@cjhyy/code-shell-core 0.7.1 → 0.8.1

package/dist/tool-system/builtin/index.js

@@ -8,7 +8,6 @@ import { editModelCatalogToolDef, editModelCatalogTool } from "./edit-model-cata
 import { generateVideoToolDef, generateVideoTool, isGenerateVideoAvailable, } from "./generate-video.js";
 import { viewImageToolDef, viewImageTool } from "./view-image.js";
 import { editToolDef, editTool } from "./edit.js";
-import { applyPatchToolDef, applyPatchTool } from "./apply-patch/index.js";
 import { globToolDef, globTool } from "./glob.js";
 import { grepToolDef, grepTool } from "./grep.js";
 import { bashToolDef, bashTool } from "./bash.js";
@@ -19,31 +18,28 @@ import { agentToolDef, agentTool, agentStatusToolDef, agentStatusTool, agentCanc
 import { enterPlanModeToolDef, enterPlanModeTool, exitPlanModeToolDef, exitPlanModeTool, } from "./plan.js";
 import { toolSearchToolDef, toolSearchTool } from "./tool-search.js";
 import { todoWriteToolDef, todoWriteTool } from "./task.js";
-import { enterWorktreeToolDef, enterWorktreeTool, exitWorktreeToolDef, exitWorktreeTool, switchSessionWorkspaceToolDef, switchSessionWorkspaceTool, } from "./worktree.js";
 import { sleepToolDef } from "./sleep.definition.js";
 import { sleepTool } from "./sleep.js";
 import { configToolDef, configTool } from "./config.js";
-import { notebookEditToolDef, notebookEditTool } from "./notebook-edit.js";
-import { lspToolDef, lspTool } from "./lsp.js";
 import { cronCreateToolDef, cronCreateTool, cronDeleteToolDef, cronDeleteTool, cronListTool, } from "./cron.js";
 import { cronListToolDef } from "./cron-list.definition.js";
-import { driveClaudeCodeToolDef, driveClaudeCodeTool, driveAgentToolDef, driveAgentTool, driveAgentJobsToolDef, driveAgentJobsTool, DRIVE_AGENT_TOOL_TIMEOUT_MS, } from "./drive-claude-code.js";
-import { checkQuotaToolDef, checkQuotaTool } from "./check-quota.js";
 import { skillToolDef, skillTool } from "./skill.js";
 import { mcpToolDef, mcpToolExecute, listMcpResourcesToolDef, listMcpResourcesTool, readMcpResourceToolDef, readMcpResourceTool, } from "./mcp-tools.js";
+import { listSourcesToolDef, listSourcesTool, readSourceToolDef, readSourceTool, } from "./sources.js";
 import { replToolDef, replTool } from "./repl.js";
-import { briefToolDef, briefTool } from "./brief.js";
 import { powershellToolDef, powershellTool } from "./powershell.js";
-import { arenaToolDef, arenaTool } from "./arena.js";
 import { memoryListToolDef, memoryListTool, memoryReadToolDef, memoryReadTool, memorySaveToolDef, memorySaveTool, memoryDeleteToolDef, memoryDeleteTool, } from "./memory.js";
 import { completeGoalToolDef, completeGoalTool } from "./complete-goal.js";
 import { cancelGoalToolDef, cancelGoalTool } from "./cancel-goal.js";
 import { addMarketplaceToolDef, addMarketplaceTool } from "./add-marketplace.js";
 import { bashOutputToolDef, bashOutputTool, killShellToolDef, killShellTool, listShellsToolDef, listShellsTool, } from "./background-shell-tools.js";
 import { browserObserveToolDef, browserObserveTool, browserActToolDef, browserActTool, browserNavigateToolDef, browserNavigateTool, } from "./browser-tools.js";
+import { panelToolDef, panelTool } from "./panel.js";
+import { sendMessageToSessionToolDef, sendMessageToSessionTool, rewriteSendMessageToSessionToolDefinition, } from "./send-message-to-session.js";
 import { useCredentialToolDef, useCredentialBuiltinTool, } from "../../credentials/use-credential-tool.js";
 import { injectCredentialToolDef, injectCredentialTool, isInjectCredentialAvailable, } from "../../credentials/inject-credential-tool.js";
 import { credentialAccessScope, getCredentialAccess } from "../../credentials/access.js";
+import { linkActionToolDef, linkActionTool, isLinkActionAvailable, } from "../../links/link-action-tool.js";
 const FAILURE_TEXT = /^(?:error\b|failed\b|failure\b|skill\b.*(?:not found\b|disabled\b|not available\b|allowlist\b|denied\b)|(?:[a-z][\w-]*\s+){1,3}(?:error\b|failed\b|failure\b|aborted\b|timed out\b))/i;
 function failureMessage(result) {
     if (typeof result.error === "string" && result.error)
@@ -80,7 +76,17 @@ export function toToolExecutionResult(value) {
     }
     return { ok: true, ...result };
 }
-const BUILTIN_IMPLEMENTATIONS = [
+const GENERAL_TAGS = ["general"];
+const HARNESS_TAGS = ["harness-min", "general"];
+const EXPLICIT_ONLY = [];
+function expose(presetTags, options = {}) {
+    return { presetTags, ...options };
+}
+function allow(tool) {
+    return [{ tool, decision: "allow" }];
+}
+/** One authoritative contribution record per builtin: schema, handler and product exposure. */
