Tools

Seventeen tools, each registered with a risk tier, a set of modes it is allowed in, an output cap and a retry class. The registry enforces all four before a call reaches the tool.

What a registration carries

Every tool is wrapped in a tools.Entry. The fields are not documentation — the registry acts on each one.

The registry

The last five are conditional: the code-intelligence four register only when the code index is available, and remember only when the curator is. Registration happens in cmd/crv/main.go.

Reading the workspace

read

Reads a file with line numbers, relative to the workspace root. from_line and to_line read just the part that matters instead of the whole file. Large files come back in slices — calling again continues from where the last read stopped, which keeps a 4,000-line file from eating the window in one call.

grep

Regex search over file contents, returning file:line with the matching line. glob narrows by filename (*.js), path scopes to a subdirectory.

glob

Finds files by name pattern — **/*.go, src/**/test_* — and returns sorted relative paths. The usual first move before reading.

Changing the workspace

edit / write

write replaces a file whole; edit replaces an exact string within one. Both are sensitive and both pass through the guard's remediation step, which takes a timestamped backup of an important file before it is touched — see Remediation.

apply_patch

Applies a unified diff. Higher cap than edit because a patch legitimately carries more context, and the same remediation applies.

Running things

bash

A one-shot shell command in the workspace, 30 seconds to 3 minutes, output capped. The description the model receives is explicit about the trap:

serve

A long-lived static server for the workspace, which is the one thing bash cannot do: bash kills its process group when the call returns. action is start, stop or list, and it returns the URL. Static files only, which is what makes it safe.

check_page

Loads a page in headless Chrome and reports console errors, uncaught exceptions, and whether an expected element rendered. path takes a workspace-relative file, url a served page, and expect an element to confirm — canvas, #board.

Since v0.5 it also evaluates JavaScript in the page and returns the value, which turns "does it look right" into a question with an answer. Reading source cannot reveal a runtime error; this is how the agent verifies its own web work.

Planning and asking

commit_plan

Discussion-only. Crystallises the conversation into a structured plan that the panel renders as a plan strip and that Autopilot later follows as guidance. A plan written to a Markdown file instead is also committed as a structured plan event — the model's stubbornest habit is writing the plan to a file, so the harness translates rather than pleads.

ask_user

Puts a real question to you and blocks until it is answered. The panel renders it as a card; Pocket surfaces it on your phone. This is what turns a six-hour stall into a one-minute one.

Reaching outside

web_fetch

Brainstorming-only. Fetches a URL as clean markdown — main content, code blocks and tables preserved. Large pages return an outline of sections; calling again with section="<heading>" reads one, or start_index=<n> continues from an offset. Fetching a whole documentation page into a 96K window is exactly the failure this avoids.

Code intelligence

Four tools backed by the code index. They only register when the index is built. Full detail on Code intelligence.

remember

Saves a fact, decision or preference to long-term semantic memory. Everything else in memory is automatic; this is the one the model reaches for deliberately when something is worth keeping across sessions. It goes through the curator, so a contradiction supersedes rather than piles up — see Memory.

Reflexes

An RFX pack can register its own tools, which enter the same registry with the same four fields and the same guard in front of them. A pack cannot grant itself a tier it was not given. See RFX packs.