4Rj€dZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z m Z mZmZmZmZddlmZmZddlmZddlmZdd lmZdd lmZmZdd lmZm Z m!Z!m"Z"ddl#Z#ddl$Z#dd l%m&Z&d dl'm(Z(m)Z)ddl*m+Z+m,Z,ddl-m.Z.ddl/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5d dl6m7Z7m8Z8m9Z9e rddl:m;Z;gdZdZ?e?Z@dZAdZBdZCdZDejdZFd2dZGejdZId3dZJd4d ZKd5d!ZLeGd"d#ZMd6d$ZNGd%d&eZOGd'd(ZPd7d)ZQd7d*ZRd7d+ZSd7d,ZTd8d-ZUd7d.ZVd7d/ZWd9d0ZXd:d1ZYy);u>Reference implementations of the ``agent_toolset_20260401`` tools — ``bash``, ``read``, ``write``, ``edit``, ``glob``, ``grep`` — plus the workdir/skills :class:`AgentToolContext`. This sits next to the other ``lib/tools`` helpers (the Messages tool runner, the memory tool, …). Importing it pulls in ``subprocess`` etc., so it is kept out of ``anthropic.lib.tools.__init__`` — depend on it explicitly (``from anthropic.lib.tools.agent_toolset import beta_agent_toolset_20260401``). The result of :func:`beta_agent_toolset_20260401` is a plain ``list[BetaAsyncFunctionTool]`` — *async* function tools, so it is for the **async** runners only: ``client.beta.sessions.events.tool_runner(...)`` (the ``SessionToolRunner``, always async) for a managed-agents session, or — via the :class:`~anthropic.lib.environments.EnvironmentWorker` — the self-hosted environment worker. The sync ``Anthropic`` ``messages.tool_runner`` accepts ``BetaRunnableTool``, which excludes the async function tools this returns, so it cannot consume this toolset. .. warning:: ``bash`` is **stateful**: it owns a persistent ``/bin/bash`` subprocess that is only torn down by its ``close`` cleanup hook. Only ``SessionToolRunner`` (and the ``EnvironmentWorker`` built on it) invoke that hook. The Messages ``client.beta.messages.tool_runner(...)`` does **not** call ``close``, so handing this toolset to the Messages tool runner leaks the bash subprocess (one orphaned shell per run). Run stateful tools under ``client.beta.sessions.events.tool_runner(...)`` / the environment worker, or drop ``bash`` from the toolset before using the Messages tool runner. Trust model: the file tools confine to ``workdir`` (symlink-aware) and are safe without a sandbox; ``bash`` is unrestricted and should run inside one. See :class:`AgentToolContext`. ) annotationsN)S_ISREG) TYPE_CHECKINGAnyListOptional NamedTuplecast)Path PurePosixPath)partial)islice)asynccontextmanager)field dataclass)MappingCallable Awaitable AsyncIterator)run_sync)_withindownload_session_skills)NotGiven not_given)is_given).BetaManagedAgentsAgentToolset20260401BashInput.BetaManagedAgentsAgentToolset20260401EditInput.BetaManagedAgentsAgentToolset20260401GlobInput.BetaManagedAgentsAgentToolset20260401GrepInput.BetaManagedAgentsAgentToolset20260401ReadInput/BetaManagedAgentsAgentToolset20260401WriteInput) ToolErrorBetaAsyncFunctionToolbeta_async_tool)AsyncAnthropic) AgentToolContext BashSession BashResult resolve_pathbeta_agent_toolset_20260401beta_bash_toolbeta_read_toolbeta_write_toolbeta_edit_toolbeta_glob_toolbeta_grep_toolig^@iiiPz\x1b\[[0-9;?]