Struct ToolCapabilities 

pub struct ToolCapabilities {

    pub memory_backend: Option<MemoryBinding>,
    pub watcher_exit_path: Option<PathBuf>,
    pub tool_register_tx: Option<UnboundedSender<Vec<Arc<dyn Tool>>>>,
    pub session_manager: Option<Arc<SessionManager>>,
    pub subagent_registry: Option<Arc<Mutex<SubagentRegistry>>>,
    pub launch_cancel: Option<CancellationToken>,
    pub event_queue: Option<Arc<EventQueue>>,
    pub delegation_parent: Option<String>,
    pub codex_parent_plan: Option<CodexExecutionPlan>,
    pub secret_prompt: Option<SecretPromptHandle>,
    pub orchestration: Option<Arc<OrchestrationRuntime>>,
    pub tool_activation: Option<ActivationCapability>,
    pub mcp_leases: Option<McpLeaseCapability>,
    pub extension_leases: Option<ExtensionLeaseCapability>,
    pub memory_context: Option<MemoryContextCapability>,
    pub cwd: Option<PathBuf>,
    pub env: Option<SessionEnv>,
    pub env_stripped: Vec<String>,
    pub env_warned: Arc<Mutex<HashSet<String>>>,
}

Runtime capability handles — shared services a tool may require.

Fields

memory_backend: Option<MemoryBinding>

Host-owned note storage binding. Runtime contexts always provide the same binding; None is reserved for manually constructed contexts. A present binding is exclusive: errors never permit legacy fallback.

watcher_exit_path: Option<PathBuf>

tool_register_tx: Option<UnboundedSender<Vec<Arc<dyn Tool>>>>

session_manager: Option<Arc<SessionManager>>

subagent_registry: Option<Arc<Mutex<SubagentRegistry>>>

launch_cancel: Option<CancellationToken>

Originating turn cancellation, pinned before tool dispatch. A late registration cannot inherit a later user’s renewed launch authority.

event_queue: Option<Arc<EventQueue>>

delegation_parent: Option<String>

Current worker handle when this context belongs to a delegated runtime. None denotes the foreground root.

codex_parent_plan: Option<CodexExecutionPlan>

Host-built foreground Codex plan for exact-model Ultra inheritance. Not a model-supplied tool parameter or an authorization grant.

secret_prompt: Option<SecretPromptHandle>

orchestration: Option<Arc<OrchestrationRuntime>>

Runtime-enforced delegation/lifecycle policy. When present, every spawn path must authorize before creating channels, threads, or provider runtimes.

tool_activation: Option<ActivationCapability>

Discovery/activation capability context (Task 17): passive catalog snapshot + retained session-set handle + host-supplied activation authority. None (default for manual fixtures and non-stream contexts) means the discovery/activation builtins fail typed and no model-initiated activation is possible.

mcp_leases: Option<McpLeaseCapability>

Session-scoped exact MCP lease capability (Task 19): exact session identity + shared runtime manager. None (default for non-stream contexts) means deferred MCP tools fail typed and start nothing.

extension_leases: Option<ExtensionLeaseCapability>

Session-scoped exact EXTENSION lease capability (Task 20): exact session identity + shared extension runtime manager. None (default for non-stream contexts) means deferred extension tools fail typed and start nothing.

memory_context: Option<MemoryContextCapability>

Session-scoped continuous-memory context capability (task A4, spec §7.2): shared per-session memory state + host-owned grant scope. None (default for non-stream contexts) means the memory_context builtin can commit nothing — lease-granting actions fail typed, while status/disable still answer deterministically Off (memory off requires no infrastructure).

cwd: Option<PathBuf>

Per-session working directory (Phase 2 daemons serve sessions from N directories in one process). None = inherit the process cwd — the only value Phase 1 ever sets, so behaviour is byte-identical.

env: Option<SessionEnv>

Per-session environment snapshot (session-identity T1). None = inherit process env. When Some, tools call env_clear().envs() so no daemon env leaks into session subprocesses.

env_stripped: Vec<String>

Names of env vars stripped as secrets (T5). Tools use this for loud notices when a command fails referencing a stripped var.

env_warned: Arc<Mutex<HashSet<String>>>

Per-name “already warned” guard (T5): prevents duplicate notices within a single session. Shared via Arc<Mutex<…>> so the same set survives across tool calls (caps are rebuilt per call in stream.rs). Poisoned-mutex recovery via into_inner.