Report gateway capabilities and whether enhanced post-secret protections are active.

Resolve and stat an absolute Windows or WSL path without returning file content.

List directory entry names and metadata. This never returns file snippets.

Search file and directory names under a root; never searches or returns secret-bearing content snippets.

Classify a bounded file range locally and return reasons plus a short-lived inspection token, never content.

Read a bounded normal text range. Sensitive ranges return review_required and no content.

Release an inspected range after model purpose verification. Exact mode also requires local confirmation.

Open one repository snapshot with executor='wsl' or executor='windows'; the original remains read-only until reviewed apply-back.

Report managed changes and separately list Git-ignored runtime outputs, without file content.

Run a command in the always-enabled WSL bubblewrap snapshot. Host homes and Windows mounts are hidden; network is enabled.

Report PowerShell 7, standard-user, Job Object, authorization, workspace, and policy status without executing a command.

Request one local approval for persistent Windows Shell authorization. It survives restarts until windows_shell_close; duration_seconds is legacy compatibility.

Statically parse and bind one PowerShell or direct native command to cwd, target, purpose, risk, environment, and timeout; does not execute it.

Consume one prepared review token and run exactly the reviewed standard-user command; non-safe commands require local confirmation.

Immediately revoke Windows Shell authorization, invalidate reviews, and terminate the active Windows command tree.

Return a redacted managed-file diff; Git-ignored runtime outputs are listed but never reviewed or applied.

After diff review and local confirmation, conflict-check and apply only reviewed paths to the original repository.

Remove the active local snapshot. Unapplied changes require an explicit discard flag and local confirmation.