Typed tool output. The LLM-facing string is derived from the structured
value exactly once, at construction, so the two can never drift. Deref to
str keeps every text read site working on the rendered form.
Closed set of runtime-resolvable option domains a tool parameter can
draw its values from. Tools declare the domain; resolution happens
where live config is visible (the runtime), so surfaces render real
selectable choices instead of free-text guessing.
Loud, actionable banner that filesystem-touching tools surface when the
active runtime uses an ephemeral workspace — e.g. a Docker container
with no host volume mount, where the workspace is a private tmpfs. In that
mode writes succeed inside the container but never reach the host and are
discarded when the session ends, and reads may return stale or empty data.
Surfacing this prevents silent data loss.
Reference implementation of the Tool::invocation_triggers matching
contract: true when trigger occurs in haystack at a word boundary.
Both are compared case-insensitively; the caller passes an
already-lowercased haystack and a lowercased trigger. A boundary is
the start/end of the string or any non-alphanumeric character
(Unicode-aware), so a trigger matches only as a whole word or phrase
(dev misses inside device, send this to hits inside please send this to marta). Boundaries and retry advancement are character-based, so
multibyte trigger or haystack text is handled without panics or
misclassification. Empty triggers never match.