@retinue/agentkit 0.1.0 → 0.3.0

package/dist/tools/library/index.d.ts

@@ -20,12 +20,15 @@
  * replay protection is the failure this envelope exists to prevent, and a deployment should hear about it the
  * first time rather than after.
  */
+export { createFsListTool, createFsReadTool, createFsSearchTool, createFsWriteTool } from "./fs.js";
+export { createShellExecTool, shellDisabled } from "./shell.js";
+export type { ShellToolConfig } from "./shell.js";
 import type { DelegatingToolDeps } from "../delegating.js";
 import type { ToolProvider } from "../index.js";
 import type { ExecutionContext } from "../../core/context.js";
 import type { ExtractionService } from "../../documents/extraction.js";
 import type { FileService } from "../../files/index.js";
-import type { HttpClient, HttpClientConfig, ReadOnlyQuery, SearchProvider } from "../../toolkit/index.js";
+import type { FileReader, FileScope, HttpClient, HttpClientConfig, ReadOnlyQuery, Sandbox, SearchProvider } from "../../toolkit/index.js";
 import type { KnowledgeRetriever } from "./knowledge.js";
 import type { RetrievalMode } from "../../knowledge/retrieval.js";
 /**
@@ -34,7 +37,7 @@ import type { RetrievalMode } from "../../knowledge/retrieval.js";
  * A closed list so `exclude` is checked against it: a typo in an exclusion is otherwise a tool that stays enabled
  * and a deployment that believes it is off.
  */
-export declare const STANDARD_TOOL_NAMES: readonly ["fetch_url", "fetch_json", "web_search", "http_request", "http_write", "parse_csv", "query_json", "sql_query", "sql_schema", "search_knowledge", "read_attachment", "list_attachments", "read_document", "now", "calculate"];
+export declare const STANDARD_TOOL_NAMES: readonly ["fetch_url", "fetch_json", "web_search", "http_request", "http_write", "parse_csv", "query_json", "sql_query", "sql_schema", "search_knowledge", "read_attachment", "list_attachments", "read_document", "now", "calculate", "fs_read", "fs_list", "fs_search", "fs_write", "shell_exec"];
 export type StandardToolName = (typeof STANDARD_TOOL_NAMES)[number];
 /**
  * The categories these tools use.
@@ -82,6 +85,30 @@ export type StandardToolsConfig = {
     readonly files?: FileService;
     /** Enables `read_document`. */
     readonly documents?: ExtractionService;
+    /**
+     * A path-scoped filesystem — REQ-047 (#206), task #215.
+     *
+     * Supplying a `root` enables `fs_read`, `fs_list` and `fs_search`. `fs_write` needs a `writableRoot` as well,
+     * and it must be a *different* directory: pointing both at the same place lets a model edit the material it
+     * also reads, which is how a corpus a model cites becomes a corpus a model wrote.
+     */
+    readonly filesystem?: FileScope | {
+        readonly reader: FileReader;
+        readonly writable: boolean;
+    };
+    /**
+     * A sandbox, which is what makes `shell_exec` exist — task #215.
+     *
+     * Two switches, deliberately, and the only tool in the library with two: a sandbox wired *and* the `shell`
+     * capability declared. Everywhere else wiring is the toggle, because a second switch is usually how a
+     * deployment ends up with something switched on and wired to nothing. Here the failure mode runs the other
+     * way — "somebody wired a sandbox for a test and forgot" must not silently mean the agent can run commands on
+     * a machine.
+     *
+     * `shellEnabled` is a function, so the declaration is read at the call rather than captured at construction.
+     */
+    readonly sandbox?: Sandbox;
+    readonly shellEnabled?: () => boolean;
     /** Injected so a test can pin `now`. */
     readonly clock?: () => Date;
     readonly exclude?: readonly StandardToolName[];
@@ -94,4 +121,12 @@ export { createHttpRequestTool, createHttpWriteTool } from "./http.js";
 export { createSearchKnowledgeTool } from "./knowledge.js";
 export type { KnowledgeRetriever } from "./knowledge.js";
 export { createFetchJsonTool, createFetchUrlTool, createWebSearchTool } from "./web.js";
+/**
+ * Audio — REQ-062 (#257), task #258.
+ *
+ * Library tools rather than a `tools-media` package, and the reason is argued in `audio.ts`: they take ports,
+ * not a vendor, exactly as `createWebSearchTool` does.
