Legacy immediate-start API. REVIEW returns pending_id.

    interactive=True requires background=True and the DEV_ONLY isolated
    Python numeric REPL allowlist, with explicit local launch review.

    Prefer run_command_wait for normal work: it observes the Owner GUI
    click and returns job output without asking the Owner to type
    'approved'. Do not reissue a command merely to check its result.

Use only for legacy immediate command submission. A REVIEW result needs a later status/wait call; normally prefer run_command_wait. Owner approval is local to Windows. Never resubmit the same operation on timeout or UNKNOWN. ERROR OwnerReviewUnavailable (reason OWNER_SESSION_UNAVAILABLE, REVIEW_BUSY or OWNER_REVIEW_FAILED; launch_outcome NOT_STARTED) means no Owner dialog was shown and nothing ran: report it and wait for the Owner, never resubmit automatically.

Run, wait for local Owner approval, then return bounded output.

    interactive=True opts into the DEV_ONLY isolated numeric Python REPL.
    Use wait_seconds=0 for prompt asynchronous observation, then send_input.

    Owner permission comes only from the Windows GUI, not MCP. On a
    wait timeout use await_command_result(pending_id) or existing output
    tools; never repeat run_command_wait to avoid duplicate execution.

Preferred command submission for tasks needing Owner GUI approval and a bounded wait for output. Use once per operation. On PENDING or timeout, continue through await_command_result with the returned pending_id; never reissue this command. ERROR OwnerReviewUnavailable (reason OWNER_SESSION_UNAVAILABLE, REVIEW_BUSY or OWNER_REVIEW_FAILED; launch_outcome NOT_STARTED) means no Owner dialog was shown and nothing ran: report it and wait for the Owner, never resubmit automatically.

Wait for an existing Owner decision/job, without another execution.

Use after an earlier run_command_wait or REVIEW when you already have pending_id. Wait for that same Owner decision and job without new execution, approval, or submission. Timeout is not permission to retry.

Use for a quick, read-only health probe of the connected MCP Host. No input; does not establish that protected remote readiness, Broker acceptance, or a particular tool is exposed in ChatGPT.

Use for read-only diagnostic status and local tool registration fingerprint. No input. LOCAL_REGISTRATION_SNAPSHOT is not proof of ChatGPT-side tool publication, remote readiness, or security acceptance.

Read-only observation using an existing pending_id: returns the stored Owner command approval/launch result, or the DEV_ONLY send_input input outcome when the ID belongs to stdin input. Does not approve, launch, send input or rerun. For command reviews, RUNNING / LAUNCH_ACCEPTED may remain after the job has COMPLETED: this is NOT the current job state. Use request_status(request_id) or await_process_output(session_id) for the job. For send_input, observe its original pending_id, not the command launch, and never send the input again. On PENDING follow the same pending_id; UNKNOWN does not prove no job ran or no input was sent. Never resubmit to check status.

Read-only lookup by the original caller's request ID.

    No new command, approval, or queue entry is created. UNKNOWN does
    not prove the old request never ran and MUST NOT trigger auto-retry.

Use with the original request_id to check a prior command's status without re-submission. UNKNOWN is inconclusive and must never justify an automatic retry.

Use to page stdout/stderr for an existing current-process JobManager session. Reads bounded output from offset; does not start or retry commands. Use previous_output for a prior Host invocation.

Wait for an already-running JobManager session, never start another.

Use to wait on an already-started session_id for a bounded period and retrieve its result. This is observation, not a new command; do not reissue run_command on timeout.

Use to list current Host JobManager sessions and their states for observability. Read-only; prior-process sessions instead use previous_sessions or recovery_overview.

Use to inspect prior Host invocation START/END journal snapshots without command replay. Read-only metadata; journal-only records are not proof of no side effects or original argv.

Read-only current/prior session guidance, never automatic replay.

    A production BrokerHost cannot claim this DEV_ONLY aggregation.

Use after reconnect to interpret current/prior session and opt-in archive evidence in READ_ONLY_MANUAL_RECOVERY mode. No arguments, grants or auto-retry. Owner verification is required for private archive IDs/commands; ARCHIVE_ONLY remains outcome-unknown. Not protected Broker acceptance.

Read archived logs from a PREVIOUS Host invocation; never replay.

    Without ID returns a bounded metadata index. With ID returns only
    that old session's stored output. A local Owner opt-in is mandatory.

Use to read an Owner-verified result archive from a PREVIOUS Host invocation. Omit session_id for metadata index, supply the original archived session_id for output and eligible safe-command identity. May contain sensitive stdout; never repost IDs or output without Owner verification, and never replay jobs.

Use only when the Owner explicitly intends to cancel an existing session_id. This modifies a running job; does not start a new one. Confirm the exact target; do not infer outcomes from missing sessions.

Explicitly cancel a job, then observe that SAME job to completion.

