List Apps and retained drafts on the invited host.

Read the active App draft, desired/saved revisions and actual target application states. Read this after interruption; do not infer application from file transfer success.

Create a new App workspace. Returns its actual cwd; does not change the shared shell directory.

Open an existing App or retained draft. Returns cwd; never overwrites a draft or sends cd to the shared PTY.

After all files and build steps in a complete editing round finish, publish its exact draftRevision. A failed target load preserves the old applied revision.

Publish the completed draft and atomically save its .vrchapp package. Separate saved package success from preview/device application results.

Send a normalized control or pointer event to the connected preview only. Requires current AI editing control; cannot launch or control the device App.

Query the durable result of an interrupted App action. Do not automatically replay a mutation.

Fix a read-only snapshot of an already saved App for file_download. Does not Save or require editing control.

Validate a completed .vrchapp app-package upload. Returns its inspected reference and update conflict/confirmation state; file_done alone never imports an App.

Commit an inspected App package using its previous package digest and the approved update decision.

Launch or focus a saved App on the device within this invitation’s enabled Launch/Exit scope. Read apps_state first. Supply replaceInstanceId only after deciding to replace that known target; on capability_required, inspect the returned manifestDigest and requestedCapabilities. Within an authorized App launch task, retry with those exact values and allow:true to grant its declared App communication capabilities. Browser/OS permissions and Allow AI still require the person. Does not save a draft.

Exit the specified current device App within this invitation’s enabled Launch/Exit scope. Preserves the shell, access, App files and saved data. Read apps_state after interruption; never replay blindly.

Read the actual active preview and device App bindings before input. Coordinates are normalized within the App viewport, independent of the device’s 150% browser zoom. Does not launch, link or switch the person’s preview.

Simulate known E1-E4 rotation/press and K1-K4 keys on an explicit active preview or device App. down/up/cancel send exact phases; click/long form a paired press using holdMs (default 50/800 ms). K1 always invokes the host Menu. Requires AI control; loss of control cancels only AI-held inputs.

Open and operate Menu or Device for the active device App, only when ai_capabilities.hostMenus enables that surface and AI owns control. Read apps_input_targets first. event open opens the named menu; click/drag/scroll coordinates are normalized to the ENTIRE host window (including Monitor bars), not the App viewport. Supports touch-style pointer interaction and navigation keys. Does not operate permission/AI approval, access-management or lifecycle controls. Never sends caller-supplied script or selectors. Verify screenshots/state after delivery.

Click, drag, scroll, type English/ASCII text or send a key/chord in the active device App interface. Use event type guide_start to press the current App Guide Start on an explicit preview/device target; it does not approve access or I/O. Use apps_host_input for Menu/Device. Permission dialogs remain human-operated. Read apps_input_targets first; pointer coordinates are normalized App coordinates, scroll deltas are CSS pixels. Delivery confirms sent/dispatched events; use screenshots/App state to verify the intended result.

Create a fixed download snapshot of a relative file in the current App workspace. Returns its reference and sha256; use file_download with app-workspace. Does not change preview or save the App.

Atomically deliver a completed app-workspace upload to a relative workspace path. Omit expectedSha256 only for a new file; supply the existing file sha256 to replace it. Does not publish, save or execute the file.

Upload a local regular file through the shared resumable file transport. App packages must use .vrchapp and remain private until inspect/commit.

Download an authorized fixed App package reference to a new local path, verifying all bytes before an atomic no-overwrite commit.

Pause the current shared file transfer.

Resume the current shared file transfer.

Cancel the current shared file transfer.

Report the current action, result or next step to the person in one or two brief sentences in their language. Works while waiting for Allow AI and after approval; never include raw commands, secrets or internal reasoning.

Run a command that needs a password or other secret using the device Private Input form. Supply only nonsecret argv; never put a password/token in argv, terminal_input, chat or a file. All command output is suppressed. Wait for device-confirmed waiting_for_private_input before asking the person to enter it in Private Input. Requires the privateCommand capability; fail closed on older devices. The ordinary shell is retained; a finished event includes only exitCode/reason. No credential argument exists.

Only when the person explicitly asks, cancel the current private input without reading or submitting it. Interrupts the waiting command and discards unsubmitted input; submitted input cannot be retracted. Set resumeAI true only when the person also authorizes continuing AI work. Requires an approved connection and the device cancelPrivateInput capability. Inspect state after interruption; never replay blindly.

Read actual enabled capabilities, targets, control owner and pause state for this approved connection. Unavailable capabilities do not prevent connection.

Join an invited device Terminal. Wait for the human to approve once. Approval grants terminal observation and on-demand screenshots; Apps invitations grant AI editing on approval; ordinary Terminal invitations require the human to grant input control.

Read terminal events and actual images shared by the human automatically. Call terminal_events({}) while waiting for ai_pending/approval and between actions. Omit waitSeconds for the normal 20-second wait; returns early on events. Does not take a screenshot. One complete queued capture batch is returned per call, with separate images for every captured screen.

Send nonsecret shell input only while the human has granted AI input control. For commands needing credentials, use terminal_run_private and wait for device-confirmed Private Input. Never send passwords/tokens through this tool. Shared screenshots are included automatically in the response.

Capture the device screens once and return the complete batch as separate images. Default follows the human Multi-screen setting: on captures all screens, off captures primary only. While on, screen may select primary or a display connector from prior image metadata. Does not change input control.

Disconnect this client. Retain the admitted session credential for resuming within its authorization.