AUTO_INJECTED_TOOLS is treated as "always present", but the injection is conditional: it only happens when call-actor, an Actor tool, or get-actor-run is already loaded. A selector that requests one of the injected tools on its own therefore gets none of the others.
?tools=abort-actor-run is the clearest case. abort-actor-run is itself a member of AUTO_INJECTED_TOOLS and satisfies none of the three trigger conditions, so nothing is injected — yet the run-shape helper it shares with call-actor and get-actor-run builds a nextStep naming get-actor-run and get-dataset-items, neither of which that session received in tools/list.
Evidence
- The injection condition lives in
src/utils/tools_loader.ts; individual internal tool names are valid selectors, so a single-tool session is reachable.
- The result text comes from
src/tools/actors/actor_run_response.ts, shared by call-actor, get-actor-run and abort-actor-run.
src/tools/actors/actor_tools_factory.ts relies on the same assumption for its waitSecs field description. That one is currently safe — an Actor tool does trigger injection — but it is safe by coincidence, not by a check.
Affected: any session whose selector names an injected tool without also pulling in a trigger.
Surfaced while fixing the same class of problem in the task tools (#1295), which documents the three surfaces a tool name can reach the client on in src/tools/AGENTS.md.
AUTO_INJECTED_TOOLSis treated as "always present", but the injection is conditional: it only happens whencall-actor, an Actor tool, orget-actor-runis already loaded. A selector that requests one of the injected tools on its own therefore gets none of the others.?tools=abort-actor-runis the clearest case.abort-actor-runis itself a member ofAUTO_INJECTED_TOOLSand satisfies none of the three trigger conditions, so nothing is injected — yet the run-shape helper it shares withcall-actorandget-actor-runbuilds anextStepnamingget-actor-runandget-dataset-items, neither of which that session received intools/list.Evidence
src/utils/tools_loader.ts; individual internal tool names are valid selectors, so a single-tool session is reachable.src/tools/actors/actor_run_response.ts, shared bycall-actor,get-actor-runandabort-actor-run.src/tools/actors/actor_tools_factory.tsrelies on the same assumption for itswaitSecsfield description. That one is currently safe — an Actor tool does trigger injection — but it is safe by coincidence, not by a check.Affected: any session whose selector names an injected tool without also pulling in a trigger.
Surfaced while fixing the same class of problem in the task tools (#1295), which documents the three surfaces a tool name can reach the client on in
src/tools/AGENTS.md.