+const BUILTIN_CONTRIBUTIONS = [
     {
         definition: {
             ...readToolDef,
@@ -91,6 +97,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             pathPolicy: [{ kind: "arg", arg: "file_path", operation: "read" }],
         },
         execute: readTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(readToolDef.name) }),
     },
     {
         definition: {
@@ -102,6 +109,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             pathPolicy: [{ kind: "arg", arg: "file_path", operation: "write" }],
         },
         execute: writeTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -112,6 +120,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false, // serializes writes to the single catalog file
         },
         execute: editModelCatalogTool,
+        exposure: expose(GENERAL_TAGS),
     },
     {
         definition: {
@@ -132,6 +141,9 @@ const BUILTIN_IMPLEMENTATIONS = [
             pathPolicy: [{ kind: "arg", arg: "referenceImages", operation: "read" }],
         },
         execute: generateImageTool,
+        exposure: expose(GENERAL_TAGS, {
+            availability: (ctx) => isGenerateImageAvailable(ctx.cwd),
+        }),
     },
     {
         definition: {
@@ -150,6 +162,9 @@ const BUILTIN_IMPLEMENTATIONS = [
             ],
         },
         execute: generateVideoTool,
+        exposure: expose(GENERAL_TAGS, {
+            availability: (ctx) => isGenerateVideoAvailable(ctx.cwd),
+        }),
     },
     {
         definition: {
@@ -161,6 +176,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             pathPolicy: [{ kind: "arg", arg: "path", operation: "read" }],
         },
         execute: viewImageTool,
+        exposure: expose(GENERAL_TAGS),
     },
     {
         definition: {
@@ -172,17 +188,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             pathPolicy: [{ kind: "arg", arg: "file_path", operation: "write" }],
         },
         execute: editTool,
-    },
-    {
-        definition: {
-            ...applyPatchToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-            pathPolicy: [{ kind: "apply_patch", arg: "patch", operation: "write" }],
-        },
-        execute: applyPatchTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -197,6 +203,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             ],
         },
         execute: globTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(globToolDef.name) }),
     },
     {
         definition: {
@@ -208,6 +215,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             pathPolicy: [{ kind: "arg", arg: "path", operation: "read", defaultToCwd: true }],
         },
         execute: grepTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(grepToolDef.name) }),
     },
     {
         definition: {
@@ -219,6 +227,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 3_600_000, // 1h — supports long-running shell loops (e.g. `until` polling)
         },
         execute: bashTool,
+        exposure: expose(HARNESS_TAGS, { requires: ["BashOutput", "KillShell", "ListShells"] }),
     },
     // ─── Background shells (Bash run_in_background companions) ──────
     {
@@ -230,6 +239,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: bashOutputTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -240,6 +250,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: killShellTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -250,6 +261,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: listShellsTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -260,6 +272,10 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: webSearchTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: allow(webSearchToolDef.name),
+            availability: (ctx) => isWebSearchAvailable(ctx.cwd),
+        }),
     },
     {
         definition: {
@@ -270,6 +286,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: webFetchTool,
+        exposure: expose(GENERAL_TAGS, { defaultPermissionRules: allow(webFetchToolDef.name) }),
     },
     {
         definition: {
@@ -281,6 +298,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 0, // 纯等待用户操作 — 不设超时，由用户 Esc/取消
         },
         execute: askUserTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(askUserToolDef.name) }),
     },
     {
         definition: {
@@ -292,6 +310,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 1_800_000, // 30min — sub-agent runs may execute many tool calls
         },
         execute: agentTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(agentToolDef.name) }),
     },
     {
         definition: {
