Documentation
¶
Index ¶
- Constants
- func AllowedSet(agent *agentcore.Agent, requested []string) map[string]bool
- func CanonicalName(name string) string
- func RegisterAnalysisTools(r *Registry, cfg BrowserToolsConfig)
- func RegisterArtifactPreviewTools(r *Registry)
- func RegisterBrowserTools(r *Registry, cfg BrowserToolsConfig)
- func RegisterRepositoryCheckoutTools(r *Registry)
- func RegisterRepositoryProviderTools(r *Registry)
- func RegisterSkillTools(r *Registry)
- func RegisterWebTools(r *Registry, cfg WebToolsConfig)
- func RegisterWebToolsFromEnv(r *Registry)
- func RegisterWorkspaceScanTools(r *Registry)
- func RegisterWorkspaceTools(r *Registry)
- func RequiresCoding(allowed map[string]bool) bool
- func SetCommandSandbox(mode string)
- func ToolResultText(output json.RawMessage) string
- func ValidateAllowedSubset(agent *agentcore.Agent, requested []string) error
- func WithLocalCommandOptions(ctx context.Context, options LocalCommandOptions) context.Context
- type ArtifactWriter
- type BraveSearchClient
- type BrowserCommandRunner
- type BrowserManager
- type BrowserToolsConfig
- type CallContext
- type CheckoutRepositoryRequest
- type CheckoutRepositoryResult
- type CommandExecutionContext
- type Definition
- type ExaCitation
- type ExaExtrasConfig
- type ExaGrounding
- type ExaHighlightsConfig
- type ExaOutput
- type ExaSearchClient
- type ExaSearchContents
- type ExaSearchRequest
- type ExaSearchResponse
- type ExaSearchResult
- type ExaSummaryConfig
- type ExaTextConfig
- type Handler
- type LocalCommandOptions
- type ProviderHealth
- type ProviderRegistration
- type PublishedPreview
- type PublishedPreviewRequest
- type Registry
- func (r *Registry) CloneForApp(appID string) *Registry
- func (r *Registry) CloseRun(ctx context.Context, appID, runID string) error
- func (r *Registry) Definition(name string) (Definition, bool)
- func (r *Registry) DefinitionForApp(appID, name string) (Definition, bool)
- func (r *Registry) Definitions() []Definition
- func (r *Registry) DefinitionsForApp(appID string) []Definition
- func (r *Registry) Execute(ctx context.Context, callCtx CallContext, name string, input json.RawMessage) (json.RawMessage, error)
- func (r *Registry) ForApp(appID string) *Registry
- func (r *Registry) ProviderHealth() []ProviderHealth
- func (r *Registry) Ready() bool
- func (r *Registry) RefreshProvider(ctx context.Context, appID, provider string) error
- func (r *Registry) RefreshProvidersForApp(ctx context.Context, appID string)
- func (r *Registry) Register(def Definition, handler Handler)
- func (r *Registry) RegisterProviderRefresher(appID, provider string, cooldown time.Duration, ...)
- func (r *Registry) RegisterRunCloser(closer RunCloser)
- func (r *Registry) ReplaceAppProvider(appID, provider string, order int, registrations []ProviderRegistration, ...) error
- func (r *Registry) SetProviderHealth(health ProviderHealth)
- type RunCloser
- type SecurityFindingGroup
- type SecurityScanFinding
- type SecurityScanSummary
- type SecurityScannerResult
- type TinyFishSearchClient
- type TinyFishSearchRequest
- type WebFetchClient
- type WebSearchClient
- type WebSearchQuery
- type WebSearchResult
- type WebToolsConfig
- type WorkspaceManager
Constants ¶
const ( // PreviewFormatMarkdown is the markdown preview panel format. PreviewFormatMarkdown = "markdown" // PreviewFormatJSON is the JSON preview panel format. PreviewFormatJSON = "json" // RunPreviewArtifactType matches Helpin's run preview artifact type. RunPreviewArtifactType = "run_preview" )
const ( CommandSandboxLandlock = "landlock" CommandSandboxBestEffort = "best_effort" CommandSandboxNone = "none" )
Command sandbox modes. The worker resolves best_effort against the kernel at startup; here best_effort and landlock both confine.
const ( RiskLevelRead = "read" RiskLevelRoutine = "routine_mutation" RiskLevelSensitive = "sensitive_mutation" RiskLevelDestructive = "destructive_mutation" )
Variables ¶
This section is empty.
