tools

const (
	// BackendNativeGo executes a daemon-compiled Go handler.
	BackendNativeGo BackendKind = "native_go"
	// BackendExtensionHost executes through the extension host subprocess runtime.
	BackendExtensionHost BackendKind = "extension_host"
	// BackendMCP executes through daemon-owned MCP client adapters.
	BackendMCP BackendKind = "mcp"
	// BackendBridge is reserved for a later bridge adapter TechSpec.
	BackendBridge BackendKind = "bridge"
)

const (
	// ErrorCodeNotFound maps to ErrToolNotFound.
	ErrorCodeNotFound ErrorCode = "tool_not_found"
	// ErrorCodeConflict maps to ErrToolConflict.
	ErrorCodeConflict ErrorCode = "tool_conflict"
	// ErrorCodeUnavailable maps to ErrToolUnavailable.
	ErrorCodeUnavailable ErrorCode = "tool_unavailable"
	// ErrorCodeDenied maps to ErrToolDenied.
	ErrorCodeDenied ErrorCode = "tool_denied"
	// ErrorCodeApprovalRequired maps to ErrToolApprovalRequired.
	ErrorCodeApprovalRequired ErrorCode = "tool_approval_required"
	// ErrorCodeInvalidInput maps to ErrToolInvalidInput.
	ErrorCodeInvalidInput ErrorCode = "tool_invalid_input"
	// ErrorCodeResultTooLarge maps to ErrToolResultTooLarge.
	ErrorCodeResultTooLarge ErrorCode = "tool_result_too_large"
	// ErrorCodeBackendFailed maps to ErrToolBackendFailed.
	ErrorCodeBackendFailed ErrorCode = "tool_backend_failed"
	// ErrorCodeCanceled maps to ErrToolCanceled.
	ErrorCodeCanceled ErrorCode = "tool_canceled"
	// ErrorCodeTimedOut maps to ErrToolTimedOut.
	ErrorCodeTimedOut ErrorCode = "tool_timed_out"
)

const (
	// ExternalDefaultDisabled denies external sources unless explicitly granted.
	ExternalDefaultDisabled ExternalDefault = "disabled"
	// ExternalDefaultAsk allows external sources but requires approval.
	ExternalDefaultAsk ExternalDefault = "ask"
	// ExternalDefaultEnabled allows external sources subject to the ACP ceiling.
	ExternalDefaultEnabled ExternalDefault = "enabled"
)

const (
	// PermissionModeDenyAll requires explicit approval for every tool call.
	PermissionModeDenyAll PermissionMode = "deny-all"
	// PermissionModeApproveReads auto-approves read-only tools.
	PermissionModeApproveReads PermissionMode = "approve-reads"
	// PermissionModeApproveAll auto-approves otherwise allowed tools.
	PermissionModeApproveAll PermissionMode = "approve-all"
)

const (
	// ReasonIDEmpty reports an empty id.
	ReasonIDEmpty ReasonCode = "id_empty"
	// ReasonIDEmptySegment reports a missing namespace segment.
	ReasonIDEmptySegment ReasonCode = "id_empty_segment"
	// ReasonIDInvalidFormat reports a grammar violation.
	ReasonIDInvalidFormat ReasonCode = "id_invalid_format"
	// ReasonIDReservedConflict reports ambiguous reserved separator usage.
	ReasonIDReservedConflict ReasonCode = "reserved_conflict"
	// ReasonReservedNamespace reports an extension or external source claiming a reserved namespace.
	ReasonReservedNamespace ReasonCode = "reserved_namespace"
	// ReasonIDTooLong reports an id over the provider-safe limit.
	ReasonIDTooLong ReasonCode = "id_too_long"
	// ReasonDependencyMissing reports a missing dependency.
	ReasonDependencyMissing ReasonCode = "dependency_missing"
	// ReasonBackendUnhealthy reports an unhealthy backend.
	ReasonBackendUnhealthy ReasonCode = "backend_unhealthy"
	// ReasonBackendNotExecutable reports a descriptor without an executable backend.
	ReasonBackendNotExecutable ReasonCode = "backend_not_executable"
	// ReasonExtensionInactive reports an inactive extension.
	ReasonExtensionInactive ReasonCode = "extension_inactive"
	// ReasonExtensionRuntimeMismatch reports a manifest/runtime mismatch.
	ReasonExtensionRuntimeMismatch ReasonCode = "extension_runtime_mismatch"
	// ReasonExtensionCapabilityMissing reports a missing extension capability.
	ReasonExtensionCapabilityMissing ReasonCode = "extension_capability_missing"
	// ReasonExtensionSourceForbidden reports a denied or unconfigured extension source.
	ReasonExtensionSourceForbidden ReasonCode = "extension_source_forbidden"
	// ReasonExtensionNotInstalled reports a missing installed extension.
	ReasonExtensionNotInstalled ReasonCode = "extension_not_installed"
	// ReasonExtensionValidationFailed reports extension lifecycle validation failure.
	ReasonExtensionValidationFailed ReasonCode = "extension_validation_failed"
	// ReasonRuntimeDescriptorMissing reports a missing runtime descriptor.