@@ -302,6 +321,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: agentStatusTool,
+        exposure: expose(EXPLICIT_ONLY),
     },
     {
         definition: {
@@ -312,6 +332,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: agentCancelTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(agentCancelToolDef.name) }),
     },
     {
         definition: {
@@ -323,6 +344,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 1_800_000, // 30min — a continuation may execute many tool calls, like Agent
         },
         execute: agentSendInputTool,
+        exposure: expose(EXPLICIT_ONLY),
     },
     {
         definition: {
@@ -333,6 +355,9 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: enterPlanModeTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: allow(enterPlanModeToolDef.name),
+        }),
     },
     {
         definition: {
@@ -343,6 +368,9 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: exitPlanModeTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: allow(exitPlanModeToolDef.name),
+        }),
     },
     {
         definition: {
@@ -353,6 +381,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: toolSearchTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(toolSearchToolDef.name) }),
     },
     {
         definition: {
@@ -363,38 +392,9 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: todoWriteTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(todoWriteToolDef.name) }),
     },
     // ─── Phase 4: Multi-Agent + Worktree ───────────────────────────
-    {
-        definition: {
-            ...enterWorktreeToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-        },
-        execute: enterWorktreeTool,
-    },
-    {
-        definition: {
-            ...exitWorktreeToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-        },
-        execute: exitWorktreeTool,
-    },
-    {
-        definition: {
-            ...switchSessionWorkspaceToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-        },
-        execute: switchSessionWorkspaceTool,
-    },
     // ─── Phase 5: Utility Tools ────────────────────────────────────
     {
         definition: {
@@ -405,6 +405,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: sleepTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(sleepToolDef.name) }),
     },
     {
         definition: {
@@ -415,35 +416,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: configTool,
-    },
-    {
-        definition: {
-            ...notebookEditToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-            pathPolicy: [
-                {
-                    kind: "arg",
-                    arg: "file_path",
-                    operation: { fromArg: "action", readValues: ["read"], default: "write" },
-                },
-            ],
-        },
-        execute: notebookEditTool,
-    },
-    // ─── Phase 6: LSP ─────────────────────────────────────────────
-    {
-        definition: {
-            ...lspToolDef,
-            source: "builtin",
-            permissionDefault: "allow",
-            isReadOnly: true,
-            isConcurrencySafe: true,
-            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "read" }],
-        },
-        execute: lspTool,
+        exposure: expose(HARNESS_TAGS),
     },
     // ─── Cron Tools ────────────────────────────────────────────────
     {
@@ -455,6 +428,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: cronCreateTool,
+        exposure: expose(GENERAL_TAGS),
     },
     {
         definition: {
@@ -465,6 +439,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: cronDeleteTool,
+        exposure: expose(GENERAL_TAGS),
     },
     {
         definition: {
@@ -475,57 +450,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: cronListTool,
-    },
-    // ─── Drive external coding-agent CLI (claude / codex) ──────────
-    {
-        definition: {
-            ...driveAgentToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-            timeoutMs: DRIVE_AGENT_TOOL_TIMEOUT_MS,
-            pathPolicy: [{ kind: "arg", arg: "attachmentPaths", operation: "read" }],
-        },
-        execute: driveAgentTool,
-    },
-    {
-        definition: {
-            ...driveAgentJobsToolDef,
-            source: "builtin",
-            permissionDefault: "allow",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-        },
-        execute: driveAgentJobsTool,
-    },
-    // Back-compat alias: DriveClaudeCode = DriveAgent pinned to cli:claude. Kept
-    // registered so old prompts/memories that name DriveClaudeCode still resolve.