*[ -/]*[@-~]c(t|r|StS)uResolve a configured cap to an effective size limit. ``not_given`` selects ``DEFAULT_MAX_FILE_BYTES``; ``None`` disables the size check (uncapped); a positive int is the cap. Governs only the size guard — callers still reject non-regular files. )rDEFAULT_MAX_FILE_BYTES) configureds i/var/www/html/meridian/meridian-ai/venv/lib/python3.12/site-packages/anthropic/lib/tools/agent_toolset.py_resolve_max_bytesr8`s"*-:I3IIz!anthropic.lib.tools.agent_toolsetctjjDcic]\}}|jdr||c}}Scc}}w)uThe environment for the bash subprocess, with the runner's own credentials scrubbed. The bash tool runs model-issued commands, so it must never inherit the runner's ``ANTHROPIC_*`` variables (API key, environment key, per-work session tokens): a prompt-injected ``echo $ANTHROPIC_API_KEY`` would otherwise land the credential straight in the session transcript. Passing an explicit ``env`` to :class:`AgentToolContext` does NOT add to this default — it FULLY REPLACES it. The provided mapping becomes the entire bash environment verbatim; nothing here is merged in, so callers who want the scrubbed process environment plus extras must build that mapping themselves. ANTHROPIC_)osenvironitems startswith)kvs r7_default_bash_envrBms8 ZZ--/ RTQq||L7QAqD RR Rs AAc"t|trd}njt|trd}nWt|trd}nDt|trd}n1t|t rd}n|j xsdj}t|d|d|S)zMap a filesystem ``OSError`` to a consistent, runtime-independent message. The raw ``OSError`` string is platform-specific (``[Errno 2] ENOENT: ...``); normalise the common cases so the model sees the same wording everywhere. zno such file or directoryznot a directoryzis a directoryzpermission deniedzfile already existsz i/o errorz: ) isinstanceFileNotFoundErrorNotADirectoryErrorIsADirectoryErrorPermissionErrorFileExistsErrorstrerrorlowerr$)op file_pathereasons r7 _fs_errorrP~s !&', A) *" A( )! A '$ A '&**+ 224 t2i[6(3 44r9cgSNrSr9r7_empty_skill_dirsrTs Ir9ceZdZUdZeej Zded<dZ ded<dZ d ed <dZ d ed <dZ d ed<e Zded<edddZded<eeddZded<ddZddZddZddZddZd dZy)!r(u Workdir + path-policy for the agent toolset. Trust model — two tiers: - The file tools (:func:`beta_read_tool`, :func:`beta_write_tool`, :func:`beta_edit_tool`, :func:`beta_glob_tool`, :func:`beta_grep_tool`) resolve paths against ``workdir`` and reject escapes unless ``unrestricted_paths`` is set. :func:`resolve_path` follows every symlink (including the leaf, even a dangling one) before the check and returns that canonical path for the operation, so a symlink inside the workdir that points outside it can neither pass the check nor be followed afterwards — a real boundary, consistent with the memory tool, so the file tools are safe to use without a sandbox. - :func:`beta_bash_tool` runs an unrestricted ``/bin/bash`` regardless of ``unrestricted_paths``. Confinement for it must come from the OS layer (e.g. a self-hosted environment runner). Attributes: workdir: Base directory for resolving relative tool paths. Defaults to :func:`os.getcwd` captured when the context is constructed (TS parity: ``process.cwd()`` at construction), so a ``chdir`` between constructing this context and the first tool call does not move where paths resolve. Pass an explicit path to override. unrestricted_paths: When ``False`` (default), the file tools reject paths that resolve outside ``workdir``. Does **not** constrain :func:`beta_bash_tool`. env: Optional environment for the bash subprocess. When unset, the