Project tools and AI extensibility

Discover before creating

List project tools and inspect a definition before invocation. A tool has bounded input/output schemas, declared capabilities, versioned files and lifecycle state. Discover currently available definitions instead of inventing names. The Typed tool reference contains every registered lifecycle operation and its exact required fields.

Create, test and activate

Create/install only within the isolated project boundary. Installation is not trust or activation. Test with synthetic inputs and inspect retained test results. Review and activation enforce their actual consent/capability gates; the AI cannot manufacture a human approval. Keep inactive/failed versions explicit. Invoke only the exact reviewed active definition with schema-valid bounded input.

Cancel, revoke and remove

Cancel stops a particular invocation; revoke withdraws its capability and remove affects the chosen definition. These are not interchangeable. Preserve invocation evidence and do not delete unrelated work to repair a failed tool. Output remains a proposal unless deterministic checks and human disposition say otherwise. Never expose a generic host-filesystem, arbitrary QAction or engineering-approval proxy through an extension.

Security and recovery

Schemas do not authorize remote references, arbitrary code, hidden network access or secrets. Credentials belong in scoped secure runtime configuration, not prompts, generated code or logs. Inspect explicit failure diagnostics, correct the definition in a new version, test again and request the real required review. Do not automatically retry external inference or paid calls.