+ */
+export { createSpeechGenerateTool, createTranscribeTool } from "./audio.js";
+export type { AudioToolDeps } from "./audio.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/library/index.js

@@ -25,9 +25,14 @@ import { createParseCsvTool, createQueryJsonTool, createSqlQueryTool, createSqlS
 import { createHttpRequestTool, createHttpWriteTool } from "./http.js";
 import { createSearchKnowledgeTool } from "./knowledge.js";
 import { createFetchJsonTool, createFetchUrlTool, createWebSearchTool } from "./web.js";
+import { createFsListTool, createFsReadTool, createFsSearchTool, createFsWriteTool } from "./fs.js";
+import { createShellExecTool } from "./shell.js";
+export { createFsListTool, createFsReadTool, createFsSearchTool, createFsWriteTool } from "./fs.js";
+export { createShellExecTool, shellDisabled } from "./shell.js";
 import { createHttpClient } from "../../toolkit/http.js";
 import { createFetchJson, createFetchPage, createWebSearch } from "../../toolkit/web.js";
 import { createSqlQuery, createSqlSchema } from "../../toolkit/data.js";
+import { createFileReader } from "../../toolkit/files.js";
 import { createReadAttachmentTool, createListAttachmentsTool } from "../../files/read-tool.js";
 import { createReadDocumentTool } from "../../documents/read-tool.js";
 /**
@@ -52,6 +57,11 @@ export const STANDARD_TOOL_NAMES = [
     "read_document",
     "now",
     "calculate",
+    "fs_read",
+    "fs_list",
+    "fs_search",
+    "fs_write",
+    "shell_exec",
 ];
 /**
  * The categories these tools use.
@@ -81,6 +91,17 @@ export const createStandardToolProvider = (config) => {
         ? undefined
         : createSqlQuery({ query: config.sql.query, readOnly: config.sql.readOnly, ...(config.sql.maxRows === undefined ? {} : { maxRows: config.sql.maxRows }) });
     const describeSql = config.sql?.schemas === undefined ? undefined : createSqlSchema({ query: config.sql.query, schemas: config.sql.schemas });
+    /**
+     * The file reader, built once.
+     *
+     * A caller may hand over a `FileReader` it already has instead of a scope — the same shape the HTTP config
+     * takes a `client` for, and the same reason: one place decides what is readable.
+     */
+    const filesystem = config.filesystem === undefined
+        ? undefined
+        : "reader" in config.filesystem
+            ? { reader: config.filesystem.reader, writable: config.filesystem.writable }
+            : { reader: createFileReader(config.filesystem), writable: config.filesystem.writableRoot !== undefined };
     const fixed = [
         ["fetch_url", () => createFetchUrlTool(deps, fetchPage)],
         ["fetch_json", () => createFetchJsonTool(deps, fetchJson)],
@@ -96,6 +117,19 @@ export const createStandardToolProvider = (config) => {
         ["read_document", () => createReadDocumentTool({ extraction: config.documents })],
         ["now", () => createNowTool(deps, config.clock)],
         ["calculate", () => createCalculateTool(deps)],
+        ["fs_read", () => createFsReadTool(deps, filesystem.reader)],
+        ["fs_list", () => createFsListTool(deps, filesystem.reader)],
+        ["fs_search", () => createFsSearchTool(deps, filesystem.reader)],
+        ["fs_write", () => createFsWriteTool(deps, filesystem.reader)],
+        [
+            "shell_exec",
+            () => createShellExecTool(deps, {
+                sandbox: config.sandbox,
+                // Absent means not declared. The uncomfortable direction on purpose: a forgotten declaration turns the
+                // tool off rather than on.
+                enabled: config.shellEnabled ?? (() => false),
+            }),
+        ],
     ];
     /** What each tool needs before it can exist. A tool with no entry needs nothing. */
     const wired = {
@@ -109,6 +143,12 @@ export const createStandardToolProvider = (config) => {
         search_knowledge: config.knowledge !== undefined,
         read_attachment: config.files !== undefined,
         read_document: config.documents !== undefined,
+        fs_read: filesystem !== undefined,
+        fs_list: filesystem !== undefined,
+        fs_search: filesystem !== undefined,
+        // A writable root, separately: the three reads are useful on their own, and most deployments want only those.
