Call the agent's tools without calling the agent

Your product has a "what's in this repo" panel. It doesn't need a model. It needs a directory listing and a grep, run with the same permission checks the agent gets.

So it calls POST /api/v1/agent/tools/list_dir/run with an X-Hoody-Cwd header. No session, no prompt, no tokens. The daemon spins an ephemeral session from the headers, runs the tool read-only, and returns the result. A mutating tool is refused unless you pass allow_mutations: true; a tool that wants a confirmation returns 409 with a token, and you re-issue with confirm: true.

You wrote zero sandboxing code. The path resolution, the directory scope, the confirmation gate: all of it came with the agent, and all of it works without the agent thinking.