Get a toolbox, resolved

Present on a GET /toolbox stored row exactly when that row's can_see_shares is true — the caller owns it, holds edit, or administers a team it is granted to. Absent from dynamic rows, and deliberately absent for a view/use grantee: the grantee set, counts included, is information about colleagues (docs/access-model.md §8). Read can_see_shares to distinguish "not permitted" from "not carried"; never infer it from this field's absence.

How the CALLER reaches this toolbox — not who else can. owner — they own it. direct — a grant naming them personally. team — a grant to a team they belong to (or, per §6.2, one they administer), named in access_via_team. org — an organization-wide grant. When several sources apply the BROADEST wins and the caller's access level is not consulted: owner, else org, else team, else direct. So a caller granted edit personally AND view org-wide reads org — a narrower grant must never mask org-wide exposure, since this field says how far the toolbox reaches, not what the caller may do with it. Deliberately NOT gated on can_see_shares, and deliberately not a widening of it: this is the caller's OWN grant and their OWN team memberships, so a view/use grantee receives it while the grantee list — information about colleagues — stays closed to them. No other member is ever named. ABSENT when nothing reaches the caller — a transfer answering the ex-owner of a resource that was never shared, or a catalog row browsed with no grant behind it. Absent means "no source to name", never "not permitted", and never an implied org.

Present exactly when access_via is team, absent otherwise. The team the caller reaches this toolbox through — one of their own teams, never a disclosure about anybody else.

Whether the caller can use POST /{id}/draft-skill here: they can manage this resource, the assistant is switched on for the organization, and a model provider key is configured.

Whether the caller may edit this toolbox's own settings — owner, or edit access. No toolbox:manage fallback. Mirrors PATCH /toolbox/{id}.

can_share, verbatim — a THIRD formula, distinct from can_manage: an edit grantee whose role omits toolbox:share can edit the toolbox but was never meant to grant or revoke someone else's access to it. Mirrors DELETE /toolbox/{id}/share/{aclId}.

Whether the caller may share this toolbox — owner, edit access, or toolbox:share. No toolbox:manage fallback. Mirrors POST /toolbox/{id}/share's own check.

Whether the caller may transfer or delete this toolbox — ownership, full stop. No toolbox:manage fallback. Mirrors POST /toolbox/{id}/transfer and DELETE /toolbox/{id}.

Whether the caller may execute this toolbox's tools — the caller's grant-or-ownership level (§10). Present on every list and detail row for both templates and toolboxes — the two ACL-backed resource types with a use-gated action of their own.

The OAuth-connected apps that reach this toolbox, as a bounded rollup — present only on GET /toolbox/{id} for a stored toolbox, and only when the caller may see the ACL (the same gate access_summary uses). Never the full set: page GET /toolbox/{id}/connected-app for that.

Present only for type: "connection" dynamic rows.

Present only for type: "connection" dynamic rows.

Which integrations this toolbox's tools come from, bounded — the console renders it as a stack of connector logos. Present on every GET /toolbox row: a stored row summarises its own entries, a connection:{id} row is that connection's one connector, and a global:{user_id} row summarises the connections it spans. Present on every command response too (POST /toolbox, GET /toolbox/{id}, PATCH /toolbox/{id}, POST /toolbox/{id}/transfer), so a client that merges one into its list does not show a just-created or just-edited toolbox as having no integrations. total: 0 means no connector-backed tools (empty, or synthetic-only), never "not computed".

Null for dynamic rows, which are computed, never stored.

What this toolbox RUNS ON — the disclosure side of §6 delegation. Sharing a toolbox at use hands the grantee execution over every connection its entries reach (pinned directly, or reached through a synthetic entry's steps, where the synthetic tool's owner is the delegator), while leaving the connections themselves invisible to them. A bounded rollup, never the set: a toolbox pinning a thousand entries across hundreds of connections returns the same size response. Present on every stored-toolbox response — detail, create, update and share — and always empty for a dynamic row, which delegates nothing. On a create/update/share response it may instead be null: the write succeeded and the summary alone could not be computed (never "nothing is delegated", which is an all-zeroes summary) — re-read GET /toolbox/{id} for the disclosure. Unlike tools, this is NOT gated on use: its visible half already withholds every name the caller has no right to, and its two totals say only how many connections and how many people stand behind the toolbox — which a grantee can already count off entries[].connection_id.