Functions ¶
func CanonicalName ¶
func RegisterAnalysisTools ¶ added in v0.11.2
func RegisterAnalysisTools(r *Registry, cfg BrowserToolsConfig)
RegisterAnalysisTools shares the app's private binary artifact callback with browser tools. No browser or browser credentials are needed for analysis.
func RegisterArtifactPreviewTools ¶
func RegisterArtifactPreviewTools(r *Registry)
RegisterArtifactPreviewTools registers the run-scoped preview publishing tools. They require an ArtifactWriter on the CallContext.
func RegisterBrowserTools ¶
func RegisterBrowserTools(r *Registry, cfg BrowserToolsConfig)
func RegisterRepositoryCheckoutTools ¶
func RegisterRepositoryCheckoutTools(r *Registry)
func RegisterRepositoryProviderTools ¶
func RegisterRepositoryProviderTools(r *Registry)
RegisterRepositoryProviderTools registers read-only GitHub PR/check tools.
func RegisterSkillTools ¶
func RegisterSkillTools(r *Registry)
func RegisterWebTools ¶
func RegisterWebTools(r *Registry, cfg WebToolsConfig)
func RegisterWebToolsFromEnv ¶
func RegisterWebToolsFromEnv(r *Registry)
func RegisterWorkspaceScanTools ¶
func RegisterWorkspaceScanTools(r *Registry)
RegisterWorkspaceScanTools registers the security scanner tools that run CLI scanners against the current run's workspace lease root.
func RegisterWorkspaceTools ¶
func RegisterWorkspaceTools(r *Registry)
RegisterWorkspaceTools registers in-process tools that operate on the current run's WorkspaceLease.RootPath.
func RequiresCoding ¶
RequiresCoding reports whether effective permissions allow local code execution or repository mutation. Host business mutations stay on support queues. CanonicalName also handles the MCP aliases of built-in tools.
func SetCommandSandbox ¶ added in v0.11.2
func SetCommandSandbox(mode string)
SetCommandSandbox sets the process-wide confinement for agent-selected commands. The local CLI executor is never confined.
func ToolResultText ¶
func ToolResultText(output json.RawMessage) string
ToolResultText returns the model-visible text represented by a tool result. Runtime-local text tools encode their output as a top-level JSON string; structured object and array results remain compact JSON.
func ValidateAllowedSubset ¶
func WithLocalCommandOptions ¶
func WithLocalCommandOptions(ctx context.Context, options LocalCommandOptions) context.Context
WithLocalCommandOptions is a trusted embedding hook, never model input.
Types ¶
type ArtifactWriter ¶
type ArtifactWriter interface {
WriteArtifact(ctx context.Context, artifact agentcore.AgentRunArtifact) error
}
ArtifactWriter persists run-scoped artifacts produced by tool handlers. It mirrors the runtime package's ArtifactWriter so callers can pass the same implementation through CallContext without an import cycle.
type BraveSearchClient ¶
type BraveSearchClient struct {
// contains filtered or unexported fields
}
func NewBraveSearchClient ¶
func NewBraveSearchClient(apiKey string) *BraveSearchClient
func (*BraveSearchClient) Search ¶
func (c *BraveSearchClient) Search(ctx context.Context, query WebSearchQuery) ([]WebSearchResult, error)
type BrowserCommandRunner ¶
type BrowserManager ¶
type BrowserManager struct {
// contains filtered or unexported fields
}
type BrowserToolsConfig ¶
type BrowserToolsConfig struct {
Enabled bool
AppID string
Binary string
ChromiumExecutable string
ChromiumArgs string
KernelAPIKey string
AllowedDomains []string
CommandTimeout time.Duration
SessionTimeoutSeconds int
MaxOutputChars int
ArtifactUploadURL string
ArtifactUploadToken string
HTTPClient *http.Client
Runner BrowserCommandRunner
Kernel kernelBrowserProvider
KernelHeadless bool
KernelStealth bool
ReplayFramerate int
FFmpegBinary string
RecordingTrimTimeout time.Duration
RecordingTrimThreads int
RecordingTrimPrePad time.Duration
RecordingTrimPostPad time.Duration
RecordingTrimLimiter chan struct{}
RecordingTrimmer browserRecordingTrimmer
RecordingConverter browserRecordingConverter
DisableRecordingTrim bool
}
func BrowserToolsConfigFromEnv ¶
func BrowserToolsConfigFromEnv() BrowserToolsConfig
BrowserToolsConfigFromEnv returns shared browser infrastructure settings. App policy, domains, and artifact destinations are supplied separately through AGENT_RUNTIME_APP_CONFIG.
