Helpers that format MCP resource/prompt content for safe injection into the
model context. All server-origin content is wrapped with an
trust="untrusted-external" provenance marker and run through the existing
secret-scrubbing/length-bounding used elsewhere for server-controlled text.
Agent-loop tool that spawns an ephemeral SubAgent inheriting the
parent’s identity, security policy, and memory allowlist, runs a
focused prompt, and returns the response. Cron’s JobType::Agent
dispatch is the other SubAgent spawn site; both funnel through
Outbound A2A HTTP client. Holds only the reqwest client and the live config
handle — no peer list copy. Constructed once, shared by all a2a_* tools
behind an Arc.
Bundled return values from tool registry construction.
Named struct to avoid an ever-growing positional tuple that’s painful
to destructure across many callers.
Tool that runs a single prompt through an LLM and optionally validates
the response against a JSON Schema. No tools are provided to the LLM —
this is a pure text-in, text-out (or JSON-out) call.
A zeroclaw Tool backed by an MCP server tool.
The prefixed_name (e.g. filesystem__read_file) is what the agent loop
sees. The registry knows how to route it to the correct server.
Send a message to a peer on a shared channel. Bound to a single
calling agent’s alias; the tool validates every send against that
agent’s resolved peer set.
Resets a session by clearing its message history. The session key
remains valid for new messages. Useful for cleaning up stale
conversations without deleting the session entry itself.
Returns the session key and metadata for the currently active session.
Reads the session key from the TOOL_LOOP_SESSION_KEY task-local,
which is scoped around gateway and channel agent turns.
Live task tracker tool. Models call this with the COMPLETE current
todo list on every invocation (whole-list replace). The tool only
validates and normalizes; the tool-execution layer emits the
resulting TurnEvent::Plan.
Typed tool output. The LLM-facing string is derived from the structured
value exactly once, at construction, so the two can never drift. Deref to
str keeps every text read site working on the rendered form.
Re-entrant agent-spawning tools that must never be collapsed by the
per-turn duplicate-call guard: launching several with the same prompt
(redundancy, sampling, fan-out) is intentional, not an accidental
repeat. Unioned with config-provided exemptions in the tool-call loop.
Build the <available-deferred-tools> section for the system prompt.
Lists tool names with a one-line summary each (the first non-empty line
of the description, capped) so the LLM knows what is available without
consuming context window on full schemas or full docstrings. Includes an
instruction block that tells the LLM to call tool_search to activate
them.
Build the two generic MCP capability tools (mcp_resources, mcp_prompts),
including each only when the access policy admits its name. A None policy
admits both. Returned as Arc<dyn Tool> ready to register and/or expose to
delegates.
Whether the Composio tool is registered for config: compiled in and
enabled. Prompt builders consult this so the model is never told about a
tool this build does not carry.
Bounded, no-follow read of an already-delivered artifact under the workspace
uploads/ directory, for the ACP consumer that embeds the blob. The artifact
is opened once beneath its parent directory handle (cap-std, no-follow), its
size is taken from that handle, and at most MAX_DELIVER_FILE_BYTES + 1 bytes
are read from the same handle. A workspace writer that grows or replaces the
content-addressed file between the tool’s write and this read therefore cannot
cause an unbounded read, and a replacement symlink is refused, not followed.
Resolves the peer groups that include the active agent, read live from config
at call time so a config reload (membership / external_peers / channel alias /
output_modality) takes effect without rebuilding the tool registry.
One immutable, session-scoped client environment shared by shell execution
and RPC admission. Only the handles are cloned; values are neither copied
into admission state nor persisted. Eligibility is resolved from live grants.
Handle to one turn’s routing state. The orchestrator creates a fresh handle
before each run_tool_call_loop call, scopes it into TURN_ROUTING for the
duration of the loop, and reads it back after the loop completes.