Struct ToolCapabilities 

pub struct ToolCapabilities {

    pub session_allow_all: Option<Arc<SessionConfirmLatch>>,
    pub memory_backend: Option<MemoryBinding>,
    pub telemetry: Option<WorkerTelemetry>,
    pub tool_register_tx: Option<UnboundedSender<Vec<Arc<dyn Tool>>>>,
    pub session_manager: Option<Arc<SessionManager>>,
    pub subagent_registry: Option<Arc<Mutex<SubagentRegistry>>>,
    pub launch_cancel: Option<CancellationToken>,
    pub event_queue: Option<Arc<EventQueue>>,
    pub delegation_parent: Option<String>,
    pub codex_parent_plan: Option<CodexExecutionPlan>,
    pub secret_prompt: Option<SecretPromptHandle>,
    pub orchestration: Option<Arc<OrchestrationRuntime>>,
    pub tool_activation: Option<ActivationCapability>,
    pub mcp_leases: Option<McpLeaseCapability>,
    pub extension_leases: Option<ExtensionLeaseCapability>,
    pub cwd: Option<PathBuf>,
    pub env: Option<ToolEnv>,
    pub env_stripped: Vec<String>,
    pub env_warned: Arc<Mutex<HashSet<String>>>,
    pub session_id: Option<String>,
    pub hook_bus: Option<Arc<HookBus>>,
    pub continuation: Option<SharedContinuation>,
}

Runtime capability handles — shared services a tool may require.

Fields

session_allow_all: Option<Arc<SessionConfirmLatch>>

Parent-session extension Confirm latch: the set of extension ids the user chose “Allow all” for. Workers share the Arc (including live updates and revokes), never a snapshot or host-global approval. This grants no activate_tools authority. None is for contexts without a parent session.

memory_backend: Option<MemoryBinding>

Host-owned note storage binding. Every context made for a chat has its chat’s: a turn’s (TurnToolContext) and a slash command’s (skills::commands::CommandChat). None is left for a context made for no chat (TurnToolContext::no_chat) and for the ones tests build by hand; there the memory tools refuse (they never derive a project from the process folder).

telemetry: Option<WorkerTelemetry>

Parent-session telemetry for the subagents this context spawns: they record at the same level through the parent’s session writer. None (manual contexts) leaves workers Off.

tool_register_tx: Option<UnboundedSender<Vec<Arc<dyn Tool>>>>

session_manager: Option<Arc<SessionManager>>

subagent_registry: Option<Arc<Mutex<SubagentRegistry>>>

launch_cancel: Option<CancellationToken>

Originating turn cancellation, pinned before tool dispatch. A late registration cannot inherit a later user’s renewed launch authority.

event_queue: Option<Arc<EventQueue>>

delegation_parent: Option<String>

Current worker handle when this context belongs to a delegated runtime. None denotes the foreground root.

codex_parent_plan: Option<CodexExecutionPlan>

Host-built foreground Codex plan for exact-model Ultra inheritance. Not a model-supplied tool parameter or an authorization grant.

secret_prompt: Option<SecretPromptHandle>

orchestration: Option<Arc<OrchestrationRuntime>>

Runtime-enforced delegation/lifecycle policy. When present, every spawn path must authorize before creating channels, threads, or provider runtimes.

tool_activation: Option<ActivationCapability>

Discovery/activation capability context (Task 17): passive catalog snapshot + retained session-set handle + host-supplied activation authority. None (default for manual fixtures and non-stream contexts) means the discovery/activation builtins fail typed and no model-initiated activation is possible.

mcp_leases: Option<McpLeaseCapability>

Session-scoped exact MCP lease capability (Task 19): exact session identity + shared runtime manager. None (default for non-stream contexts) means deferred MCP tools fail typed and start nothing.

extension_leases: Option<ExtensionLeaseCapability>

Session-scoped exact EXTENSION lease capability (Task 20): exact session identity + shared extension runtime manager. None (default for non-stream contexts) means deferred extension tools fail typed and start nothing.

cwd: Option<PathBuf>

Per-session working directory (Phase 2 daemons serve sessions from N directories in one process). None = inherit the process cwd — the only value Phase 1 ever sets, so behaviour is byte-identical.

env: Option<ToolEnv>

Per-session environment snapshot (session-identity T1). None = inherit process env. When Some, tools call env_clear().envs() so no daemon env leaks into session subprocesses.

env_stripped: Vec<String>

Names of env vars stripped as secrets (T5). Tools use this for loud notices when a command fails referencing a stripped var.

env_warned: Arc<Mutex<HashSet<String>>>

Per-name “already warned” guard (T5): prevents duplicate notices within a single session. Shared via Arc<Mutex<…>> so the same set survives across tool calls (caps are rebuilt per call in stream.rs). Poisoned-mutex recovery via into_inner.

session_id: Option<String>

Owning conversation id of the tool call, as carried on hook events. None for workers/subagents and for host contexts with no conversation. Forwarded to extension tool.call as params.session_id so a daemon-shared plugin knows its caller. Not the lease scope (tool_session_id, a random runtime id).

hook_bus: Option<Arc<HookBus>>

Extension hook bus, for the notify-only events a builtin tool sends (memory_forget: on_memory_forgotten). A worker carries its own view, which sends nothing. None wherever no bus exists; the tool then works the same and nothing is announced.

continuation: Option<SharedContinuation>

The calling chat’s rollover state, where context_checkpoint records its phase and note. The tool is one instance shared by every chat on the host and has no state of its own. None for a context with no chat: the tool refuses there. (A worker carries its own state, which is never enabled, and its registry has no such tool.)

Trait Implementations

impl Clone for ToolCapabilities

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for ToolCapabilities

fn default() -> Self

Returns the “default value” for a type.