Skip to content
Synoec

Tool families

Family Tools Boundary
Files Read, Write, Edit, Delete, Move, Glob, Grep, Notebook, AttachmentRead Folders the chat may use; protected paths ask
System SystemStatus (memory, processes, disks, GPUs on this machine) Read-only, in every mode, with no shell and no approval. Reports programs without their arguments
Shell Bash, BashJobs (background jobs), BashSession (interactive terminal) Sandboxed by default; network and host access are explicit
Git GitInspect, GitMutate, Worktree, GitPublish through your gh/glab No force-push, default-branch push or merge
Code intelligence RepoMap, CodeSearch, SymbolSearch, Definition, References, Diagnostics Local analyzers — see Repository
Web WebSearch, WebScrape, WebFetch, WebAvailability See Web search and scraping
Browser Agora tab tools Per-tab grant — see Agora
Desktop Computer (macOS, Windows) App-scoped sessions, OS permissions
Orchestration Task, TaskWait, TaskResume, ThreadStart, ThreadMessage See Tasks and subthreads
Interaction AskUserQuestion, PlanReview, Checklist, TurnWrapUp Display and questions only
Services GenerateImage, DecisionEvaluate GenerateImage needs an image-capable provider in the chat’s Profile, such as Google or Codex; DecisionEvaluate needs a decision model and, on a connection in the chat’s Profile, runs under Approve for me without asking, even at a private address
Composition ToolProgram, ToolSearch, SpecialistRead, SkillRead, CommandInvoke (with SpecialistSearch, SkillSearch, CommandSearch) Nested calls keep ordinary policy

The model sees a short set of tools inline; the rest are named in one line and loaded through ToolSearch when needed. WorkflowCatalog, RunWorkflow, WorkflowWait and WorkflowResume appear only when a registered workflow is available; there is no ad-hoc Workflow tool. A provider that runs its own agent loop (Cursor) gets the same deferral through a ToolRun callback.

A few behaviors worth knowing:

  • Tool results reach the model as plain text: file contents as-is, commands as exit code and output, errors first.
  • A local model served over Chat Completions that writes its tool call as text (a JSON object with name and arguments, bare or in <tool_call> tags) still has it run through the ordinary tool path.
  • Agents work in the project. A temp folder is only for a throwaway script or output the project should not keep; a Quick Chat keeps such work in the system temp folder.
  • Read and AttachmentRead return the text of PDF, Word, Excel, PowerPoint, OpenDocument, EPUB and RTF files, so any model, local ones included, can read them. WebFetch does the same for a document behind a URL. Pictures and scanned PDF pages come back as images, a ZIP or tar as a listing, and a SQLite file as its schema with sample rows. Legacy .doc, .xls and .ppt files fail with what would work instead.
  • GenerateImage follows long renders as jobs on a service that offers them, and stopping the turn stops the render. A refusal shows the service’s own reason.
  • On Windows a command is limited in what it can change but not in what it can read or send, in a project you have trusted, once a self-test has proved that works on your machine. See Windows sandbox. Otherwise every Bash call asks.
  • Bash runs confined first. If a model asks to leave the sandbox, the command still runs confined, and you are asked only once the sandbox has refused something in that turn. A write refused on .git, such as git commit, does not wait for the model: the turn itself asks to run the command outside the sandbox.
  • On macOS and Linux, a project folder that is a linked Git worktree, or holds one up to two folders down (an Ergon company’s projects), can read the Git metadata its .git file points to, read-only, so git status and git diff work there.
  • AttachmentRead with asFile saves a read-only copy that the chat’s Bash can run programs on. It is deleted with the chat.
  • Edit takes replaceAll to change every match, and edits to make several changes to one file in one call, all or none; a miss says why the text did not match. Grep takes regex: true for a per-line regular expression.
  • A Bash call can run in the background. While it runs, the thread rail’s Processes card counts it; open the card to Stop a command.
  • A BashSession line runs only when it ends with a newline. A model that escapes the newline twice sends a trailing \n as two characters; that one ending becomes Enter, so the line still runs.
  • The desktop adopts your login-shell environment at startup, so tools on your PATH work when the app is opened from the Dock. It also ships rg (ripgrep); one you installed yourself comes first.

The canonical inventories live in the specification index.