type CallContext ¶
type CheckoutRepositoryResult ¶
type CheckoutRepositoryResult struct {
Alias string `json:"alias,omitempty"`
Primary bool `json:"primary"`
Lease *agentcore.WorkspaceLease `json:"lease,omitempty"`
RepositoryID string `json:"repository_id,omitempty"`
RepoFullName string `json:"repo_full_name,omitempty"`
BaseBranch string `json:"base_branch,omitempty"`
WorkBranch string `json:"work_branch,omitempty"`
}
type CommandExecutionContext ¶
type CommandExecutionContext = sdk.CommandExecutionContext
func CommandExecutionContextFromCallContext ¶
func CommandExecutionContextFromCallContext(callCtx CallContext) CommandExecutionContext
type Definition ¶
type Definition struct {
Name string `json:"name"`
Description string `json:"description"`
Category string `json:"category"`
InputSchema interface{} `json:"input_schema"`
Mutating bool `json:"mutating"`
RiskLevel string `json:"risk_level,omitempty"`
SupportedTargetTypes []string `json:"supported_target_types,omitempty"`
}
func (Definition) EffectiveRiskLevel ¶
func (d Definition) EffectiveRiskLevel() string
EffectiveRiskLevel returns a safe normalized classification. Existing mutating tools without metadata remain approval-gated as sensitive.
type ExaCitation ¶
type ExaExtrasConfig ¶
type ExaGrounding ¶
type ExaGrounding struct {
Field string `json:"field,omitempty"`
Citations []ExaCitation `json:"citations,omitempty"`
Confidence string `json:"confidence,omitempty"`
}
type ExaHighlightsConfig ¶
type ExaOutput ¶
type ExaOutput struct {
Content any `json:"content,omitempty"`
Grounding []ExaGrounding `json:"grounding,omitempty"`
}
type ExaSearchClient ¶
type ExaSearchClient struct {
// contains filtered or unexported fields
}
func NewExaSearchClient ¶
func NewExaSearchClient(apiKey string) *ExaSearchClient
func (*ExaSearchClient) Search ¶
func (c *ExaSearchClient) Search(ctx context.Context, query ExaSearchRequest) (*ExaSearchResponse, error)
type ExaSearchContents ¶
type ExaSearchContents struct {
Text *ExaTextConfig `json:"text,omitempty"`
Highlights *ExaHighlightsConfig `json:"highlights,omitempty"`
Summary *ExaSummaryConfig `json:"summary,omitempty"`
MaxAgeHours *int `json:"maxAgeHours,omitempty"`
Subpages *int `json:"subpages,omitempty"`
SubpageTarget any `json:"subpageTarget,omitempty"`
Extras *ExaExtrasConfig `json:"extras,omitempty"`
}
type ExaSearchRequest ¶
type ExaSearchRequest struct {
Query string `json:"query"`
AdditionalQueries []string `json:"additionalQueries,omitempty"`
SystemPrompt string `json:"systemPrompt,omitempty"`
Type string `json:"type,omitempty"`
Category string `json:"category,omitempty"`
UserLocation string `json:"userLocation,omitempty"`
NumResults int `json:"numResults,omitempty"`
IncludeDomains []string `json:"includeDomains,omitempty"`
ExcludeDomains []string `json:"excludeDomains,omitempty"`
StartPublishedDate string `json:"startPublishedDate,omitempty"`
EndPublishedDate string `json:"endPublishedDate,omitempty"`
StartCrawlDate string `json:"startCrawlDate,omitempty"`
EndCrawlDate string `json:"endCrawlDate,omitempty"`
Moderation bool `json:"moderation,omitempty"`
Contents *ExaSearchContents `json:"contents,omitempty"`
OutputSchema map[string]any `json:"outputSchema,omitempty"`
}
type ExaSearchResponse ¶
type ExaSearchResult ¶
type ExaSearchResult struct {
Title string `json:"title"`
URL string `json:"url"`
ID string `json:"id"`
PublishedDate *string `json:"publishedDate,omitempty"`
Author *string `json:"author,omitempty"`
Image string `json:"image,omitempty"`
Favicon string `json:"favicon,omitempty"`
Text string `json:"text,omitempty"`
Highlights []string `json:"highlights,omitempty"`
HighlightScores []float64 `json:"highlightScores,omitempty"`
Summary string `json:"summary,omitempty"`
Subpages []ExaSearchResult `json:"subpages,omitempty"`
Extras map[string]any `json:"extras,omitempty"`
}
type ExaSummaryConfig ¶
type ExaTextConfig ¶
type Handler ¶
type Handler func(ctx context.Context, callCtx CallContext, input json.RawMessage) (json.RawMessage, error)
type LocalCommandOptions ¶
type ProviderHealth ¶
type ProviderHealth struct {
AppID string `json:"app_id"`
Provider string `json:"provider"`
Ready bool `json:"ready"`
Degraded bool `json:"degraded"`
Source string `json:"source"`
ToolCount int `json:"tool_count"`
LastSuccess time.Time `json:"last_success,omitempty"`
LastError string `json:"last_error,omitempty"`
}
ProviderHealth describes the active catalog source and its refresh state.