	ReasonRuntimeDescriptorMissing ReasonCode = "runtime_descriptor_missing"
	// ReasonRuntimeDescriptorMismatch reports a runtime descriptor mismatch.
	ReasonRuntimeDescriptorMismatch ReasonCode = "runtime_descriptor_mismatch"
	// ReasonHandlerMissing reports a missing extension handler.
	ReasonHandlerMissing ReasonCode = "handler_missing"
	// ReasonMCPUnreachable reports an unreachable MCP server.
	ReasonMCPUnreachable ReasonCode = "mcp_unreachable"
	// ReasonMCPAuthUnconfigured reports missing MCP auth configuration.
	ReasonMCPAuthUnconfigured ReasonCode = "mcp_auth_unconfigured"
	// ReasonMCPAuthRequired reports that MCP login is required.
	ReasonMCPAuthRequired ReasonCode = "mcp_auth_required"
	// ReasonMCPAuthExpired reports expired MCP auth.
	ReasonMCPAuthExpired ReasonCode = "mcp_auth_expired"
	// ReasonMCPAuthInvalid reports invalid MCP auth.
	ReasonMCPAuthInvalid ReasonCode = "mcp_auth_invalid"
	// ReasonMCPAuthRefreshFailed reports failed MCP auth refresh.
	ReasonMCPAuthRefreshFailed ReasonCode = "mcp_auth_refresh_failed"
	// ReasonNetworkRawTokenRejected reports raw claim-token fields in network payloads.
	ReasonNetworkRawTokenRejected ReasonCode = "network_raw_token_rejected"
	// ReasonSourceDisabled reports a disabled source.
	ReasonSourceDisabled ReasonCode = "source_disabled"
	// ReasonPolicyDenied reports a policy denial.
	ReasonPolicyDenied ReasonCode = "policy_denied"
	// ReasonVisibilityDenied reports a descriptor hidden from a scoped projection.
	ReasonVisibilityDenied ReasonCode = "visibility_denied"
	// ReasonApprovalRequired reports required approval.
	ReasonApprovalRequired ReasonCode = "approval_required"
	// ReasonApprovalUnreachable reports no available approval channel.
	ReasonApprovalUnreachable ReasonCode = "approval_unreachable"
	// ReasonApprovalTimedOut reports approval timeout.
	ReasonApprovalTimedOut ReasonCode = "approval_timed_out"
	// ReasonApprovalCanceled reports approval cancellation.
	ReasonApprovalCanceled ReasonCode = "approval_canceled"
	// ReasonApprovalTokenMissing reports a missing local approval token.
	ReasonApprovalTokenMissing ReasonCode = "approval_token_missing"
	// ReasonApprovalTokenExpired reports an expired local approval token.
	ReasonApprovalTokenExpired ReasonCode = "approval_token_expired"
	// ReasonApprovalTokenMismatch reports a local approval token binding mismatch.
	ReasonApprovalTokenMismatch ReasonCode = "approval_token_mismatch"
	// ReasonApprovalTokenReplayed reports a replayed local approval token.
	ReasonApprovalTokenReplayed ReasonCode = "approval_token_replayed"
	// ReasonSessionDenied reports session lineage denial.
	ReasonSessionDenied ReasonCode = "session_denied"
	// ReasonScopeMismatch reports caller-supplied scope conflicting with trusted scope.
	ReasonScopeMismatch ReasonCode = "scope_mismatch"
	// ReasonMemorySubagentWriteDenied reports a sub-agent direct memory write denial.
	ReasonMemorySubagentWriteDenied ReasonCode = "memory_subagent_write_denied"
	// ReasonHookDenied reports hook denial.
	ReasonHookDenied ReasonCode = "hook_denied"
	// ReasonSchemaInvalid reports invalid JSON schema.
	ReasonSchemaInvalid ReasonCode = "schema_invalid"
	// ReasonConflictedID reports a canonical id conflict.
	ReasonConflictedID ReasonCode = "conflicted_id"
	// ReasonConflictedSanitizedName reports an external-name sanitization conflict.
	ReasonConflictedSanitizedName ReasonCode = "conflicted_sanitized_name"
	// ReasonResultBudgetExceeded reports a result budget violation.
	ReasonResultBudgetExceeded ReasonCode = "result_budget_exceeded"
	// ReasonCallCanceled reports dispatch cancellation.
	ReasonCallCanceled ReasonCode = "call_canceled"
	// ReasonCallTimedOut reports dispatch deadline expiration.
	ReasonCallTimedOut ReasonCode = "call_timed_out"
	// ReasonSecretMetadata reports sensitive metadata in a public envelope.
	ReasonSecretMetadata ReasonCode = "secret_metadata"
	// ReasonToolsetUnknown reports a policy reference to an unknown toolset.
	ReasonToolsetUnknown ReasonCode = "toolset_unknown"
	// ReasonToolsetCycle reports recursive toolset membership.
	ReasonToolsetCycle ReasonCode = "toolset_cycle"
	// ReasonToolUnknown reports a policy reference to an unknown tool.
