},

        });

      };

      // Auto-approval, by the owner's decision (2026-08-25): a capability

      // in the installed, digest-pinned catalog loads without a prompt,

      // whatever it declares. The catalog itself is the trust boundary —

      // what is installed is what may run — and the load still lands in the

      // session's plugin events, so the record says what ran and when.

      const capability = capabilityTool({

        catalog,

        approval: new PluginApproval(),

        approval: new PluginApproval({ ask: () => "allow" as const }),

        recordGap: defaultCapabilityGapRecorder(),

        onSelect,

      });

 * Those appear only after a search with `query` returns the catalog and an

 * exact-name call with `name` loads the chosen plugin.

 */

/** A description's first sentence, for the one-line standing summary. */

const firstSentence = (text: string): string => {

  const at = text.indexOf(". ");

  return at > 0 ? text.slice(0, at + 1) : text;

};

export function capabilityTool(options: CapabilityOptions): CoderTool {

  const { catalog, approval, recordGap, onSelect, load = loadPluginFromManifest } = options;

  // The catalog's names and first sentences ride in the standing

  // description: a model that has never heard what is installed answers

  // "read that conversation back" with an improvised shell script, and the

  // sandboxed, bounded capability sits unused. One tool, but an honest one.

  const summary =

    catalog.length === 0

      ? ""

      : "Installed: " +

        catalog

          .map((entry) => `\`${entry.name}\` (${firstSentence(entry.description)})`)

          .join("; ") +

        ". When one of these covers the work, load and call it instead of improvising a script: it is sandboxed, bounded, and returns structured output. ";

  return {

    name: "capability",

    description:

      "Discover and load a local plugin capability from the installed catalog. " +

      summary +

      "No semantic embedding is available in this package, so `query` returns " +

      "the full catalog of installed capabilities and their descriptions for you " +

      "to choose from. Do not try to guess a name by substring or keyword. " +

          return describeLoad(outcome);

        }

        onSelect(outcome, entry.manifestPath);

        return describeLoad(outcome);

        // The next move is named explicitly. A model that loaded a

        // capability mid-plan kept following the plan — improvising with

        // shell — while the tool it asked for sat ready.

        return (

          describeLoad(outcome) +

          `\n\nThe tool \`${entry.name}\` is available now. Call it directly for this work ` +

          "instead of a shell script: it is sandboxed, bounded, and returns structured JSON. " +

          "Its parameters are in its tool declaration."

        );

      }

      if (query !== undefined && query.length > 0) {

      "printed. Use it for anything you would type at a terminal: reading files, listing " +

      "directories, searching, git, running builds and tests. For the `openagents` CLI use the " +

      "`openagents` tool instead — it carries the list of commands, so running it through here " +

      "costs a turn finding out what exists. Prefer it over `delegate` for " +

      "costs a turn finding out what exists. When an installed capability covers the task — " +

      "the `capability` tool names what is installed — load and call it instead of scripting " +

      "the same thing here: it is sandboxed, bounded, and returns structured output. " +

      "Prefer it over `delegate` for " +

      "single commands -- a child agent is for work worth a whole agent, not for one line of " +

      "output. Both output streams come back together with the exit code. There is no terminal, " +

      "so a command that would prompt gets end-of-file instead of waiting; pass a flag that " +

  "name": "foreign_sessions",

  "version": "0.1.0",

  "author": "OpenAgents",

  "description": "Discover recent Claude Code and Codex CLI sessions from their local state directories, mounted read-only: for each session its source, id, working directory, modification time, size, and record count. Metadata only \u2014 it never reads whole conversations back, never writes, and cannot resume anything. Use it when asked what foreign coding-agent sessions exist on this machine, optionally filtered to a working directory.",

  "description": "Discover recent Claude Code and Codex CLI sessions from their local state directories, mounted read-only: for each session its source, id, working directory, modification time, size, and record count. Metadata only \u2014 it never reads whole conversations back, never writes, and cannot resume anything. Use it when asked what foreign coding-agent sessions exist on this machine, optionally filtered to a working directory. To read a conversation's content back, load the read_conversation capability instead.",

  "artifact": {

    "path": "foreign_sessions.wasm",

    "digest": "sha256:5ba9c4265b7a18dbb1c1c175e10a0ffcff5b7d124c766536b582c6e33bde84bb"