244 commands.
One list, for you and the agent.

244 registered commands in 47 namespaces, counted from the desktop source on 2026-09-25. 105 only read, 110 write something recoverable, 23 are destructive and 6 run a program. The largest namespaces are mcp (19), artifact (15) and automation (13).

No. 69 of the 244 commands are person-only, and the bus refuses them to any agent run before an approval card exists, among them approval.decide, chat.send and project.trust. Of the rest, 39 stop and ask you by default: every destructive and exec command, plus 10 that ask whatever their effect, such as git.commit and project.open, where the per-command setting that can quiet the others is not consulted. Every conversation you start has the same ceiling, exec, so what stops is decided by your trust level: running a program asks at Always ask and Normal, and only god mode lifts that.

23 of them: agent.delete, app.restore, artifact.delete, automation.delete, brand.delete, business.delete, business.discard_import, crew.delete, fs.discard, idea.discard, idea.promote, index.clear, index.embedding.set, mcp.logout, mcp.remove, mcp.secret.clear, media.discard, project.delete, provider.key.clear, sandbox.sweep, settings.delete, versus.delete and versus.tidy. 7 of those declare an undo (artifact.delete, automation.delete, idea.discard, index.embedding.set, mcp.remove, project.delete and settings.delete). By default, an agent that calls any destructive command waits for a person to approve the exact call.

6: app.quit, dev.start, fs.open, mcp.login, provider.topup and shell.run. shell.run is the only one that runs an arbitrary command line, inside the open project, and it asks every time at Always ask and Normal trust. Only god mode lifts that, and only inside the sandbox.

74 commands declare an inverse, and journal.undo replays the stored inverse through the bus, so the undo is itself a journalled, permission-checked command. Whether one particular call can be undone is decided by its own journal row, because a call may have changed nothing.

9 commands return foreign content: browser.capture, browser.read, browser.reopen, browser.save, pane.act, pane.capture, pane.open, pane.read and web.fetch. Reading any of them taints the run for the rest of its life: it may still read and make something new, a Canvas document or a .md, .txt or .csv file under the project’s web/ folder, but it can no longer change anything that already exists, delete or execute, and no approval lifts that. Files in a project you opened are different: they are wrapped as data, but the run keeps its authority, so it can still make the change you asked for.

No. 3 commands name input fields the bus blanks before the call is journalled: mcp.answer (content), mcp.secret.set (value) and provider.key.set (api_key). The rule is on the command, so no handler has to remember it.

A connected program can reach 20 of them, and only under the box you tick for it: looking at your agents, chats and projects, making media in the Studio, handing a job to your agents with chat.send, and setting up agents and crews. Every other command is on no companion list at all, whatever the settings say.

Each one is the summary string written on the command in the app’s source. The palette shows you that line, and the model is given the same line as the tool’s description, with a clause added when the call asks first or taints the run. Nothing on this page was rewritten for marketing.

The app does not export its registry to a file yet. Until it does, a script reads every CommandSpec in the desktop source, skips test code, and writes the list this page renders. This copy was read on 2026-09-25. When the app’s own export exists it replaces this file, with the app version on it.