Struct MessageSendTool 

pub struct MessageSendTool { /* private fields */ }

The message_send tool: how a run leaves a message for another agent.

Implementations

impl MessageSendTool

pub fn new(route: Arc<MailboxRoute>) -> Self

Trait Implementations

impl Tool for MessageSendTool

fn read_only(&self) -> bool

True, and it is a decision, not an oversight: sending writes one file into the user’s own owner-only store — nothing leaves the machine, nothing in the workspace changes, and the receiving side re-imposes every gate (its own permissions, interlock, outbox) on whatever the message asks. Requiring approval here would make the unattended draft-and-report shape — the reason this tool exists — impossible in exactly the read-only runs it was designed for, the same reasoning that lets outbox staging skip the approver. The guardrails are the pending cap, the duplicate brake, and the taint stamped on every message by the harness.

Read-only for the approver and permission gate — but not, despite this flag, for the planning phase: sending is a side effect on another agent, and Phase::allows would otherwise admit it because it keys on read_only. call refuses in Phase::Plan explicitly rather than turning the flag off, because turning it off would drag the approver back in and break the unattended shape above.

fn name(&self) -> &str

fn description(&self) -> &str

fn input_schema(&self) -> Value

fn capabilities(&self) -> Capabilities

Declared risk surface. The default is the conservative one for a tool nobody has classified: assume it does nothing special.

fn call<'life0, 'life1, 'async_trait>( &'life0 self, input: Value, ctx: &'life1 ToolCtx, ) -> Pin<Box<dyn Future<Output = Result<ToolOutput>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn carried_state(&self) -> Option<CarriedState>

State this tool holds that a compaction must not lose.

fn denial_remedy(&self) -> Option<String>

How the operator could make a call like the one just refused safe — one sentence appended to a trifecta denial, or None when nothing short of policy would change the answer.

fn fixed_workspace(&self) -> Option<PathBuf>

The root this tool’s relative paths actually resolve against, when the tool was constructed over a fixed directory rather than following the per-run ToolCtx workspace.

fn narrows_surface_to(&self) -> Option<Vec<String>>

Tool names this tool is currently restricting the surface to, if it is restricting it at all.

fn forget_conversation_state(&self)

Drop state that belonged to the conversation that just ended.

fn spec(&self) -> ToolSpec