type ProviderRegistration ¶
type ProviderRegistration struct {
Definition Definition
Handler Handler
}
ProviderRegistration is one atomically replaceable provider tool.
type PublishedPreview ¶
type PublishedPreview struct {
PanelKey string `json:"panel_key"`
Title string `json:"title"`
Format string `json:"format"`
Content json.RawMessage `json:"content"`
Replace bool `json:"replace"`
}
PublishedPreview is the normalized preview payload persisted as an artifact.
type PublishedPreviewRequest ¶
type PublishedPreviewRequest struct {
Slot string `json:"slot,omitempty"`
PanelKey string `json:"panel_key"`
Title string `json:"title"`
Format string `json:"format"`
Content json.RawMessage `json:"content"`
Replace *bool `json:"replace,omitempty"`
}
PublishedPreviewRequest is the raw input for preview publishing tools.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
func NewRegistry ¶
func NewRegistry() *Registry
func (*Registry) CloneForApp ¶
CloneForApp returns an isolated snapshot containing the runtime-owned tools and the selected app's tools. Run-scoped tools can be registered on the clone without mutating the process-wide registry or leaking into other runs.
func (*Registry) Definition ¶
func (r *Registry) Definition(name string) (Definition, bool)
func (*Registry) DefinitionForApp ¶
func (r *Registry) DefinitionForApp(appID, name string) (Definition, bool)
func (*Registry) Definitions ¶
func (r *Registry) Definitions() []Definition
func (*Registry) DefinitionsForApp ¶
func (r *Registry) DefinitionsForApp(appID string) []Definition
func (*Registry) Execute ¶
func (r *Registry) Execute(ctx context.Context, callCtx CallContext, name string, input json.RawMessage) (json.RawMessage, error)
func (*Registry) ForApp ¶
ForApp returns a registration view whose definitions and handlers are visible only to the specified host app. Runtime-owned tools remain global.
func (*Registry) ProviderHealth ¶
func (r *Registry) ProviderHealth() []ProviderHealth
ProviderHealth returns a stable snapshot of all configured provider states.
func (*Registry) RefreshProvider ¶
RefreshProvider refreshes one provider through the same single-flight path used by unknown-alias recovery. Scheduled refreshes bypass only the cooldown; they still join an in-flight request.
func (*Registry) RefreshProvidersForApp ¶
RefreshProvidersForApp refreshes each provider at most once per cooldown window.
func (*Registry) Register ¶
func (r *Registry) Register(def Definition, handler Handler)
func (*Registry) RegisterProviderRefresher ¶
func (r *Registry) RegisterProviderRefresher(appID, provider string, cooldown time.Duration, refresh func(context.Context) error)
RegisterProviderRefresher installs the provider's on-demand refresh hook.
func (*Registry) RegisterRunCloser ¶
func (*Registry) ReplaceAppProvider ¶
func (r *Registry) ReplaceAppProvider(appID, provider string, order int, registrations []ProviderRegistration, rejectGlobalCollision bool) error
ReplaceAppProvider atomically replaces one app provider's complete snapshot.
func (*Registry) SetProviderHealth ¶
func (r *Registry) SetProviderHealth(health ProviderHealth)
SetProviderHealth atomically records provider readiness and degradation.
type SecurityFindingGroup ¶
type SecurityFindingGroup struct {
Kind string `json:"kind"`
Key string `json:"key"`
Category string `json:"category,omitempty"`
Severity string `json:"severity,omitempty"`
RuleID string `json:"rule_id,omitempty"`
PackageName string `json:"package_name,omitempty"`
VulnerabilityID string `json:"vulnerability_id,omitempty"`
Path string `json:"path,omitempty"`
Count int `json:"count"`
Summary SecurityScanSummary `json:"summary"`
}
SecurityFindingGroup aggregates filtered findings along one dimension.
