Option<u16>)

Attach (or detach) the per-session HTTP CONNECT proxy port.

Called from crate::session::KodaSession::new after spawning the always-on koda_sandbox::BuiltInProxy. Pass None to detach (Bash invocations revert to unfiltered network access — only used in standalone-ToolRegistry tests; production sessions keep this set for their full lifetime). Lock-poisoning is non-fatal — we silently keep the previous value, matching the precedent set by set_mcp_manager.

pub fn proxy_port(&self) -> Option<u16>

Current proxy port, if one has been attached. Read by the Bash dispatch path; threaded into crate::sandbox::build which turns it into the env-var bouquet on the spawned Command.

pub fn set_socks5_port(&self, port: Option<u16>)

Attach (or detach) the per-session SOCKS5 proxy port. Mirrors Self::set_proxy_port — see that fn’s docs for the lock-poisoning policy.

pub fn socks5_port(&self) -> Option<u16>

Current SOCKS5 port, if one has been attached. Threaded into crate::sandbox::build which appends ALL_PROXY to the spawned Command’s env.

pub fn classify_tool_with_mcp(&self, name: &str) -> ToolEffect

Classify a tool, using MCP annotations when available.

For built-in tools, delegates to classify_tool(). For MCP tools, looks up cached annotations in the manager.

pub fn all_builtin_tool_names(&self) -> Vec<String>

Get all built-in tool names. Used by wiring tests to verify every tool is properly integrated.

pub fn has_tool(&self, name: &str) -> bool

Check whether a tool name is known.

pub fn list_skills(&self) -> Vec<(String, String, String)>

List all available skills as (name, description, source) tuples.

pub fn search_skills(&self, query: &str) -> Vec<(String, String, String)>

Search skills by query, returning (name, description, source) tuples.

pub fn get_definitions( &self, allowed: &[String], denied: &[String], ) -> Vec<ToolDefinition>

Get tool definitions, optionally filtered by allow/deny lists.

Includes MCP tool definitions if a manager is attached.

• allowed non-empty → only those tools (allowlist).
• denied non-empty → all tools except those (denylist).
• Both empty → all tools.
• If both are specified, allowlist wins (deny is ignored).

pub async fn execute( &self, name: &str, arguments: &str, sink_for_streaming: Option<(&dyn EngineSink, &str)>, caller_spawner: Option<u32>, ) -> ToolResult

Execute a tool by name with the given JSON arguments.

Empty or whitespace-only arguments are treated as {} (no args) so that tools can fall through to their own defaults instead of surfacing a raw JSON parse error. See #513.

sink_for_streaming is an optional (sink, call_id) pair. When provided, the Bash tool streams each output line as a ToolOutputLine event in real-time.