Use for explicit cancellation of the existing session_id followed by a bounded wait for its observed result. No new job or automatic replay. Only cancel when Owner intended.

Use before a requested replacement edit to validate path, proposed full content and the original file SHA-256. Preview only: no write or Owner grant. Do not expose sensitive content in chat.

Review a proposed general source file without creating it.

Use to validate and preview creating a new source file at a permitted path. No file is created; send full proposed content only when safe, then separately seek Owner-approved creation if appropriate.

Build one literal source edit proposal; no file write or grant.

Use to preview one literal exact-text source replacement against the expected SHA-256. No write/approval. Source up to 65536 bytes; complete diff up to 16384 bytes. Returns old/new SHA-256 and the complete diff, never the whole proposed content. A generic tool failure is not an Owner rejection or a write; resolve stale or ambiguous source rather than guess.

DEV_ONLY: ask the local Owner GUI to send one exact numeric line ONCE to this manager's previously approved interactive Python process. Returns pending_id; observe through await_command_result or review_status only. No arbitrary code, secrets, PID attachment, input logging or retries. UNKNOWN stops the session.

DEV_ONLY: ask the local Owner GUI to create one absent directory in configured roots. Reject links, protected names and existing targets; no command/job spawn. UNKNOWN requires manual reconciliation, never retry or assumed rollback.

DEV_ONLY: ask the local Owner GUI to create one new text file in configured roots, showing its path and complete content first. Existing targets are never overwritten; links and protected names are rejected; no command or job spawn. UNKNOWN requires manual reconciliation, never retry or assumed rollback.

DEV_ONLY Windows: request local Owner GUI review of one exact file move in existing roots. No overwrite, directory move or job spawn. Cooperative checks are not protected CAS. UNKNOWN requires manual reconciliation; never auto-retry or assume rollback.

DEV_ONLY cooperative literal source patch: reuse preview_source_patch, show the complete proposed content and diff to local Owner GUI, then recheck SHA before replacement. One exact anchor only; no fuzzy edit, job spawn or protected Broker acceptance. Never retry an UNKNOWN result.

Read-only bounded PID and executable basename listing using installed psutil or Windows Toolhelp snapshot. No command lines, environment, Owner identity, credentials or process control. Safe error on unavailable/incomplete enumeration; never starts a job or installs dependencies.

Read-only nonsecret DEV configuration view: reports flags, root count and rootsConfigured boolean only. No paths, credential values, identity or configuration mutation. This view grants no privileges and establishes no protected Broker acceptance.

List bounded entries under Owner-approved read roots. Read-only; depth=0 preserves immediate children and the original schema. Depth 1 to 4 adds relative paths and bounded recursion, excluding private names, links and denied folders. Limit bounds output, not authorization.

Continue a bounded listing without widening Owner read roots.

Use to page a folder listing when list_folder's output is insufficient. Provide the same path, entry offset and limit. Read-only and confined to Owner read roots.

Use for a bounded UTF-8 read of an existing file within configured Owner read roots. Never modify the file; may return sensitive text, so share only when appropriate.

Read a UTF-8 page within existing Owner-configured read roots.

Use for large UTF-8 files needing byte-offset pagination within approved read roots. Reuse the returned byte cursor rather than guessing; no file modifications.

Bounded name-only discovery inside configured Owner read roots.

Use to discover filenames by name under an allowed directory within bounded depth/result count. This is path discovery, not a content search or write authorization.

Literal UTF-8 source search; results include relative path and line.

Use for literal text search within bounded UTF-8 files under approved roots. Supply the exact search text, depth and result cap. Search results may expose sensitive lines; read-only.

Read-only file size and bounded digest; never authorizes a write.

Use for non-mutating file or directory metadata checks on an allowed path, including size/digest when available. Not a write grant and not proof of user consent.

Read numbered UTF-8 source lines without creating a new grant.

Use when exact numbered source lines are needed for review. Choose 1-based start_line and a bounded max_lines; no edits or permission changes.

Read up to eight bounded existing UTF-8 files in one MCP call.

Use to read up to eight existing UTF-8 files in one bounded, read-only call. Provide distinct paths in approved roots; each file has its own byte limit.

Compare two Owner-scoped existing files without editing either.

Use to compare two existing Owner-scoped text files as a read-only diff. before_path and after_path are files, not patches; context_lines adjusts displayed context only.

Read a bounded UTF-8 tail or resume from a previous byte cursor.

Use to read a bounded UTF-8 tail (offset -1) or resume at an explicit byte cursor. Useful for logs and evolving files; never creates or changes them.

Stream a bounded file hash, with no install/execute permissions.

Use to compute the SHA-256 of an approved existing file without reading full contents into chat or changing permissions. Hash alone does not establish a trusted signature.

Actual local SDK registration snapshot; NOT connector publication.

Use to inspect only the local FastMCP tool registration count, names and schema fingerprint. No args and no remote publication guarantee; compare against ChatGPT's visible action list for stale tool snapshots.