-    {
-        definition: {
-            ...driveClaudeCodeToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-            timeoutMs: DRIVE_AGENT_TOOL_TIMEOUT_MS,
-            pathPolicy: [{ kind: "arg", arg: "attachmentPaths", operation: "read" }],
-        },
-        execute: driveClaudeCodeTool,
-    },
-    // ─── Check remaining CC/Codex subscription quota ──────────────
-    {
-        definition: {
-            ...checkQuotaToolDef,
-            source: "builtin",
-            // Read-only intent (reports quota, mutates nothing). Note: the "claude"
-            // path sends a 1-token probe (Anthropic exposes quota only via response
-            // headers) — that tiny cost is documented in the tool description.
-            permissionDefault: "allow",
-            isReadOnly: true,
-            isConcurrencySafe: true,
-        },
-        execute: checkQuotaTool,
+        exposure: expose(GENERAL_TAGS, { defaultPermissionRules: allow(cronListToolDef.name) }),
     },
     // ─── Phase 7: Missing tools from restored-src ─────────────────
     {
@@ -537,6 +462,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: skillTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(skillToolDef.name) }),
     },
     {
         definition: {
@@ -547,6 +473,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: mcpToolExecute,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -557,6 +484,9 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: listMcpResourcesTool,
+        exposure: expose(HARNESS_TAGS, {
+            defaultPermissionRules: allow(listMcpResourcesToolDef.name),
+        }),
     },
     {
         definition: {
@@ -572,48 +502,56 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: readMcpResourceTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
-            ...replToolDef,
+            ...listSourcesToolDef,
             source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
         },
-        execute: replTool,
+        execute: listSourcesTool,
+        exposure: expose(HARNESS_TAGS, {
+            defaultPermissionRules: allow(listSourcesToolDef.name),
+        }),
     },
     {
         definition: {
-            ...briefToolDef,
+            ...readSourceToolDef,
             source: "builtin",
-            permissionDefault: "allow",
+            // Source content is untrusted and may contain sensitive workspace data.
+            // Match ReadMcpResource: every read requires explicit approval, while
+            // the executor performs a second source/scope/resource authorization.
+            permissionDefault: "ask",
             isReadOnly: true,
             isConcurrencySafe: true,
         },
-        execute: briefTool,
+        execute: readSourceTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
-            ...powershellToolDef,
+            ...replToolDef,
             source: "builtin",
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
         },
-        execute: powershellTool,
+        execute: replTool,
+        exposure: expose(GENERAL_TAGS),
     },
-    // ─── Arena: Multi-Model Collaborative Analysis ────────────────
     {
         definition: {
-            ...arenaToolDef,
+            ...powershellToolDef,
             source: "builtin",
             permissionDefault: "ask",
-            isReadOnly: true,
+            isReadOnly: false,
             isConcurrencySafe: false,
-            timeoutMs: 1_800_000, // 30min — multi-model debate rounds take time
         },
-        execute: arenaTool,
+        execute: powershellTool,
+        exposure: expose(GENERAL_TAGS),
     },
     // ─── Memory tools (persistent cross-session memory) ────────────
     // Save/Delete default to "ask" so user-scope modifications go through a
@@ -629,6 +567,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: memoryListTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(memoryListToolDef.name) }),
     },
     {
         definition: {
@@ -639,6 +578,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: memoryReadTool,
+        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(memoryReadToolDef.name) }),
     },
     {
         definition: {
@@ -649,6 +589,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: memorySaveTool,
+        exposure: expose(HARNESS_TAGS),
     },
     {
         definition: {
@@ -659,6 +600,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: memoryDeleteTool,
+        exposure: expose(HARNESS_TAGS),
     },
     // ─── Goal mode: model-declared completion ──────────────────────
     // Lets the model explicitly declare the active goal complete. The
@@ -673,6 +615,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: completeGoalTool,
+        exposure: expose(HARNESS_TAGS, { availability: (ctx) => ctx.hasGoal === true }),
     },
     // ─── Goal mode: user-initiated cancellation ────────────────────
     // Distinct from complete_goal — the user explicitly asked to abandon the
@@ -688,6 +631,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: cancelGoalTool,
+        exposure: expose(HARNESS_TAGS, { availability: (ctx) => ctx.hasGoal === true }),
     },
     // ─── Plugin marketplace: model-driven source registration ──────
     {
@@ -700,6 +644,7 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 120_000, // git clone over network
         },
         execute: addMarketplaceTool,
+        exposure: expose(GENERAL_TAGS),
     },
     // Browser automation — 3 semantic tools driving the in-app webview via the
     // BrowserBridge (CDP). All serial on one webview (isConcurrencySafe:false).