	ReasonToolUnknown ReasonCode = "tool_unknown"
	// ReasonConfigPathForbidden reports an agent-immutable config path.
	ReasonConfigPathForbidden ReasonCode = "config_path_forbidden"
	// ReasonConfigSecretPathForbidden reports a secret-bearing config path.
	ReasonConfigSecretPathForbidden ReasonCode = "config_secret_path_forbidden" // #nosec G101 -- reason code.
	// ReasonConfigTrustRootForbidden reports a trust-root config path.
	ReasonConfigTrustRootForbidden ReasonCode = "config_trust_root_forbidden"
	// ReasonConfigScopeNotAllowed reports an unsupported config write scope.
	ReasonConfigScopeNotAllowed ReasonCode = "config_scope_not_allowed"
	// ReasonConfigValidationFailed reports a validated config writer rejection.
	ReasonConfigValidationFailed ReasonCode = "config_validation_failed"
	// ReasonHookSourceImmutable reports a non-config hook source mutation attempt.
	ReasonHookSourceImmutable ReasonCode = "hook_source_immutable"
	// ReasonHookSecretInputForbidden reports a secret-bearing hook executor input.
	ReasonHookSecretInputForbidden ReasonCode = "hook_secret_input_forbidden"
	// ReasonHookValidationFailed reports a hook normalization or validation rejection.
	ReasonHookValidationFailed ReasonCode = "hook_validation_failed"
	// ReasonAutomationScopeForbidden reports an automation scope or source mutation denial.
	ReasonAutomationScopeForbidden ReasonCode = "automation_scope_forbidden"
	// ReasonAutomationSecretInputForbidden reports forbidden raw automation secret material.
	ReasonAutomationSecretInputForbidden ReasonCode = "automation_secret_input_forbidden" // #nosec G101 -- reason code.
	// ReasonAutomationValidationFailed reports automation manager or model validation rejection.
	ReasonAutomationValidationFailed ReasonCode = "automation_validation_failed"
	// ReasonAutonomySessionRequired reports a session-bound autonomy call without a caller session.
	ReasonAutonomySessionRequired ReasonCode = "autonomy_session_required"
	// ReasonAutonomyNoActiveLease reports no active run lease for the caller session.
	ReasonAutonomyNoActiveLease ReasonCode = "autonomy_no_active_lease"
	// ReasonAutonomyForeignRun reports a run id outside the caller session's active lease.
	ReasonAutonomyForeignRun ReasonCode = "autonomy_foreign_run"
	// ReasonAutonomyLeaseExpired reports an expired or non-active caller lease.
	ReasonAutonomyLeaseExpired ReasonCode = "autonomy_lease_expired"
	// ReasonAutonomyLeaseAlreadyHeld reports multiple active leases for one session.
	ReasonAutonomyLeaseAlreadyHeld ReasonCode = "autonomy_lease_already_held"
)

const (
	// RiskRead marks read-only local inspection.
	RiskRead RiskClass = "read"
	// RiskMutating marks state-changing behavior.
	RiskMutating RiskClass = "mutating"
	// RiskOpenWorld marks access to arbitrary external state.
	RiskOpenWorld RiskClass = "open_world"
	// RiskDestructive marks destructive or irreversible behavior.
	RiskDestructive RiskClass = "destructive"
)

const (
	// SourceBuiltin marks daemon-defined tools.
	SourceBuiltin SourceKind = "builtin"
	// SourceMCP marks tools discovered from MCP servers.
	SourceMCP SourceKind = "mcp"
	// SourceExtension marks tools provided by extensions.
	SourceExtension SourceKind = "extension"
	// SourceDynamic marks future runtime-assembled tools.
	SourceDynamic SourceKind = "dynamic"
)

const (
	// ToolCallStarted reports that dispatch passed identity resolution and began.
	ToolCallStarted ToolCallEventKind = "tool.call_started"
	// ToolCallCompleted reports successful provider execution and result limiting.
	ToolCallCompleted ToolCallEventKind = "tool.call_completed"
	// ToolCallFailed reports schema, hook, backend, cancellation, or timeout failures.
	ToolCallFailed ToolCallEventKind = "tool.call_failed"
	// ToolCallDenied reports policy, availability, approval, conflict, or hook denial.
	ToolCallDenied ToolCallEventKind = "tool.call_denied"
	// ToolResultTruncated reports deterministic result truncation.
	ToolResultTruncated ToolCallEventKind = "tool.result_truncated"
)

const (
	// ToolIDToolList lists tools in the caller's effective registry projection.
	ToolIDToolList ToolID = "agh__tool_list"
	// ToolIDToolSearch searches tools in the caller's effective registry projection.
	ToolIDToolSearch ToolID = "agh__tool_search"
	// ToolIDToolInfo reads one tool descriptor and diagnostics view.
	ToolIDToolInfo ToolID = "agh__tool_info"
	// ToolIDSkillList lists skills through the existing skill registry.
	ToolIDSkillList ToolID = "agh__skill_list"
	// ToolIDSkillSearch searches skills through the existing skill registry.
