Extensions and Recovery: More Capability, Same Ledger

Codewhale’s extensions and persistence systems answer a shared question: how can the agent gain more context, tools, and recovery options without creating a second authority system? MCP servers, Skills, hooks, LSP, memory, sessions, checkpoints, events, and workspace snapshots all add something different. The reliable way to use them is to ask who owns the bytes, how they enter the Runtime, what can steer execution, and which record proves what happened.

This is also a chapter about transitions. An extension can be discovered, reviewed, enabled, reloaded, and then executed under policy. A session can move from submitted input to a turn, from a turn to items and events, and from an interrupted process to a recoverable record. The state that persists is valuable precisely because it is not the same thing as the model’s final prose.

One control plane for more capability

MCP is Codewhale’s main route for external tools. A server may run locally over stdio or expose a remote URL-based transport. Its tools are namespaced and enter the model-visible catalog through the same approval and policy paths as built-in tools. A read-only resource lookup and a side-effectful remote action are therefore not treated as equivalent merely because both arrived through MCP.

Remote configuration adds another boundary. Public destinations have their DNS answers and redirects checked; private-network access is an explicit, origin-scoped exception. A server added by the model cannot inherit the operator’s private-network exception. The setup wizard can report that a server is configured or needs attention, but it does not silently start processes, install packages, log in, or enable trust. Discovery and execution remain separate transitions.

Skills are different from MCP. A Skill is a reusable instruction pack, typically a SKILL.md bundle, that can shape how work is approached. Codewhale-owned project and global roots are the places its manager may write. Compatible roots such as .claude or .agents can be discovered or imported but are not mutated in place. A digest-bound trust marker records review intent; it does not sandbox the Skill or auto-approve its tools.

Hooks are different again. They are arbitrary commands configured for the interactive TUI. A small set of lifecycle events can steer submitted text, tool calls, or shell environments; observer events can report what happened without changing the Runtime’s decision. A hook is still a command running with the launching environment’s credentials. Its label does not make it safer than any other executable configuration.

LSP diagnostics are an execution feedback path rather than a general extension marketplace. After a successful edit, the Runtime may ask a language server for diagnostics and inject the result before the next model request. A missing or crashing server is non-blocking. This gives the agent more evidence without turning a language server into a new authority layer.

Memory is opt-in context, not a hidden second constitution. Native memory stays local, uses durable Markdown as its source of truth, and keeps a rebuildable search index. Injected entries are bounded and marked as untrusted user data.