@@ -719,6 +664,10 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 30_000, // wait/observe can sit through a load; RPC headroom
         },
         execute: browserObserveTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: allow(browserObserveToolDef.name),
+            promptSections: ["browser"],
+        }),
     },
     {
         definition: {
@@ -730,6 +679,17 @@ const BUILTIN_IMPLEMENTATIONS = [
             timeoutMs: 30_000, // the wait action internally bounds; give RPC headroom
         },
         execute: browserActTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: [
+                {
+                    tool: browserActToolDef.name,
+                    argsPattern: { action: "^(click|type|select)$" },
+                    decision: "ask",
+                    reason: "browser_act click/type/select mutate the page",
+                },
+            ],
+            promptSections: ["browser"],
+        }),
     },
     {
         definition: {
@@ -740,6 +700,58 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: browserNavigateTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: allow(browserNavigateToolDef.name),
+            promptSections: ["browser"],
+        }),
+    },
+    // Generic host-panel control. The bridge is injected only by interactive
+    // Desktop sessions; plugin tools can call the same ctx.panels service.
+    {
+        definition: {
+            ...panelToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: panelTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: [
+                {
+                    tool: panelToolDef.name,
+                    argsPattern: { action: "^(list|open|tools)$" },
+                    decision: "allow",
+                },
+                {
+                    tool: panelToolDef.name,
+                    argsPattern: { action: "^invoke$" },
+                    decision: "ask",
+                    reason: "Panel App Agent tools can read or change project design data",
+                },
+            ],
+            availability: (ctx) => ctx.host === "desktop" && ctx.isSubAgent !== true,
+        }),
+    },
+    // Cross-Session coordination is one ordinary message send. The host supplies
+    // a closed same-project target set and queues the message as the target's
+    // next user turn.
+    {
+        definition: {
+            ...sendMessageToSessionToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: sendMessageToSessionTool,
+        exposure: expose(HARNESS_TAGS, {
+            defaultPermissionRules: allow(sendMessageToSessionToolDef.name),
+            availability: (ctx) => ctx.isSubAgent !== true &&
+                ctx.behaviorProfile !== "quickChatRestricted" &&
+                (ctx.sessionMessageTargets?.length ?? 0) > 0,
+            rewriteDefinition: rewriteSendMessageToSessionToolDefinition,
+        }),
     },
     // ─── Credentials: AI 取用已存凭证(token/link/cookie) ──────────
     // permissionDefault:"allow" 是展示/声明 hint；取用审批由工具内部的
@@ -754,6 +766,26 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: true,
         },
         execute: useCredentialBuiltinTool,
+        exposure: expose(GENERAL_TAGS, {
+            availability: (ctx) => isUseCredentialAvailable(ctx.cwd, ctx.settingsScope),
+        }),
+    },
+    // Local Link actions resolve their provider-owned credential on every call.
+    // Read actions are allowed after the user connects a provider; write actions
+    // use a closed, in-tool approval prompt so read and write share one catalog.
+    {
+        definition: {
+            ...linkActionToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: true,
+        },
+        execute: linkActionTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: allow(linkActionToolDef.name),
+            availability: (ctx) => isLinkActionAvailable(ctx.cwd, ctx.settingsScope),
+        }),
     },
     // InjectCredential:把 cookie 凭证注入内置浏览器(恢复登录态)。审批由工具内部
     // CredentialUseGate 负责(逐条 autoInjectByAI),permissionDefault:"allow" 仅作展示 hint。
@@ -767,33 +799,71 @@ const BUILTIN_IMPLEMENTATIONS = [
             isConcurrencySafe: false,
         },
         execute: injectCredentialTool,
+        exposure: expose(GENERAL_TAGS, {
+            availability: (ctx) => isInjectCredentialAvailable(ctx.cwd, ctx.settingsScope),
+        }),
     },
 ];
-export const BUILTIN_TOOLS = BUILTIN_IMPLEMENTATIONS.map(({ definition, execute }) => ({
+export const BUILTIN_TOOLS = BUILTIN_CONTRIBUTIONS.map(({ definition, execute, exposure }) => ({
     definition,
+    exposure,
     execute: async (args, ctx) => toToolExecutionResult(await execute(args, ctx)),
 }));
-/**
- * Per-tool availability predicates. A tool listed here is filtered OUT of the
- * exposed toolDefs when its predicate returns false for the active cwd (see
- * engine.ts toolDefs assembly). Tools NOT listed here are always visible.