+        fs_write: filesystem?.writable === true,
+        shell_exec: config.sandbox !== undefined,
     };
     const tools = fixed
         .filter(([name]) => !excluded.has(name) && (wired[name] ?? true))
@@ -131,4 +171,11 @@ export { createParseCsvTool, createQueryJsonTool, createSqlQueryTool, createSqlS
 export { createHttpRequestTool, createHttpWriteTool } from "./http.js";
 export { createSearchKnowledgeTool } from "./knowledge.js";
 export { createFetchJsonTool, createFetchUrlTool, createWebSearchTool } from "./web.js";
+/**
+ * Audio — REQ-062 (#257), task #258.
+ *
+ * Library tools rather than a `tools-media` package, and the reason is argued in `audio.ts`: they take ports,
+ * not a vendor, exactly as `createWebSearchTool` does.
+ */
+export { createSpeechGenerateTool, createTranscribeTool } from "./audio.js";
 //# sourceMappingURL=index.js.map

package/dist/tools/library/shell.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Running a command — REQ-047 (#206), task #215.
+ *
+ * An envelope over `toolkit/sandbox.ts`, and the most consequential tool in the package. Read the note at the top
+ * of that module before wiring this: the tool is only defensible because of what the sandbox guarantees, and the
+ * local adapter guarantees almost none of it.
+ *
+ * ## Three things this envelope does, and one it deliberately does not
+ *
+ * **`destructive`, so the approval gate always fires.** Not because every command is destructive — `ls` is not —
+ * but because the classification is what the gate reads, and a tool whose worst case is "anything" has to be
+ * classified by its worst case.
+ *
+ * **An idempotency key is required.** A retried `shell_exec` must not run twice: the first result is returned
+ * instead. A command that appended a line to a file would otherwise append two on a network hiccup.
+ *
+ * **The capability must be declared.** Wiring a sandbox is not enough; `shell: "on"` has to be in the runtime's
+ * capability declaration, and this is checked at the *call*. Two switches for one decision is usually a smell —
+ * see `web_search`, where wiring alone is the toggle — and here it is deliberate: this is the one tool where
+ * "somebody wired a sandbox for a test and forgot" must not silently mean the agent can run commands.
+ *
+ * **What it does not do is read the command.** No refusing `rm -rf`, no allow-list of binaries. That is a losing
+ * game — `find . -delete`, `dd`, `python -c`, a base64 pipeline — and worse, it *feels* like protection while
+ * being a list somebody gets around. The classification cannot be evaded by rephrasing.
+ */
+import type { DelegatingToolDeps } from "../delegating.js";
+import type { Tool } from "../index.js";
+import type { Sandbox, SandboxResult } from "../../toolkit/index.js";
+export type ShellToolConfig = {
+    readonly sandbox: Sandbox;
+    /**
+     * Whether the runtime declared the `shell` capability.
+     *
+     * A function rather than a boolean, so the answer is read at the call. A capability map captured at
+     * construction is a capability map that cannot be turned off without a restart, and this is the one tool where
+     * that matters.
+     */
+    readonly enabled: () => boolean;
+};
+/** What a refused call returns. Shaped like a result, because the model can act on a reason and not on a throw. */
+export declare const shellDisabled: () => SandboxResult & {
+    readonly refused: string;
+};
+export declare const createShellExecTool: (deps: DelegatingToolDeps, config: ShellToolConfig) => Tool;
+//# sourceMappingURL=shell.d.ts.map

package/dist/tools/library/shell.js

@@ -0,0 +1,70 @@
+/**
+ * Running a command — REQ-047 (#206), task #215.
+ *
+ * An envelope over `toolkit/sandbox.ts`, and the most consequential tool in the package. Read the note at the top
+ * of that module before wiring this: the tool is only defensible because of what the sandbox guarantees, and the
+ * local adapter guarantees almost none of it.
+ *
+ * ## Three things this envelope does, and one it deliberately does not
+ *
+ * **`destructive`, so the approval gate always fires.** Not because every command is destructive — `ls` is not —
+ * but because the classification is what the gate reads, and a tool whose worst case is "anything" has to be
+ * classified by its worst case.
+ *
+ * **An idempotency key is required.** A retried `shell_exec` must not run twice: the first result is returned
+ * instead. A command that appended a line to a file would otherwise append two on a network hiccup.