bash tool inherits the process environment with the runner's ``ANTHROPIC_*`` credentials scrubbed. When provided, it FULLY REPLACES that default environment — the mapping is used verbatim and is NOT merged with or added to the scrubbed process environment. To keep the defaults plus extra vars, build the combined mapping yourself before passing it. max_file_bytes: Size cap for the ``read`` and ``edit`` tools, which both load the whole file into memory. ``not_given`` (default) uses the built-in 256 KiB cap; a positive int sets a custom cap; ``None`` disables the cap entirely. Disabling it reintroduces the OOM risk on a model-controlled path, so pass ``None`` only when the sandbox can absorb arbitrarily large files. The non-regular-file (FIFO/device) guard always applies regardless of this value. )default_factorystr | os.PathLike[str]workdirFboolunrestricted_pathsNzAsyncAnthropic | Noneclientz str | None session_idOptional[Mapping[str, str]]envint | None | NotGivenmax_file_bytes)defaultinitreprzBashSession | None_bash)rVrbrc list[Path] _skill_dirscK|j8tj|j|jd{|_|jS7wNr^)rdr)startrXr^selfs r7bashzAgentToolContext.bashsB :: *004880LLDJzzMs;AAAc|K|j*|jjd{d|_yy7 wrR)rdcloserks r7rozAgentToolContext.closes5 :: !**""$ $ $DJ " $s *<:<cK|j |jyt|j|j|jd{|_y7 w)zDownload the session agent's skills into ``{workdir}/skills//``. No-op unless both :attr:`client` and :attr:`session_id` are set. The download + safe archive extraction lives in :mod:`anthropic.lib.tools._skills`. N)r\rX)r[r\rrXrfrks r7 setup_skillszAgentToolContext.setup_skillssG ;; $//"9 !8QUQ`Q`jnjvjv!wwwsA A A AcK|jD]0} tttj|dd{2g|_y7#t $r!}t jd||Yd}~bd}~wwxYww)uRemove the skill directories :meth:`setup_skills` downloaded. Only the directories this context created are removed — a pre-existing ``{workdir}/skills`` tree is left untouched. T) ignore_errorsNz,failed to remove downloaded skill dir %s: %s)rfrr shutilrmtree Exceptionlogwarning)rl skill_dirrNs r7_cleanup_skillsz AgentToolContext._cleanup_skillssv )) ZI Zwv}}itTUUU Z V Z JIWXYY Zs>A9(A A A  A9 A  A6A1,A91A66A9cBK|jd{|S7wrR)rqrks r7 __aenter__zAgentToolContext.__aenter__s"!!!  "s cK |jd{|jd{y77#|jd{7wxYwwrR)rorz)rlexcs r7 __aexit__zAgentToolContext.__aexit__sG )**,  &&( ( (  ($&&( ( (s?A959A7A9AA AAAreturnr)rNone)rr()r~objectrr)__name__ __module__ __qualname____doc__rr<getcwdrX__annotations__rZr[r\r^rr`rdrTrfrmrorqrzr|rrSr9r7r(r(s(Z',BII&FG #F$$%)F !(!J !'+C $+,5N)5 %dU KE K$4EEX]^K^  x )r9r(cRt|}|jr |jr|jSt|jj}|jr|n||z j}|jst ||st d|d|S)uqResolve ``p`` against the workdir; reject results that escape it. Absolute and relative inputs go through the same canonicalise-then-contain check — an absolute path that lands inside the workdir is permitted, only paths that resolve *outside* are rejected. ``Path.resolve()`` follows every symlink (including the leaf, even a dangling one) before the containment check, so a symlink under the workdir that targets ``/etc`` is rejected — and the resolved path is what the tool then operates on, so it can't be followed afterwards either. See the trust model on :class:`AgentToolContext`. zpath z escapes workdir)r rZ is_absoluteresolverXr ValueError)ctxp candidaterootfulls r7r+r+sQI )"7"7"9  ""   $ $ &D"..0IdY6F O O QD  ! !'