feat(rig-core): ToolCallExtensions — per-call tool context through the agent loop, MCP & sub-agents (supersedes #1537, #1953)

[gold-silver-copper]

Summary

Per-call runtime extensions for tools — a type-erased type-map that lets callers attach values (auth tokens, session IDs, A2A context_id/task_id, conversation state) to a tool call and lets tools read them by type, threaded all the way through the agent run loop, MCP tools, and sub-agents. The model never sees them.

This supersedes #1537 (rebased onto current main) and now also incorporates the strengths of the parallel #1953, so the surviving design has both the better naming/type and the full integration. Credit to @redroy44 for the original #1537 design (first commit replays it).

Closes #1536. Supersedes #1537 and #1953.

use rig_core::tool::ToolCallExtensions;

#[derive(Clone)]
struct SessionId(String);

let mut ext = ToolCallExtensions::new();
ext.insert(SessionId("session-123".into()));

let answer = agent.prompt("do the thing").tool_extensions(ext).await?; // also on stream_prompt(..)

A tool reads them by overriding call_with_extensions:

async fn call_with_extensions(&self, args: Self::Args, ext: &ToolCallExtensions)
    -> Result<Self::Output, Self::Error>
{
    let session = ext.require::<SessionId>()?; // or ext.get::<SessionId>()
    // ...
}

What's here

The type (tool/extensions.rs) — a port of http::Extensions' AnyClone pattern: type-erased, cloneable, zero-alloc when empty (Option<Box<HashMap>>), no-op IdHasher over TypeId keys (no SipHash; hardened with a non-panicking write fallback), insert returns the displaced value, len/is_empty, plus a require::<T>() -> Result<&T, MissingExtension> accessor and an assert_send_sync compile guard. The wasm/non-wasm split is deduped into one AnyClone definition via WasmCompat{Send,Sync}.

The dispatch chain gains call_with_extensions on Tool → ToolDyn → ToolType → ToolSet → ToolServerHandle, each defaulting to the existing extension-free call (fully backward compatible; the now-dead ToolType::call is removed, not #[allow]'d).

The agent loop — the piece #1537 was missing: a tool_extensions field on AgentRunner is threaded into the single run_single_tool dispatch site (borrowed, not cloned) for both the blocking and streaming drivers, and surfaced via tool_extensions(..) on PromptRequest, TypedPromptRequest, and StreamingPromptRequest.

Reaches the real destinations (what makes this end-to-end usable for the motivating A2A/MCP case):

• MCP tools — McpTool::call_with_extensions forwards an rmcp::model::Meta from the extensions as the request _meta (SEP-1319): per-call auth/session to MCP servers. Re-exported as rig::tool::rmcp::Meta.
• Sub-agents — Agent-as-tool propagates the extensions into the inner run, so delegated agents' tools observe them.

Relationship to #1953

#1953 (ToolCallExtensions) independently rebuilt #1537 with a better type (the IdHasher, len/is_empty, and the collision-free name). This PR adopts all of those (last commit) on top of its own deeper integration — MCP _meta, sub-agent propagation, the TypedPromptRequest entry point, require(), deduped wasm, and broader tests — so #1954 is now a strict superset and #1953 can be closed in its favor.

Test plan

• cargo test -p rig-core --lib — 1019 pass (type + IdHasher round-trip + len/is_empty + deep-clone + require; blocking & streaming end-to-end through the real agent loop; sub-agent propagation; sentinel/default paths).
• cargo test -p rig-core --lib --features rmcp — 1029 pass, incl. a mock-server test asserting _meta reaches the server.
• cargo clippy -p rig-core --all-features --all-targets clean; cargo fmt clean; cargo check --features wasm --target wasm32-unknown-unknown clean; doctests pass.

Generated with AI assistance (Claude).