- * Keyed by the tool's `name` (must match the toolDef name).
- */
-export const BUILTIN_TOOL_GUARDS = new Map([
-    [webSearchToolDef.name, (ctx) => isWebSearchAvailable(ctx.cwd)],
-    [generateImageToolDef.name, (ctx) => isGenerateImageAvailable(ctx.cwd)],
-    [generateVideoToolDef.name, (ctx) => isGenerateVideoAvailable(ctx.cwd)],
-    // UseCredential is hidden until at least one credential exists — keeps it out
-    // of the tool list (and the context) for the common no-credentials case,
-    // matching the spec's "quiet when empty" intent (true ToolSearch-deferral for
-    // builtins isn't wired in the engine).
-    [useCredentialToolDef.name, (ctx) => isUseCredentialAvailable(ctx.cwd, ctx.settingsScope)],
-    // InjectCredential hidden until ≥1 cookie credential exists (browser injection
-    // is cookie-only). Also degrades at call time if no browser bridge is wired.
-    [injectCredentialToolDef.name, (ctx) => isInjectCredentialAvailable(ctx.cwd, ctx.settingsScope)],
-    [completeGoalToolDef.name, (ctx) => ctx.hasGoal === true],
-    [cancelGoalToolDef.name, (ctx) => ctx.hasGoal === true],
-]);
+const KNOWN_TOOL_PROMPT_SECTIONS = new Set(["browser"]);
+export function validateBuiltinToolExposures(tools = BUILTIN_TOOLS) {
+    const byName = new Map(tools.map((tool) => [tool.definition.name, tool]));
+    if (byName.size !== tools.length)
+        throw new Error("Builtin tool catalog contains duplicate names");
+    for (const tool of tools) {
+        const { name } = tool.definition;
+        if (!Array.isArray(tool.exposure.presetTags)) {
+            throw new Error(`Builtin tool '${name}' is missing presetTags`);
+        }
+        for (const section of tool.exposure.promptSections ?? []) {
+            if (!KNOWN_TOOL_PROMPT_SECTIONS.has(section)) {
+                throw new Error(`Builtin tool '${name}' references unknown prompt section '${section}'`);
+            }
+        }
+        for (const requiredName of tool.exposure.requires ?? []) {
+            const required = byName.get(requiredName);
+            if (!required)
+                throw new Error(`Builtin tool '${name}' requires unknown tool '${requiredName}'`);
+            for (const tag of tool.exposure.presetTags) {
+                if (!required.exposure.presetTags.includes(tag)) {
+                    throw new Error(`Builtin tool '${name}' requires '${requiredName}' in preset '${tag}'`);
+                }
+            }
+        }
+    }
+}
+validateBuiltinToolExposures();
+/** Derive a preset's tool list and safe defaults from any composed tool catalog. */
+export function derivePresetExposure(tag, tools = BUILTIN_TOOLS) {
+    const selected = tools.filter((tool) => tool.exposure.presetTags.includes(tag));
+    return {
+        builtinTools: selected.map((tool) => tool.definition.name),
+        defaultPermissionRules: selected.flatMap((tool) => [
+            ...(tool.exposure.defaultPermissionRules ?? []),
+        ]),
+    };
+}
+/** Backwards-compatible name for callers deriving only from the core catalog. */
+export function deriveBuiltinPresetExposure(tag) {
+    return derivePresetExposure(tag, BUILTIN_TOOLS);
+}
+export function deriveToolGatedPromptSections(tools = BUILTIN_TOOLS) {
+    const result = {};
+    for (const tool of tools) {
+        for (const section of tool.exposure.promptSections ?? []) {
+            (result[section] ??= []).push(tool.definition.name);
+        }
+    }
+    return result;
+}
+/** Compatibility view consumed by engine + executor; metadata is authoritative. */
+export const BUILTIN_TOOL_GUARDS = new Map(BUILTIN_TOOLS.flatMap((tool) => tool.exposure.availability
+    ? [[tool.definition.name, tool.exposure.availability]]
+    : []));
 /** UseCredential is available when the cwd's credential metadata has ≥1 entry. */
 export function isUseCredentialAvailable(cwd, settingsScope) {
     try {