+ *
+ * **The capability must be declared.** Wiring a sandbox is not enough; `shell: "on"` has to be in the runtime's
+ * capability declaration, and this is checked at the *call*. Two switches for one decision is usually a smell —
+ * see `web_search`, where wiring alone is the toggle — and here it is deliberate: this is the one tool where
+ * "somebody wired a sandbox for a test and forgot" must not silently mean the agent can run commands.
+ *
+ * **What it does not do is read the command.** No refusing `rm -rf`, no allow-list of binaries. That is a losing
+ * game — `find . -delete`, `dd`, `python -c`, a base64 pipeline — and worse, it *feels* like protection while
+ * being a list somebody gets around. The classification cannot be evaded by rephrasing.
+ */
+import { z } from "zod";
+import { defineDelegatingTool } from "../delegating.js";
+const shellSchema = z
+    .object({
+    command: z
+        .string()
+        .min(1)
+        .max(4_000)
+        .describe("A shell command. It runs in an isolated sandbox with no network and a writable /scratch only."),
+    timeoutMs: z.number().int().min(100).max(120_000).optional(),
+})
+    .strict();
+/** What a refused call returns. Shaped like a result, because the model can act on a reason and not on a throw. */
+export const shellDisabled = () => ({
+    ok: false,
+    exitCode: null,
+    stdout: "",
+    stderr: "",
+    truncated: false,
+    durationMs: 0,
+    refused: "shell_exec is wired but the `shell` capability is not declared for this runtime, so no command will run. " +
+        "This is a deliberate second switch on the one tool whose blast radius is the machine.",
+});
+export const createShellExecTool = (deps, config) => defineDelegatingTool(deps, {
+    name: "shell_exec",
+    label: "Run a command",
+    description: "Run a shell command inside an isolated sandbox: no network, a read-only filesystem apart from /scratch, a " +
+        "memory cap and a wall-clock timeout. Returns stdout, stderr and the exit code. This always requires a " +
+        "human's approval before it runs, whatever the command is. Output is truncated when long, and says so.",
+    category: "code",
+    effect: "destructive",
+    approvalPolicy: "always",
+    requiresIdempotencyKey: true,
+    inputSchema: shellSchema,
+    delegatesTo: "toolkit/sandbox.run",
+    delegate: async (input) => {
+        if (!config.enabled())
+            return shellDisabled();
+        return config.sandbox.run({
+            command: input.command,
+            ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
+        });
+    },
+});
+//# sourceMappingURL=shell.js.map

package/dist/tools/meta-tools.js

@@ -26,6 +26,14 @@ const meta = (name, label, description) => ({
 });
 export const META_TOOL_DESCRIPTORS = {
     learn_tools: meta("learn_tools", "Learn tools", "Fetch the full input/output schemas for named tools before using them."),
+    /**
+     * REQ-045 (#204), task #210.
+     *
+     * The description says "not all of them are listed", and that sentence is doing real work: a model that
+     * believes the catalogue it can see is complete will not search, and a budget that dropped fourteen tools
+     * would then behave exactly like fourteen tools that do not exist.
+     */
+    find_tools: meta("find_tools", "Find tools", "Search for a tool by describing what you need to do. Not all available tools are listed in the catalogue, so search before concluding that something cannot be done. Returns names and descriptions; use learn_tools for a schema."),
     execute_tool: meta("execute_tool", "Execute tool", "Run a tool by name with validated input; authorization is rechecked at execution."),
     load_skill: meta("load_skill", "Load skill", "Load a named skill's instructions into context on demand."),
     ask_questions: meta("ask_questions", "Ask questions", "Ask the user consequential questions that cannot be resolved from context or tools."),

package/dist/tools/registry.d.ts

@@ -16,10 +16,13 @@
  *   result instead of firing the side effect twice.
