Report the access mode, workspace root, platform, available external tools (git, ripgrep, shells), and the background processes this session manages. Call this first when unsure what the bridge can do.

Read operating-system, CPU, memory, uptime, Node.js, and host identity information without invoking a shell.

List operating-system processes with bounded structured results.

List local TCP/UDP endpoints and owning PIDs, optionally filtered by port, PID, or protocol.

List environment variable names and optionally non-sensitive values. Secret-like variables are always redacted.

Read filesystem capacity and free-space information for a path allowed by the current machine access policy.

Read local network-interface addresses and metadata without making an outbound network request.

Read recent redacted machine-operation audit records.

Search recent redacted audit records by text.

Read a UTF-8 text file with line and byte limits. Returns the file SHA-256; pass it back as "expected_sha256" when writing to detect concurrent changes.

List files, directories, and symlinks with size and modification time, without running a shell command.

Find files recursively by glob. Build output and dependency directories such as node_modules, .git, dist, and target are skipped unless "include_ignored" is true.

Get file or directory metadata and an optional SHA-256 hash for regular files.

Inspect a local PNG, JPEG, or WebP image and return dimensions, size, and SHA-256.

Download an HTTPS PNG, JPEG, or WebP image to the machine. Blocks local and private hosts, limits redirects and size, and sends no cookies or credentials.

Search file contents and return structured path, line, column, and text matches. Uses ripgrep when installed and falls back to a built-in scanner otherwise. Supports surrounding context lines, a per-file match cap, and a files-only mode for cheap surveys.

Create a UTF-8 text file, or replace one when "overwrite" is true. Prefer edit_file or update_file for changes to an existing file.

Replace exact text in an existing UTF-8 file. Supply either old_text/new_text or an edits array. Array edits are validated in memory then written atomically, so a failed edit never leaves a partial file.

Replace an inclusive 1-based line range in an existing UTF-8 text file. Line numbers shift after every edit, so read the file again between updates.

Run a shell command inside the configured workspace root and wait for it to finish. Use start_process for anything long-running.

Start a background process inside the configured workspace and return its PID. Poll it with read_process_output.

Get the status, runtime, and current output offsets for a managed background process.

Read captured stdout and stderr from a managed background process. Pass the previous "next_stdout_offset" and "next_stderr_offset" values as "since_stdout" and "since_stderr" to receive only new output, and "wait_ms" to block until output arrives or the process exits.

Write UTF-8 text to the standard input of a live process started by start_process. Recovered processes remain inspectable after restart but their stdin cannot be reattached.

Stop a managed background process and its child tree by PID.

Add, update, move, or delete files inside the configured workspace using Codex patch format. Run with "dry_run" first when the context lines are uncertain.

Read the current Git branch, upstream tracking state, and working-tree status without running a shell command.

Read the Git working-tree or staged diff without running a shell command, optionally limited to specific paths.

Read structured Git commit history without shell interpolation.

Read one Git revision and its patch or statistics with bounded output.

List local Git branches and optionally remote branches with current/upstream metadata.

Stage explicit repository paths using Git directly, without shell interpolation.

Create a local Git commit from staged changes, optionally staging tracked-file modifications with --all.

Switch to an existing Git branch, or create and switch to a new branch. Force/discard modes are intentionally not exposed.

Push a Git branch to a remote using Git directly. This is an external mutation and is approval-gated by the developer policy.