	ToolIDSkillSearch ToolID = "agh__skill_search"
	// ToolIDSkillView reads one skill and its verified body.
	ToolIDSkillView ToolID = "agh__skill_view"
	// ToolIDNetworkPeers lists visible network peers.
	ToolIDNetworkPeers ToolID = "agh__network_peers"
	// ToolIDNetworkStatus reads daemon-owned network runtime status.
	ToolIDNetworkStatus ToolID = "agh__network_status"
	// ToolIDNetworkChannels lists active AGH network channels.
	ToolIDNetworkChannels ToolID = "agh__network_channels"
	// ToolIDNetworkInbox reads queued inbound network messages for one local session.
	ToolIDNetworkInbox ToolID = "agh__network_inbox"
	// ToolIDNetworkSend sends one network message through the existing network manager.
	ToolIDNetworkSend ToolID = "agh__network_send"
	// ToolIDNetworkChannelCreate registers one AGH network channel with a stated purpose.
	ToolIDNetworkChannelCreate ToolID = "agh__network_channel_create"
	// ToolIDNetworkThreads lists public network thread summaries.
	ToolIDNetworkThreads ToolID = "agh__network_threads"
	// ToolIDNetworkThreadMessages reads messages in one public network thread.
	ToolIDNetworkThreadMessages ToolID = "agh__network_thread_messages"
	// ToolIDNetworkDirects lists direct-room summaries.
	ToolIDNetworkDirects ToolID = "agh__network_directs"
	// ToolIDNetworkDirectResolve creates or returns one deterministic direct room.
	ToolIDNetworkDirectResolve ToolID = "agh__network_direct_resolve"
	// ToolIDNetworkDirectMessages reads messages in one direct room.
	ToolIDNetworkDirectMessages ToolID = "agh__network_direct_messages"
	// ToolIDNetworkWork reads one network work lifecycle row.
	ToolIDNetworkWork ToolID = "agh__network_work"
	// ToolIDSessionList lists runtime sessions.
	ToolIDSessionList ToolID = "agh__session_list"
	// ToolIDSessionStatus reads one runtime session snapshot.
	ToolIDSessionStatus ToolID = "agh__session_status"
	// ToolIDSessionHistory reads grouped turn history for one session.
	ToolIDSessionHistory ToolID = "agh__session_history"
	// ToolIDSessionEvents reads persisted events for one session.
	ToolIDSessionEvents ToolID = "agh__session_events"
	// ToolIDSessionDescribe reads a composite read-only session description.
	ToolIDSessionDescribe ToolID = "agh__session_describe"
	// ToolIDSessionHealth reads metadata-only session health and wake eligibility.
	ToolIDSessionHealth ToolID = "agh__session_health"
	// ToolIDAgentHeartbeatStatus reads resolved Heartbeat policy, wake state, health, and wake audit.
	ToolIDAgentHeartbeatStatus ToolID = "agh__agent_heartbeat_status"
	// ToolIDAgentHeartbeatWake requests one managed advisory Heartbeat wake decision.
	ToolIDAgentHeartbeatWake ToolID = "agh__agent_heartbeat_wake"
	// ToolIDWorkspaceList lists registered workspaces.
	ToolIDWorkspaceList ToolID = "agh__workspace_list"
	// ToolIDWorkspaceInfo reads one registered workspace record.
	ToolIDWorkspaceInfo ToolID = "agh__workspace_info"
	// ToolIDWorkspaceDescribe reads one resolved workspace detail projection.
	ToolIDWorkspaceDescribe ToolID = "agh__workspace_describe"
	// ToolIDAgentCreate authors one AGENT.md definition at global or workspace scope.
	ToolIDAgentCreate ToolID = "agh__agent_create"
	// ToolIDProviderModelsList lists the daemon provider model catalog.
	ToolIDProviderModelsList ToolID = "agh__provider_models_list"
	// ToolIDProviderModelsRefresh refreshes one or more provider model catalog sources.
	ToolIDProviderModelsRefresh ToolID = "agh__provider_models_refresh"
	// ToolIDProviderModelsStatus reads provider model catalog source status.
	ToolIDProviderModelsStatus ToolID = "agh__provider_models_status"
	// ToolIDMemoryList lists memory headers visible for a scope.
	ToolIDMemoryList ToolID = "agh__memory_list"
	// ToolIDMemoryShow reads one memory document through the current memory store.
	ToolIDMemoryShow ToolID = "agh__memory_show"
	// ToolIDMemorySearch recalls memory documents through the active memory provider.
	ToolIDMemorySearch ToolID = "agh__memory_search"
	// ToolIDMemoryPropose submits a controller-backed memory proposal.
	ToolIDMemoryPropose ToolID = "agh__memory_propose"
	// ToolIDMemoryNote records a controller-backed ad-hoc memory note.
	ToolIDMemoryNote ToolID = "agh__memory_note"
	// ToolIDMemoryHealth reads Memory v2 health and derived catalog state.
	ToolIDMemoryHealth ToolID = "agh__memory_health"
	// ToolIDMemoryScopeShow reports effective Memory v2 scope resolution.