$*=5%5677 Kr9c(eZdZUdZded< ded<y)r*uResult of :meth:`BashSession.exec` — the captured output and exit code. A ``NamedTuple`` so it unpacks positionally (``out, code = await s.exec(...)``) and reads by name (``result.output`` / ``result.exit_code``) interchangeably. stroutputint exit_codeN)rrrrrrSr9r7r*r*s K?N8r9r*cVeZdZdZd dZeddd dZed dZe fd dZ d dZ y)r)uA persistent ``/bin/bash`` process; cwd, env and jobs survive across calls. .. warning:: :class:`BashSession` is **stateful and not safe to share concurrently**. Interleaved :meth:`exec` calls would race for the same stdin/stdout pipes (mixed input, output read by the wrong caller, and corrupted sentinel detection). Each :class:`AgentToolContext` creates its own session, so the safe pattern is *one context per session* — never a single ``AgentToolContext`` (or hand-constructed ``BashSession``) shared across multiple sessions running on different self-hosted environments. Holding the shared instance behind a per-call lock would serialize all bash work and is almost certainly not what you want. c||_y)uUse :meth:`BashSession.start` to construct — ``__init__`` takes an already-spawned process and is intended for internal use.N)_proc)rlprocs r7__init__zBashSession.__init__6s  r9Nric K| t|n t}tjgd|i|ddddtj tj tj d{}||S7 w)N)z /bin/bashz --noprofilez--norcdumb)PS1PS2TERM)cwdr^stdinstdoutstderr)dictrBanyio open_process subprocessPIPESTDOUT)clsrXr^basers r7rjzBashSession.start;smOtCy1B1D'' 2>4>2v>//??$$   4y sA*A;,A9- A;c2|jjduS)uWhether the underlying bash process has exited / been torn down. Inverse of "alive". Named ``closed`` (not ``alive``) to match the TS ``BashSession.closed`` boolean — porting code between the two SDKs should not have to flip the sense of this check. N)r returncoderks r7closedzBashSession.closedHszz$$D00r9cK|jr td|jj|jjJ|jj}|jjdt j jd}|ddd|dd}d|d|d}|j|jd{td |jdfd } tj|5|d{dddt"j%dj'd} | j)|} | dkrt+| j-dS| d| j/d} | | t1|zdj-} | rt3| j5dnd} rd| z} t+| | S77#1swYxYw#t$rZ}tjd 5|jd{7dddn #1swYnxYwtd |d|d}~wtj $rFtjd 5|jd{7ddd#1swYxYwwxYw#t6$rd} YwxYww)Nz)bash session terminated; restart required __ANT_CMD__DONE__z''z{ z } &1; printf '\nz %d\n' $? FcK jdd{}|syj|t t kDrdt t z =dvry]7G#tj$rYywxYww)NTi)receiver EndOfStreamextendlenBASH_OUTPUT_LIMIT)chunkbufmarkerr truncateds r7read_until_sentinelz-BashSession.exec..read_until_sentinelfs"(.."66E 5!s8//:c#h):::; $IS=6((s8A=A$A"A$AA="A$$A:7A=9A::A=Tshieldzbash command timed out after srreplaceerrorsr z[output truncated] r)r RuntimeErrorrrruuiduuid4hexsendencode bytearrayr fail_after TimeoutError CancelScoperoget_cancelled_exc_class_ANSIsubdecoderfindr*striprstriprr splitlinesr)rlcmdtimeoutrsentinelsentinel_splitwrappedrrNtextidxouttailcoderrrrs @@@@r7execzBashSession.execRs ;;JK Kzz+ 0A0A0MMM   ""  0 019$RaL>HQRL>:u=n=M[Yjj)***k "  $ !!'* ,)+++ ,.yySZZyZ9:jj" 7djjlB/ /4Cj%C#h-')*002 043t(+,"D (3.C#t$$y +4, , , R""$/ #jjl"" # # #!