  */
 import type { ExecutionContext } from "../core/context.js";
+import type { PlatformError } from "../core/errors.js";
 import type { BlobRef } from "../core/ids.js";
 import { type AuthorizationPolicy } from "../authorization/index.js";
 import { type IdempotencyStore } from "../idempotency/index.js";
 import type { BlobStore } from "../persistence/index.js";
+import { type TokenBudget } from "../core/budget.js";
+import type { ToolSearch, ToolSearchOutcome } from "./find.js";
 import type { OneTimeApprovalRef, ShadowRecorder, ToolCatalogEntry, ToolDescriptor, ToolProvider, ToolResult } from "./index.js";
 /** Validates a tool input against its (opaque) `inputSchema`. Default duck-types a zod schema. */
 export interface SchemaValidator {
@@ -33,6 +36,55 @@ export interface SchemaValidator {
 }
 /** Default validator: run a zod-like schema's `safeParse`; pass through anything else (tool self-validates). */
 export declare const zodishValidator: SchemaValidator;
+/**
+ * `execute_tool({ name, input })` → the call it names. Anything else passes through untouched.
+ *
+ * Refuses to target another meta-tool: `execute_tool` calling itself is an unbounded recursion a model can start
+ * with one call, and the others have their own entry points. One level of indirection is the feature; a stack of
+ * it is a way to hide what a call actually was from every log that records the outer name.
+ */
+export type ExecuteToolRequest = {
+    name: string;
+    input: unknown;
+    idempotencyKey?: string;
+    toolCallId?: string;
+    approval?: OneTimeApprovalRef;
+};
+export declare const unwrapExecuteTool: (request: ExecuteToolRequest) => ExecuteToolRequest | {
+    readonly error: PlatformError;
+};
+/**
+ * What a tenant has switched on — REQ-045 (#204), task #210, AC-4.
+ *
+ * Authorization answers *may this principal use this tool*. Nothing answered *does this tenant want it at all*,
+ * and without the second question a catalogue is only ever as small as its largest customer: every tenant pays
+ * the context cost of every integration anybody wired.
+ *
+ * Categories rather than names, deliberately. A tenant switching off `communication` should not have to name
+ * five Slack tools and then miss the sixth when it ships.
+ */
+export type TenantToolset = {
+    /** An allow-list. Present means *only* these categories, which is the safer shape for a tenant opting in. */
+    readonly enabledCategories?: readonly string[];
+    /** A deny-list, applied after any allow-list. */
+    readonly disabledCategories?: readonly string[];
+};
+/**
+ * Resolves a tenant's toolset. A port, because where this lives is a deployment's decision — a column, a
+ * settings service, a static map.
+ */
+export interface ToolsetResolver {
+    resolve(context: ExecutionContext): Promise<TenantToolset>;
+}
+/**
+ * Categories a tenant may not switch off.
+ *
+ * `meta` is the model's route back to everything else. A tenant that disabled it would have an agent that cannot
+ * learn a schema or search the catalogue — which is not a smaller toolset, it is a broken one.
+ */
+export declare const UNDISABLEABLE_CATEGORIES: readonly string[];
+/** Whether a category survives a tenant's toolset. Exported because the filtering is worth testing directly. */
+export declare const categoryEnabled: (toolset: TenantToolset, category: string) => boolean;
 export type ToolPolicyView = {
     readonly preloaded: readonly string[];
     readonly categories: readonly string[];
@@ -45,7 +97,49 @@ export type ToolCatalog = {
     readonly discoverable: readonly ToolCatalogEntry[];
     /** Always-present meta-tools. */
     readonly meta: readonly ToolCatalogEntry[];
+    /**
+     * Present only when a budget bound — REQ-045 (#204), task #210, AC-3.
+     *
+     * On the catalogue as well as in the run event log, because the two have different readers: the event is for
+     * whoever reviews the run afterwards, and this is for the client rendering the catalogue *now*. A UI showing
+     * a shortened list with no indication it was shortened is the same invisible failure in a different place.
+     */
+    readonly truncation?: {
+        readonly budgetTokens: number;
+        readonly residentTokens: number;
+        readonly dropped: readonly string[];
+        readonly findable: boolean;
+        readonly overBudget: boolean;
+    };
+    /**
+     * The tenant's toolset as it was applied — AC-4's "visible in the capability declaration".
+     *
+     * This catalogue *is* the declaration a client reads: it is the only place the platform states what an agent
+     * can do. A tenant setting that silently narrowed it, with nothing in the answer saying so, would be
+     * indistinguishable from tools that were never built.
+     */
+    readonly toolset?: TenantToolset;
 };
+/**
+ * Loads a skill body by name — the execution half of `load_skill`.
