[liugddx]

What

Next step after #6464/#6505: the Bot can look at the user's conversations. This is the read-only part of the Session tools discussed in #6076 and #6464; M4n5ter agreed that reads can be open.

Change

• COORDINATION_TOOLS gains SessionList, SessionRead, SessionHistory, SessionQueue, SessionWork and SessionExecution. As before, a Bot Session is created with the names in that list that its Owner actually registers, so a Host without these tools gets none of them.
• Tools that create, fork, update, change (archive/restore/delete), message, stop, resume or edit the queue of a conversation are not granted. They need their confirmation tiers and, for the Bot's own workers, a parentSessionId check first; both are separate steps.
• The standing instructions list the held read tools as one ability ("read the user's conversations, read-only"), naming only the members actually held (en, zh-CN, zh-TW).

Things to know

• The tool list of a Session is fixed when it is created, so only Bots created after this change get the new tools. An existing Bot keeps its list; archiving it and opening the Bot again creates one with the new list. I did not add a path that rewrites a Session's tool ceiling.
• The default product registers all of these as preapproved, so the Bot can read any conversation, including its own, without asking. The reads return conversation content to the model the user has configured for the Bot.

Verification

• New test the_bot_can_read_conversations_but_is_not_given_tools_that_change_them: with SessionList, SessionRead, SessionSend and SessionChange registered, the Bot's tool list holds the first two and not the others; the Bot's model request offers SessionList and not SessionSend; calling SessionList returns the user's conversation by title and id. The prompt test gains assertions that only held read members are named.
• Bot tests: 19 pass (the two that timed out in one parallel run pass alone and when rerun with 4 threads). cargo clippy -p maka-agent-native --no-deps --all-targets: clean.

Not checked: a real model using the tools in the desktop app. The Bot in my demo directory predates this change and does not hold them.

🤖 Generated with Claude Code

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

I reviewed both changed files at eb691859559c8d96ce531f884ab2ebaf45fbda91, the Bot creation/reuse and held-tool prompt paths, the default product registrations, the six underlying query contracts, and session tool selection. I found no confirmed P0–P2 defect in this source review.

The actual change adds SessionList, SessionRead, SessionHistory, SessionQueue, SessionWork and SessionExecution to the Bot creation allowlist, intersected with tools the owner registered. The default product maps these to list, observe, history, queue, work and execution; all are Query methods. Creation, sending, stopping, resuming, queue editing and lifecycle mutations are absent from this addition. Prompt text names only the read members actually held. An existing unarchived Bot record returns its existing session before the new creation list is built, so the update does not rewrite its tool ceiling.

The capability direction is supported by the maintainer's published Session-tool decision, rather than only the proposal in this PR. The default registrations are preapproved and permit reading other conversations into the Bot's configured model. That is an intentional product behavior of this change, not a new per-call confirmation guarantee.

The new test checks selected read tools versus send/change tools and the actual model request/result for SessionList. It does not execute every one of the six query tools. CI for this exact head succeeds. I did not run Rust tests, a real model or the desktop app locally; the author's 19 Bot-test result is not my independent execution. The actual merge into current Rust 50687a74 is clean.

P3: the contribution identifies Claude Code but its commit has Co-Authored-By: without the required Generated-by: trailer. This is attribution feedback, not a runtime defect or approval.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.