Struct CtxShapeTool 

pub struct CtxShapeTool;

Shapes the output of a host-native tool after it ran (concept K2, “shape, don’t redirect”): a host mod (Claude Code tool.call) forwards the native Bash stdout here instead of denying the call and forcing a round trip to ctx_shell. The text it rewrites gets lean-ctx’s secret redaction, and the result flows through the same dispatch pipeline as every ctx_* output (sensitivity floor, policy-pack redaction, input filters).

Host-only surface: a host extension calls it through ctx_call ($.mcp.call in Claude Code 2.1.296+ only reaches listed tools, #2089); it is never advertised, and every gate refusal on it is an error so the host keeps the native output — see dynamic_tools::INTERNAL_HOST_TOOLS.

Trait Implementations

impl McpTool for CtxShapeTool

fn produces_machine_readable(&self, _args: Option<&Map<String, Value>>) -> bool

The body replaces a native tool’s output verbatim, so the pipeline must hand it back without hints, nudges or checkpoints — after its redaction, sensitivity and filter passes, which machine-readable calls keep.

fn name(&self) -> &'static str

Tool name as registered in the MCP protocol (e.g. “ctx_tree”).

fn tool_def(&self) -> Tool

MCP tool definition including JSON schema. This replaces the corresponding entry in granular_tool_defs().

fn handle( &self, args: &Map<String, Value>, _ctx: &ToolContext, ) -> Result<ToolOutput, ErrorData>

Execute the tool. Args are the raw JSON-RPC arguments. ctx provides access to resolved paths and project state.

fn rights_name(&self) -> &'static str

The name of the handler this tool runs, for the session rights’ denied_tools (process-v1 §9): an alias names the tool it delegates to, so denying that tool denies every name it is reachable under.

fn attests_source_free(&self, _args: Option<&Map<String, Value>>) -> bool

Attestation that this invocation derives its output from the caller’s arguments and lean-ctx’s own state only — it reads no project source, provider or stored copy of one. Replay admission relies on it: an output with no captured source set is replayed under protection only when its tool attests this. The default is false: “no source was observed” is not proof, an uninstrumented reader publishes none either. Override only for a tool whose handler was read for exactly this.

fn publishes_every_source(&self, _args: Option<&Map<String, Value>>) -> bool

Declaration that this invocation reads every project source it derives output from through the admitted readers (tools::ctx_read::read_file_*), on the handler’s own thread or on workers started with TaskSpine::spawn_thread — so that each of them is published into the call’s source capture. Only then is a captured source set the WHOLE set, and only then may it authorize reuse of the result (idempotent replay, response cache, source-bound recovery copy).