	ToolIDMemoryScopeShow ToolID = "agh__memory_scope_show"
	// ToolIDMemoryAdminHistory lists Memory v2 operation history without reusing the removed legacy ID.
	ToolIDMemoryAdminHistory ToolID = "agh__memory_admin_history"
	// ToolIDMemoryReindex rebuilds Memory v2 derived indexes.
	ToolIDMemoryReindex ToolID = "agh__memory_reindex"
	// ToolIDMemoryPromote promotes one Memory v2 entry across scopes.
	ToolIDMemoryPromote ToolID = "agh__memory_promote"
	// ToolIDMemoryReset resets derived Memory v2 state.
	ToolIDMemoryReset ToolID = "agh__memory_reset"
	// ToolIDMemoryReload invalidates future Memory v2 snapshots.
	ToolIDMemoryReload ToolID = "agh__memory_reload"
	// ToolIDMemoryDecisionsList lists Memory v2 controller decisions.
	ToolIDMemoryDecisionsList ToolID = "agh__memory_decisions_list"
	// ToolIDMemoryDecisionsShow reads one Memory v2 controller decision.
	ToolIDMemoryDecisionsShow ToolID = "agh__memory_decisions_show"
	// ToolIDMemoryDecisionsRevert reverts one applied Memory v2 controller decision.
	ToolIDMemoryDecisionsRevert ToolID = "agh__memory_decisions_revert"
	// ToolIDMemoryRecallTrace reads one materialized Memory v2 recall trace.
	ToolIDMemoryRecallTrace ToolID = "agh__memory_recall_trace"
	// ToolIDMemoryDreamStatus reads live Memory v2 dreaming status.
	ToolIDMemoryDreamStatus ToolID = "agh__memory_dream_status"
	// ToolIDMemoryDreamList lists Memory v2 dreaming run records.
	ToolIDMemoryDreamList ToolID = "agh__memory_dream_list"
	// ToolIDMemoryDreamShow reads one Memory v2 dreaming run record.
	ToolIDMemoryDreamShow ToolID = "agh__memory_dream_show"
	// ToolIDMemoryDreamTrigger triggers Memory v2 dream consolidation.
	ToolIDMemoryDreamTrigger ToolID = "agh__memory_dream_trigger"
	// ToolIDMemoryDreamRetry retries Memory v2 dream consolidation.
	ToolIDMemoryDreamRetry ToolID = "agh__memory_dream_retry"
	// ToolIDMemoryDailyList lists Memory v2 daily operation logs.
	ToolIDMemoryDailyList ToolID = "agh__memory_daily_list"
	// ToolIDMemoryExtractorStatus reads Memory v2 extractor queue status.
	ToolIDMemoryExtractorStatus ToolID = "agh__memory_extractor_status"
	// ToolIDMemoryExtractorFailures lists Memory v2 extractor failures.
	ToolIDMemoryExtractorFailures ToolID = "agh__memory_extractor_failures"
	// ToolIDMemoryExtractorRetry retries Memory v2 extractor failures.
	ToolIDMemoryExtractorRetry ToolID = "agh__memory_extractor_retry"
	// ToolIDMemoryExtractorDrain drains the Memory v2 extractor queue.
	ToolIDMemoryExtractorDrain ToolID = "agh__memory_extractor_drain"
	// ToolIDMemoryProviderList lists Memory v2 providers.
	ToolIDMemoryProviderList ToolID = "agh__memory_provider_list"
	// ToolIDMemoryProviderGet reads one Memory v2 provider.
	ToolIDMemoryProviderGet ToolID = "agh__memory_provider_get"
	// ToolIDMemoryProviderSelect selects the active Memory v2 provider.
	ToolIDMemoryProviderSelect ToolID = "agh__memory_provider_select"
	// ToolIDMemoryProviderEnable enables one Memory v2 provider.
	ToolIDMemoryProviderEnable ToolID = "agh__memory_provider_enable"
	// ToolIDMemoryProviderDisable disables one Memory v2 provider.
	ToolIDMemoryProviderDisable ToolID = "agh__memory_provider_disable"
	// ToolIDMemorySessionLedger reads one materialized Memory v2 session ledger.
	ToolIDMemorySessionLedger ToolID = "agh__memory_session_ledger"
	// ToolIDMemorySessionReplay replays one materialized Memory v2 session ledger.
	ToolIDMemorySessionReplay ToolID = "agh__memory_session_replay"
	// ToolIDMemorySessionsPrune prunes Memory v2 session ledgers.
	ToolIDMemorySessionsPrune ToolID = "agh__memory_sessions_prune"
	// ToolIDMemorySessionsRepair repairs Memory v2 session ledgers.
	ToolIDMemorySessionsRepair ToolID = "agh__memory_sessions_repair"
	// ToolIDListLogs reads redacted runtime logs.
	ToolIDListLogs ToolID = "agh__logs"
	// ToolIDObserveMetrics reads daemon observability health and metrics.
	ToolIDObserveMetrics ToolID = "agh__observe_metrics"
	// ToolIDObserveSearch searches redacted observability events.