>wiqIJPQ Q,,. ""$/ #jjl"" #  #  , D sC K G')K =G8 G,G*G,"G8*B K 4 J9K *G,,G51G88 J6IH:+H.,H:1 I:I ?I0J6J)JJ) J6)J2 .J66K 9 KK KK cK|jjLtjd5 |jjj d{ddd|jj Z|jjtjd5|jjd{dddtjd5 |jj d{dddy7#t $rYwxYw#1swYxYw7l#1swYkxYw78#t $rYAwxYw#1swYyxYww)NTr) rrrracloservrkill move_on_afterwaitrks r7rozBashSession.closes' ::   '""$/ ****11333  :: ( JJOO $$Q' (jjoo''' (   d +  jj'')))  4   ( ( (*    s-E D)'DDDA E *D7D5 D7 E +E-E E E E D D&#D)%D&&D))D2.E 5D77E<E E EEEEEE )rzanyio.abc.Processrr)rXrWr^r]rr))rrY)rrrfloatrr*r) rrrrr classmethodrjpropertyrBASH_DEFAULT_TIMEOUTrrorSr9r7r)r)'sI  `d  115IJ%Xr9r)cltdfd }tdttt|S)NcKddfd  d dfd } |jd{yy7#jd{7wwxYww)z)Run a command in a persistent bash shell.Nc~K3tjjjd{S7wrh)r)rjrXr^)rsessionsr7_sessionz3beta_bash_tool..bash_tool.._sessions7 + 1 1#++377 1 KKNLs 1=;=cxK|r,  jd{d d{y|s td|r|dz nt} d{}|j||d{\}}|dk7r t||S7p7a787#tt f$r}td||d}~wwxYww)Nzbash session restartedzbash: command is requiredg@@)rzbash: r)ror$rrrr) commandrestart timeout_msrrrrrNrrs r7rmz/beta_bash_tool..bash_tool..bashs&!--/))"Gj  / ;<<-7j6)=QG 5"*$"#&&'&"BB Tqyn$J* %B ,/ 5& -14 5sgB:B B:BB: BBB2B3B:B:B:BBB7#B22B77B:r)NNN)r Optional[str]rOptional[bool]rz Optional[int]rr)ro)rmrrrs @@r7 bash_toolz!beta_bash_tool..bash_tools'+ hl " 4B Wd   , &J"mmo%%#%"mmo%%#s1A$AA$AA$A!AA!!A$rmname input_schema)rz,AsyncIterator[Callable[..., Awaitable[str]]])rr&rr r)rrs` r7r-r-s>,&,&f ? C  3  r9c>tdtddfd }|S)Nreadrc K t |} |j}t |j std|dt j}|.|j|kDrtd|d|jd|d|j}|s|St|dk7r td |\}}|jd } td |d z } |d kDr|n t| } d j| | | S#t$r}td||d}~wwxYw#t$rt$r}td|||d}~wwxYww) z,Read a file rooted at the working directory.zread: N: not a regular file is  bytes, exceeds z6-byte limit. Use bash (head/tail/sed) to read a slice.rrz/read: view_range must be [start_line, end_line]rrr)r+rr$statrst_moder8r`st_size read_textOSErrorrPrsplitmaxjoin) rM view_rangetargetrNstlimitr start_lineend_linelinesrjendrs r7rzbeta_read_tool..readsp 1!#y1F 9B2::&& 3G HII&s'9'9:E RZZ%%7YKtBJJ<7GwO@@##%D K z?a MN N) H 4 AzA~&"Q,hCJyyuS)**9 1fQCL)q 0 1    9FIq1q 8 9sGE  DB D#A(E  D  DD  E #E5EEE rR)rMrrzOptional[List[int]]rr)r&r")rrs` r7r.r.s&&/]^ +_ +D Kr9c<tdtdfd }|S)Nwriterc$K t|} |jj dd|j |dt|d|S#t$r}td||d}~wwxYw#t $r}td|||d}~wwxYww)z4Write a file, creating parent directories as needed.zwrite: NT)parentsexist_okrzwrote z bytes to ) r+rr$parentmkdir write_textr rPr)rMcontentrrNrs r7rzbeta_write_tool..writes 2!#y1F : MM  t  <   g &G ~Z {;; 2gaSM* 1 2  :GY2 9 :sEB A.A1B A.A))A..B1 B :BB  B)rMrrrrr)r&r#)rrs` r7r/r/s%'0_` <a < Lr9c>tdtddfd }|S)Neditrc K t |} |j}t |j std|dt j}|.|j|kDrtd|d|jd|d|j}|j|} | dk(rtd ||s| d kDrtd | d |d |r|j||n|j||d } |j| d|d|r| dSd dS#t$r}td||d}~wwxYw#t$rt$r}td|||d}~wwxYw#t$r}td|||d}~wwxYww)z-Replace text in a file by exact string match.zedit: Nrrrz5-byte limit. Use bash (sed/awk) to edit a large file.r rzedit: old_string not found in rzedit: old_string appears z times in z (must be unique)zedited z (z replacement(s)))r+rr$rrrr8r`rr r rPcountrr) rM old_string new_string replace_allrrNrrrr"updatedrs r7r zbeta_edit_tool..edit%s 1!#y1F 9 B2::&& 3G HII&s'9'9:E RZZ%%7YKtBJJ<7GwO??##%D  :& A:*D99D>>FE&E!!E&&F) F2FFFrR) rMrr#rr$rr%rrr)r&r)rr s` r7r0r0$s(&/]^#T_#TJ Kr9cV |jjS#t$rYywxYw)Ng)rst_mtimer )rs r7_mtime_or_zeror)Ns+vvx   s  ((c>tdtddfd }|S)Nglobrc>Kd}t|jr4js tdtd}|j d}nqjs"dt |j vr td|r t|}n#tjj}|}js|} tt|j|t}|*|Dcgc]}t!|j|s|!