+ *
+ * Kept structural (no `skills` import) so `tools` does not depend on `skills`. Returns `null` for a name the
+ * tenant does not have, so an unknown skill is a message rather than a throw.
+ */
+export interface SkillBodyLoader {
+    load(context: ExecutionContext, name: string): Promise<{
+        readonly name: string;
+        readonly version: number;
+        readonly instructions: string;
+    } | null>;
+}
+/**
+ * How many distinct skills one run may pull into context.
+ *
+ * Mirrors `SKILL_LIMITS.maxLoadedPerRun`, duplicated rather than imported for the same layering reason as
+ * `SkillBodyLoader`. A test asserts the two agree, so the copy cannot drift silently.
+ */
+export declare const MAX_SKILLS_LOADED_PER_RUN = 5;
 /** Structural approval check (satisfied by the HITL `ApprovalGate`) — kept structural to avoid a
  * tools→hitl dependency. Returns false when the tool needs approval and the call carries neither a
  * standing grant nor a valid one-time approval. */
@@ -127,9 +221,61 @@ export type ToolRegistryConfig = {
      * than performed, the same fail-closed rule as the envelope's.
      */
     readonly shadow?: ShadowRecorder;
+    /**
+     * Search over the catalogue, which is what makes `find_tools` exist — AC-1.
+     *
+     * Absent means no `find_tools` in the catalogue at all, rather than one that always answers "not configured".
+     * Wiring is the toggle, the same rule the tool library already follows for `web_search`.
+     */
+    readonly search?: ToolSearch;
+    /**
+     * Loads a named skill's body, when the deployment has skills — task #244.
+     *
+     * Structural rather than importing `SkillResolver`, for the reason `ApprovalCheck` is structural: `tools` must
+     * not depend on `skills`. `createSkillBodyLoader` in `skills/` adapts a resolver to this shape.
+     *
+     * Wiring is the toggle. `load_skill` has been in `META_TOOLS` since the registry was written with **nothing
+     * implementing it** — the third instance of that exact pattern after `execute_tool` and `learn_tools` (#210).
+     * A model handed the descriptor would call it, get "Unknown tool load_skill", and a transcript reader would
+     * see a broken platform. So the descriptor is now advertised only when this is wired, which is the rule
+     * `find_tools` already follows.
+     */
+    readonly skills?: SkillBodyLoader;
+    /** A tenant's category switches, applied *before* authorization filtering — AC-4. */
+    readonly toolsets?: ToolsetResolver;
+    /**
+     * A ceiling in tokens on the discoverable catalogue — AC-3.
+     *
+     * Applies to the compact entries only. Preloaded tools are an explicit instruction from the host and are not
+     * silently withdrawn; a host that preloads more than its own budget is told so through `overBudget` rather
+     * than having its instruction quietly reversed.
+     */
+    readonly catalogBudget?: TokenBudget;
 };
 export interface ToolRegistry {
     catalog(context: ExecutionContext, policy: ToolPolicyView): Promise<ToolCatalog>;
+    /**
+     * Search the catalogue — AC-1.
+     *
+     * Filtered by the same authorization policy as discovery, which is not a nicety: an unfiltered search is an
+     * enumeration oracle. A principal who cannot see `github_merge_pull_request` in the catalogue but can confirm
+     * it exists by searching for "merge" has learned what the deployment does, and hiding a tool from discovery
+     * while making it findable is worse than not hiding it, because it looks like it was hidden.
+     */
+    find(context: ExecutionContext, input: {
+        readonly query: string;
+        readonly limit?: number;
+    }): Promise<ToolSearchOutcome>;
+    /**
+     * Every tool this caller may use, with schemas — the list `buildTools` should hand a model.
+     *
+     * Exists because the embedded facade was doing this itself: gathering providers, flattening, and filtering by
+     * authorization, in its own copy of the four lines this registry already owns. The copy had no duplicate-name
+     * check and no tenant toolset, so a category a tenant had switched off was invisible in the catalogue, absent
+     * from `find_tools`, refused at execution — and *still handed to the model*, which would then call it and be
+     * refused. One implementation, and this is it.
+     */
+    listAuthorized(context: ExecutionContext): Promise<readonly ToolDescriptor[]>;
     learn(context: ExecutionContext, names: readonly string[]): Promise<readonly ToolDescriptor[]>;
     execute(context: ExecutionContext, input: {
         name: string;