	ToolIDObserveSearch ToolID = "agh__observe_search"
	// ToolIDBridgesList lists bridge instances without secret bindings.
	ToolIDBridgesList ToolID = "agh__bridges_list"
	// ToolIDBridgesStatus reads bridge status and health without credentials.
	ToolIDBridgesStatus ToolID = "agh__bridges_status"
	// ToolIDTaskList lists task summaries through the task service.
	ToolIDTaskList ToolID = "agh__task_list"
	// ToolIDTaskRead reads one task view through the task service.
	ToolIDTaskRead ToolID = "agh__task_read"
	// ToolIDTaskCreate creates one root task through the task service.
	ToolIDTaskCreate ToolID = "agh__task_create"
	// ToolIDTaskChildCreate creates one child task through the task service.
	ToolIDTaskChildCreate ToolID = "agh__task_child_create"
	// ToolIDTaskUpdate updates one task through the task service.
	ToolIDTaskUpdate ToolID = "agh__task_update"
	// ToolIDTaskCancel cancels one task through the task service.
	ToolIDTaskCancel ToolID = "agh__task_cancel"
	// ToolIDTaskRunList lists task runs through the task service.
	ToolIDTaskRunList ToolID = "agh__task_run_list"
	// ToolIDTaskRunReviewRequest requests a review for one terminal task run.
	ToolIDTaskRunReviewRequest ToolID = "agh__task_run_review_request"
	// ToolIDTaskRunReviewList lists task-run reviews through the task service.
	ToolIDTaskRunReviewList ToolID = "agh__task_run_review_list"
	// ToolIDTaskRunReviewShow reads one task-run review through the task service.
	ToolIDTaskRunReviewShow ToolID = "agh__task_run_review_show"
	// ToolIDTaskExecutionProfileGet reads one task execution profile.
	ToolIDTaskExecutionProfileGet ToolID = "agh__task_execution_profile_get"
	// ToolIDTaskExecutionProfileSet updates one task execution profile.
	ToolIDTaskExecutionProfileSet ToolID = "agh__task_execution_profile_set"
	// ToolIDTaskExecutionProfileDelete removes one task execution profile.
	ToolIDTaskExecutionProfileDelete ToolID = "agh__task_execution_profile_delete"
	// ToolIDTaskNotificationSubscribe creates one bridge notification subscription for a task.
	ToolIDTaskNotificationSubscribe ToolID = "agh__task_notification_subscribe"
	// ToolIDTaskNotificationList lists bridge notification subscriptions for a task.
	ToolIDTaskNotificationList ToolID = "agh__task_notification_list"
	// ToolIDTaskNotificationShow reads one bridge notification subscription for a task.
	ToolIDTaskNotificationShow ToolID = "agh__task_notification_show"
	// ToolIDTaskNotificationDelete deletes one bridge notification subscription for a task.
	ToolIDTaskNotificationDelete ToolID = "agh__task_notification_delete"
	// ToolIDTaskRunClaimNext claims the next run for the caller session.
	ToolIDTaskRunClaimNext ToolID = "agh__task_run_claim_next"
	// ToolIDTaskRunHeartbeat extends the caller session's active run lease.
	ToolIDTaskRunHeartbeat ToolID = "agh__task_run_heartbeat"
	// ToolIDTaskRunComplete completes the caller session's active run lease.
	ToolIDTaskRunComplete ToolID = "agh__task_run_complete"
	// ToolIDTaskRunFail fails the caller session's active run lease.
	ToolIDTaskRunFail ToolID = "agh__task_run_fail"
	// ToolIDTaskRunRelease releases the caller session's active run lease.
	ToolIDTaskRunRelease ToolID = "agh__task_run_release"
	// ToolIDTaskRunReviewSubmit submits the caller session's bound task-run review verdict.
	ToolIDTaskRunReviewSubmit ToolID = "agh__task_run_review_submit"
	// ToolIDConfigShow shows the redacted effective config.
	ToolIDConfigShow ToolID = "agh__config_show"
	// ToolIDConfigList lists redacted effective config entries.
	ToolIDConfigList ToolID = "agh__config_list"
	// ToolIDConfigGet reads one redacted effective config entry.
	ToolIDConfigGet ToolID = "agh__config_get"
	// ToolIDConfigSet mutates one validated config overlay value.
	ToolIDConfigSet ToolID = "agh__config_set"
	// ToolIDConfigUnset removes one validated config overlay value.
	ToolIDConfigUnset ToolID = "agh__config_unset"
	// ToolIDConfigDiff compares defaults/global config against the effective view.
	ToolIDConfigDiff ToolID = "agh__config_diff"
	// ToolIDConfigPath reports resolved config paths.
	ToolIDConfigPath ToolID = "agh__config_path"
	// ToolIDHooksList lists resolved hooks.
	ToolIDHooksList ToolID = "agh__hooks_list"
	// ToolIDHooksInfo reads one resolved hook.
	ToolIDHooksInfo ToolID = "agh__hooks_info"
	// ToolIDHooksEvents lists supported hook events.
	ToolIDHooksEvents ToolID = "agh__hooks_events"
	// ToolIDHooksRuns lists hook run audit records.