}}|sy|j#t$d d j'd |dt(DS#t$r}td||d}~wwxYw#ttf$r}td||d}~wwxYwcc}ww) z1List files matching a glob pattern, newest first.Nz$glob: absolute pattern not permitted/z..z*glob: '..' is not permitted in the patternzglob: no matchesT)keyreverserc32K|]}t|ywrR)r).0ms r7 z/beta_glob_tool..glob..}sEAQEs)r rrZr$lstripr partsr+rrXrlistrr+WALK_MAX_ENTRIESr rsortr)r GLOB_RESULT_LIMIT) patternpathconfinerpatrNmatchesr3rs r7r+zbeta_glob_tool..globVs#' = $ $ &)) FGG9D..%C ))dmG6L6R6R.R LMM9'T2DCKK(002C)) 16$))C.2BCDG  #*KQWQYY['-JqKGK  6yyE1C2C)DEEE+"9#fQCL1q89G$ 1fQCL)q 0 1 Ls`BF E4F(E2-F3FF;F E/E**E//F2FFFFrRr;rr<rrr)r&r )rr+s` r7r1r1Us(&/]^&F_&FP Kr9c>tdtddfd }|S)Ngreprc K |r t|n"tjj}t jdx}rtj|ddd|dt|gd d{}|jd k(ry |jd k7r(t d |jjd|jjd}t|t kDr|dt dt dz}|S t#j$|}t)||S#t$r}t d||d}~wwxYw7#t"j&$r}t d||d}~wwxYww)z.Search file contents for a regular expression.zgrep: Nrgz-nz --no-headingz-ez--F)checkrr.rzgrep: rg failed: rrz [output truncated at  bytes]zgrep: invalid regex: )r+r rXrrr$rtwhichr run_processrrrrrrGREP_OUTPUT_LIMITrecompileerror _walk_grep) r;r<searchrNrDresultrrxrs r7rBzbeta_grep_tool..greps~ 104\#t,$s{{:K:S:S:UFd# #2 #!,,T>4$F LF  A%#  A%"3FMM4H4HPY4H4Z3[ \]]--&&i&8C3x++,,-2IJ[I\\c0ddJ @G$B"f%%/ 1fQCL)q 0 1 xx @3A378a ? @sYE51D)AE57E 8BE5E  E5) E2EEE5 E2E--E22E5rRr@)r&r!)rrBs` r7r2r2s%&/]^&_&: Kr9c g t d fd d fd }|jr ||nd}tj|D]\}}}|Dcgc]&}|dvst ||z j r%|(c}|dd|D]P}t ||z } | j r"|dz }|t kDs || r9 rdj ndccS rdj SdScc}w) Nct|dzzdkrjdtdyj|y)Nrrz[output truncated at rFFT)rappendrI)linebudgethitss r7pushz_walk_grep..pushsF#d)a- A: KK/0A/B'J K Dr9c  |jd5}d|jdvr dddy|jdt|dD]e\}}t |t kDr|j djd }j|sL|d |d |r]dddy  dddy#1swYyxYw#t$rYywxYw) NrbiTrrrrz :F) openrseek enumeraterGREP_MAX_LINE_LENGTHrrrNr )rfirawrTrWrPs r7scanz_walk_grep..scans 4 %AaffSk) % %q '1o%FAs3x"66 ::Y:7>>vFDyyttfAaS$4H/I$ % %% % %   sQC CC A(CC,C-C 6C8C C C C CCr)z.git node_modulesrrr.)rTrrrY)rr rrY)rIis_filer<walkr is_symlinkr8r ) rPrNrcseendirpathdirnames filenamesdrrrUrVrWs ` @@@r7rMrMsD F&~~ V ,.GGFO E (GXy$q0H'HRVW^R_bcRcQoQoQqHQK" EG}t+??$ **$t*.2499T? D E  E#499T?4 4s C3 C3=C3c~t|t|t|t|t |t |gS)uReturn the ``agent_toolset_20260401`` implementations bound to ``ctx``. The result is a plain list of :class:`~anthropic.lib.tools.BetaAsyncFunctionTool` instances — *async* function tools, so it is for the **async** runners only: the ``AsyncAnthropic`` ``client.beta.messages.tool_runner`` and ``client.beta.sessions.events.tool_runner`` (always async). The sync ``Anthropic`` ``messages.tool_runner`` takes ``BetaRunnableTool``, which excludes the async function tools this returns. Filter or extend it before passing it on:: tools = [*beta_agent_toolset_20260401(ctx), my_custom_tool] tools = [t for t in beta_agent_toolset_20260401(ctx) if t.name != "grep"] )r-r.r/r0r1r2)rs r7r,r,s> sssss  r9)r6r_rz int | None)rzdict[str, str])rLrrMrrNr rr$)rre)rr(rrrr )rr(rzBetaAsyncFunctionTool[Any])rr rr)rPzre.Pattern[str]rNr rr)rr(rz list[BetaAsyncFunctionTool[Any]])Zr __future__rr<rJrrtloggingrrrtypingrrrrr r pathlibr r functoolsr itertoolsr contextlibr dataclassesrrcollections.abcrrrrr anyio.abcanyio.to_threadr_skillsrr_typesrr_utilsr types.betarrr r!r"r#_beta_functionsr$r%r&_clientr'__all__rrr5READ_MAX_BYTESrIr_r:r8rKrr8 getLoggerrwrBrPrTr(r+r*r)r-r.r/r0r)r1r2rMr,rSr9r7rsMB# GG'*(GG $5)ON) #' /0Jg;<S"5* g)g) g)T* 8 8 FFR8v$N$'T*ZD35lr9