type SecurityScanFinding ¶
type SecurityScanFinding struct {
Scanner string `json:"scanner"`
Category string `json:"category"`
Severity string `json:"severity"`
RuleID string `json:"rule_id"`
Title string `json:"title"`
Message string `json:"message"`
Path string `json:"path"`
StartLine *int `json:"start_line,omitempty"`
EndLine *int `json:"end_line,omitempty"`
PackageName *string `json:"package_name,omitempty"`
InstalledVersion *string `json:"installed_version,omitempty"`
FixedVersion *string `json:"fixed_version,omitempty"`
VulnerabilityID *string `json:"vulnerability_id,omitempty"`
CWEIDs []string `json:"cwe_ids,omitempty"`
CVSSScore *float64 `json:"cvss_score,omitempty"`
References []string `json:"references,omitempty"`
Fingerprint string `json:"fingerprint"`
Raw map[string]interface{} `json:"raw,omitempty"`
}
SecurityScanFinding is a normalized finding shared across scanners.
type SecurityScanSummary ¶
type SecurityScanSummary struct {
Total int `json:"total"`
Critical int `json:"critical"`
High int `json:"high"`
Medium int `json:"medium"`
Low int `json:"low"`
Info int `json:"info"`
}
SecurityScanSummary counts findings per normalized severity.
type SecurityScannerResult ¶
type SecurityScannerResult struct {
Scanner string `json:"scanner"`
Summary SecurityScanSummary `json:"summary"`
SummaryBeforePagination SecurityScanSummary `json:"summary_before_pagination"`
TotalFindings int `json:"total_findings"`
ReturnedFindings int `json:"returned_findings"`
Page int `json:"page"`
PageSize int `json:"page_size"`
HasMore bool `json:"has_more"`
ScanID string `json:"scan_id,omitempty"`
CacheHit bool `json:"cache_hit"`
SummaryOnly bool `json:"summary_only,omitempty"`
DetailLevel string `json:"detail_level,omitempty"`
Bounded bool `json:"bounded,omitempty"`
Groups []SecurityFindingGroup `json:"groups,omitempty"`
Findings []SecurityScanFinding `json:"findings"`
Warnings []string `json:"warnings,omitempty"`
}
SecurityScannerResult is the JSON tool result envelope.
type TinyFishSearchClient ¶
type TinyFishSearchClient struct {
// contains filtered or unexported fields
}
func NewTinyFishSearchClient ¶
func NewTinyFishSearchClient(apiKey string) *TinyFishSearchClient
func (*TinyFishSearchClient) Search ¶
func (c *TinyFishSearchClient) Search(ctx context.Context, query TinyFishSearchRequest) ([]WebSearchResult, error)
type TinyFishSearchRequest ¶
type WebFetchClient ¶
type WebFetchClient struct {
// contains filtered or unexported fields
}
func NewWebFetchClient ¶
func NewWebFetchClient(proxyURLs string) *WebFetchClient
type WebSearchClient ¶
type WebSearchClient interface {
Search(ctx context.Context, query WebSearchQuery) ([]WebSearchResult, error)
}
type WebSearchQuery ¶
type WebSearchResult ¶
type WebToolsConfig ¶
type WebToolsConfig struct {
BraveSearch *BraveSearchClient
ExaSearch *ExaSearchClient
TinyFishSearch *TinyFishSearchClient
WebFetch *WebFetchClient
}
type WorkspaceManager ¶
type WorkspaceManager interface {
CheckoutRepository(ctx context.Context, req CheckoutRepositoryRequest) (*CheckoutRepositoryResult, error)
}
WorkspaceManager performs runtime-owned workspace state changes requested by tools. Implementations must keep credentials out of model-visible outputs.
Source Files
¶
- analysis_artifacts.go
- artifact_preview_tools.go
- browser_recording_trim.go
- browser_tools.go
- coding_policy.go
- command_output.go
- command_sandbox.go
- execution_context.go
- kernel_browser_provider.go
- local_command.go
- native_read_budget.go
- python_tools.go
- registry.go
- repository_checkout_tools.go
- repository_provider_tools.go
- skill_tools.go
- web_tools.go
- workspace_command_tools.go
- workspace_edit_feedback.go
- workspace_find_tools.go
- workspace_git_tools.go
- workspace_patch_tools.go
- workspace_read_tools.go
- workspace_scan_tools.go
- workspace_symbol_tools.go
- workspace_text_format.go
- workspace_tools.go