	ToolIDHooksRuns ToolID = "agh__hooks_runs"
	// ToolIDHooksCreate creates one config-backed hook declaration.
	ToolIDHooksCreate ToolID = "agh__hooks_create"
	// ToolIDHooksUpdate updates one config-backed hook declaration.
	ToolIDHooksUpdate ToolID = "agh__hooks_update"
	// ToolIDHooksDelete deletes one config-backed hook declaration.
	ToolIDHooksDelete ToolID = "agh__hooks_delete"
	// ToolIDHooksEnable enables one config-backed hook declaration.
	ToolIDHooksEnable ToolID = "agh__hooks_enable"
	// ToolIDHooksDisable disables one config-backed hook declaration.
	ToolIDHooksDisable ToolID = "agh__hooks_disable"
	// ToolIDAutomationJobsList lists automation jobs through the automation manager.
	ToolIDAutomationJobsList ToolID = "agh__automation_jobs_list"
	// ToolIDAutomationJobsGet reads one automation job through the automation manager.
	ToolIDAutomationJobsGet ToolID = "agh__automation_jobs_get"
	// ToolIDAutomationJobsCreate creates one dynamic automation job through the automation manager.
	ToolIDAutomationJobsCreate ToolID = "agh__automation_jobs_create"
	// ToolIDAutomationJobsUpdate updates one automation job through the automation manager.
	ToolIDAutomationJobsUpdate ToolID = "agh__automation_jobs_update"
	// ToolIDAutomationJobsDelete deletes one dynamic automation job through the automation manager.
	ToolIDAutomationJobsDelete ToolID = "agh__automation_jobs_delete"
	// ToolIDAutomationJobsEnable enables one automation job through the automation manager.
	ToolIDAutomationJobsEnable ToolID = "agh__automation_jobs_enable"
	// ToolIDAutomationJobsDisable disables one automation job through the automation manager.
	ToolIDAutomationJobsDisable ToolID = "agh__automation_jobs_disable"
	// ToolIDAutomationJobsTrigger manually triggers one automation job through the automation manager.
	ToolIDAutomationJobsTrigger ToolID = "agh__automation_jobs_trigger"
	// ToolIDAutomationJobsHistory lists run history for one automation job.
	ToolIDAutomationJobsHistory ToolID = "agh__automation_jobs_history"
	// ToolIDAutomationTriggersList lists automation triggers through the automation manager.
	ToolIDAutomationTriggersList ToolID = "agh__automation_triggers_list"
	// ToolIDAutomationTriggersGet reads one automation trigger through the automation manager.
	ToolIDAutomationTriggersGet ToolID = "agh__automation_triggers_get"
	// ToolIDAutomationTriggersCreate creates one dynamic automation trigger through the automation manager.
	ToolIDAutomationTriggersCreate ToolID = "agh__automation_triggers_create"
	// ToolIDAutomationTriggersUpdate updates one automation trigger through the automation manager.
	ToolIDAutomationTriggersUpdate ToolID = "agh__automation_triggers_update"
	// ToolIDAutomationTriggersDelete deletes one dynamic automation trigger through the automation manager.
	ToolIDAutomationTriggersDelete ToolID = "agh__automation_triggers_delete"
	// ToolIDAutomationTriggersEnable enables one automation trigger through the automation manager.
	ToolIDAutomationTriggersEnable ToolID = "agh__automation_triggers_enable"
	// ToolIDAutomationTriggersDisable disables one automation trigger through the automation manager.
	ToolIDAutomationTriggersDisable ToolID = "agh__automation_triggers_disable"
	// ToolIDAutomationTriggersHistory lists run history for one automation trigger.
	ToolIDAutomationTriggersHistory ToolID = "agh__automation_triggers_history"
	// ToolIDAutomationRunsList lists automation run records through the automation manager.
	ToolIDAutomationRunsList ToolID = "agh__automation_runs_list"
	// ToolIDAutomationRunsGet reads one automation run record through the automation manager.
	ToolIDAutomationRunsGet ToolID = "agh__automation_runs_get"
	// ToolIDExtensionsSearch searches configured extension marketplace sources.
	ToolIDExtensionsSearch ToolID = "agh__extensions_search"
	// ToolIDExtensionsList lists installed extensions through the extension registry.
	ToolIDExtensionsList ToolID = "agh__extensions_list"
	// ToolIDExtensionsInfo reads one installed extension status.
	ToolIDExtensionsInfo ToolID = "agh__extensions_info"
	// ToolIDExtensionsInstall installs one extension through a managed local or marketplace source.
	ToolIDExtensionsInstall ToolID = "agh__extensions_install"
	// ToolIDExtensionsUpdate updates one or more marketplace-installed extensions.
	ToolIDExtensionsUpdate ToolID = "agh__extensions_update"
	// ToolIDExtensionsRemove removes one managed installed extension.
	ToolIDExtensionsRemove ToolID = "agh__extensions_remove"
	// ToolIDExtensionsEnable enables one installed extension.