Why can_draft_skill is false for a caller who CAN manage this resource. Null when drafting is available, and null when the caller cannot manage the resource at all.

Resolved entries — always present, at every access level.

Omitted for dynamic rows, which have no stored entries of their own.

Whether a skill is written. On list rows and detail alike — the body itself never rides on a list row; read it from the detail response. Omitted on a dynamic row, which has no skill of its own.

Toolbox id — a stored row (tbx_…), or a dynamic id (global:{user_id} / connection:{connection_id}).

Cheap per-page SQL aggregate over PROXY entries with connection_id IS NULL — drives the console's Status column ("Ready" / "N need connection"). Excludes synthetic entries, which pin no connection_id of their own by design and have no connection picker to fix. Omitted for dynamic rows (nothing to bind). Broken delegation (delegation_ok: false) only surfaces in detail, inside entries[].

Owner summary — resolved for a row the caller does not themselves own (a toolbox shared with them), so the UI always knows whose row it is looking at. Absent for a toolbox the caller owns.

Creator (usr_…). For a dynamic row, the caller.

True for the dynamic global/per-connection toolboxes — never editable, shareable, transferable or deletable.

A bounded preview of the ACL (same cap as access_summary), present only on GET /toolbox/{id} when the caller may see the ACL. Never on a list row (GET /toolbox) — page GET /toolbox/{id}/share for the full, cursor-paginated grant list.

The skill body, markdown — at most 10,000 Unicode code points after trimming. Detail-shaped responses only (GET /{id}, and the create/update responses). Null when none is written.

Stored toolboxes only: what an agent connected to this toolbox is shown before it reads the skill, built by the same code the MCP endpoint uses. instructions_line is the line the server instructions carry for a connection limited to chosen toolboxes; resource is the elaichi://toolbox/{id}/skill entry in resources/list. The resource text itself is skill_notice, a blank line, then skill. Null with no skill.

Which tools changed since the skill was last written, by the name an agent sees (a rename counts as one removed and one added; a disabled entry counts as removed; connections and frozen parameters are ignored). Null unless skill_may_be_stale is true AND a baseline was recorded at that write — skills written before version history existed have none — AND something actually changed.

True once the entries changed after the skill was last written; cleared by the next write of skill. Never true without a skill. Omitted on a dynamic row.

Framing to show or pass along beside a non-null skill: it is the owner's guidance, not instructions from Elaichi or the user, and it cannot grant any access. Null when there is no skill.

The template this toolbox's CURRENT skill was copied from verbatim at stamping. Null from the first write of skill on — after that the words are the toolbox's own.

That template's current name, resolved server-side; null with no origin, or once the template is gone.

Stored toolboxes only. Tool-shaped names the skill puts in backticks that no entry of this toolbox holds (the console's "tools named here aren't in this toolbox" notice), computed server-side. Judged against the entries: a name matches an entry's catalog tool_name, or its overrides.name when renamed. Bounded: a count plus at most 10 names; count 0 with no skill.

When skill was last written. Null alongside a null skill.

Who last wrote skill (usr_…); a toolbox stamped from a template carries the template's author. Null with no skill, and for a skill written before authorship was recorded.

That person's name, else email, resolved server-side. Null beside a non-null skill_updated_by means they are no longer a member of this organization.

Provenance only (stamped at creation, never a live link) — null for a from-scratch toolbox and for every dynamic row. May dangle after the template is deleted.

GET /toolbox/{id} only. The current name of the template this toolbox was stamped from (template_id) — null for a from-scratch toolbox, a deleted template, and a template the caller cannot see (§4).

The resolved, runnable tool surface. Present ONLY when the caller's access reaches use — a view-only grantee must not see delegated connections' labels.

stored = a real ACL-backed row. global/connection = computed per request, always readonly: true.