	ToolIDExtensionsEnable ToolID = "agh__extensions_enable"
	// ToolIDExtensionsDisable disables one installed extension.
	ToolIDExtensionsDisable ToolID = "agh__extensions_disable"
	// ToolIDBundlesList lists the extension bundle catalog and active bundle records.
	ToolIDBundlesList ToolID = "agh__bundles_list"
	// ToolIDBundlesInfo reads one active bundle record.
	ToolIDBundlesInfo ToolID = "agh__bundles_info"
	// ToolIDBundlesActivate activates one extension bundle profile.
	ToolIDBundlesActivate ToolID = "agh__bundles_activate"
	// ToolIDBundlesDeactivate deactivates one bundle activation.
	ToolIDBundlesDeactivate ToolID = "agh__bundles_deactivate"
	// ToolIDBundlesStatus reports bundle catalog, activation, and network-default status.
	ToolIDBundlesStatus ToolID = "agh__bundles_status"
	// ToolIDResourcesList lists desired-state resource records.
	ToolIDResourcesList ToolID = "agh__resources_list"
	// ToolIDResourcesInfo reads one desired-state resource record.
	ToolIDResourcesInfo ToolID = "agh__resources_info"
	// ToolIDResourcesSnapshot reads a filtered desired-state resource snapshot.
	ToolIDResourcesSnapshot ToolID = "agh__resources_snapshot"
	// ToolIDMCPStatus probes one configured MCP server without exposing login/logout as tools.
	ToolIDMCPStatus ToolID = "agh__mcp_status"
	// ToolIDMCPAuthStatus reads redacted MCP auth diagnostics for one configured server.
	ToolIDMCPAuthStatus ToolID = "agh__mcp_auth_status"
)

const (
	// ToolsetIDBootstrap groups registry self-inspection tools.
	ToolsetIDBootstrap ToolsetID = "agh__bootstrap"
	// ToolsetIDCatalog groups registry and skill catalog tools.
	ToolsetIDCatalog ToolsetID = "agh__catalog"
	// ToolsetIDCoordination groups network coordination tools.
	ToolsetIDCoordination ToolsetID = "agh__coordination"
	// ToolsetIDTasks groups bounded task tools.
	ToolsetIDTasks ToolsetID = "agh__tasks"
	// ToolsetIDAutonomy groups session-bound task-run autonomy tools.
	ToolsetIDAutonomy ToolsetID = "agh__autonomy"
	// ToolsetIDSessions groups read-only runtime session tools.
	ToolsetIDSessions ToolsetID = "agh__sessions"
	// ToolsetIDAuthoredContext groups managed Soul/Heartbeat read and wake tools.
	ToolsetIDAuthoredContext ToolsetID = "agh__authored_context"
	// ToolsetIDWorkspace groups workspace inspection and managed agent authoring tools.
	ToolsetIDWorkspace ToolsetID = "agh__workspace"
	// ToolsetIDProviderModels groups provider model catalog tools.
	ToolsetIDProviderModels ToolsetID = "agh__provider_models"
	// ToolsetIDMemory groups Memory v2 read and proposal tools.
	ToolsetIDMemory ToolsetID = "agh__memory"
	// ToolsetIDMemoryAdmin groups Memory v2 operational tools.
	ToolsetIDMemoryAdmin ToolsetID = "agh__memory_admin"
	// ToolsetIDObserve groups read-only observability tools.
	ToolsetIDObserve ToolsetID = "agh__observe"
	// ToolsetIDBridges groups read-only bridge inspection tools.
	ToolsetIDBridges ToolsetID = "agh__bridges"
	// ToolsetIDConfig groups validated config tools.
	ToolsetIDConfig ToolsetID = "agh__config"
	// ToolsetIDHooks groups hook introspection and mutable config-backed hook tools.
	ToolsetIDHooks ToolsetID = "agh__hooks"
	// ToolsetIDAutomation groups automation lifecycle and run inspection tools.
	ToolsetIDAutomation ToolsetID = "agh__automation"
	// ToolsetIDExtensions groups extension discovery and lifecycle tools.
	ToolsetIDExtensions ToolsetID = "agh__extensions"
	// ToolsetIDBundles groups extension bundle lifecycle tools.
	ToolsetIDBundles ToolsetID = "agh__bundles"
	// ToolsetIDResources groups desired-state resource inspection tools.
	ToolsetIDResources ToolsetID = "agh__resources"
	// ToolsetIDMCP groups MCP probe and status diagnostics.
	ToolsetIDMCP ToolsetID = "agh__mcp"
	// ToolsetIDMCPAuth groups redacted MCP auth diagnostics.
	ToolsetIDMCPAuth ToolsetID = "agh__mcp_auth"
)

const (
	// VisibilityInternal limits a tool to daemon-internal use.
	VisibilityInternal Visibility = "internal"
	// VisibilityOperator exposes a tool to operator diagnostics.
	VisibilityOperator Visibility = "operator"
	// VisibilitySession exposes a tool to session-scoped views.
	VisibilitySession Visibility = "session"
	// VisibilityModel exposes a tool to model-visible projections.
	VisibilityModel Visibility = "model"
)