ruyi-workbench-oss

a

b

c

echo over http

echo over sse

added later

Echo a message back

Add two numbers

Capture a full-screen screenshot (fake)

Report optional module availability (fake)

Write a fake .docx file (mirrors ACC write_document契约)

Move/rename a file (mirrors ACC move_file契约: source→destination)

Copy a file (mirrors ACC copy_file契约: source→destination)

Read text file (mirrors ACC read_file契约)

Write/append text file (mirrors ACC write_file契约)

Write fake .docx (mirrors ACC write_document新形状:含 output_path)

Write fake .xlsx (mirrors ACC write_excel契约)

Write fake .pdf (mirrors ACC write_pdf契约:非 .pdf 路径报错)

Write fake .pptx (mirrors ACC write_pptx契约:slides 规格)

Beautify existing .xlsx (mirrors ACC excel_beautify契约)

Insert chart into existing .xlsx (mirrors ACC excel_chart契约)

Render chart .png (mirrors ACC chart_image契约)

Resize image (mirrors ACC image_resize契约:ok包络)

Screenshot a window (mirrors ACC window_screenshot契约:output_path 可选)

Read clipboard image (mirrors ACC get_clipboard_image契约:save_path 可选)

Delete a file (mirrors ACC delete_file契约)

Sleep ms then return (47b 桥超时契约测试件)

Partial edit via exact-string replacement (mirrors ACC edit_file契约:唯一性闸)

Fetch a URL with SSRF guard (mirrors ACC fetch契约, fake 不联网)

Save a memory entry (mirrors ACC memory_save契约)

Read a memory entry (mirrors ACC memory_read契约)

List memory entries (mirrors ACC memory_list契约)

Delete a memory entry (mirrors ACC memory_delete契约)

Record a thinking step (mirrors ACC sequential_thinking契约)

List/search confirmed Workbench Memory metadata for the current project and global scope. Use when the user asks what is remembered or the injected memory preflight/index is insufficient. This does not read full bodies.

Read one confirmed Workbench Memory entry by id. Read only entries relevant to the current request and verify stale facts against the workspace before relying on them.

Submit one durable memory candidate for user review. It never saves directly: the user must confirm the card shown after the turn. Use when the user explicitly asks to remember something, or for a stable preference, confirmed project convention/decision, or verified recurring lesson that is not alre…

Propose a relation edge between two existing confirmed Workbench Memory entries (supports/contradicts/supersedes/derived_from). It never saves directly: the user must confirm the card after the turn. from/to must be memory ids that already exist in the same scope.

Propose a revision to an existing confirmed Workbench Memory entry (name/description/type/body). It never saves directly: the user must confirm the card after the turn. Provide the suggested replacement values; unchanged fields may be omitted.

Propose revoking (deleting) an existing memory relation edge. It never deletes directly: the user must confirm the card after the turn. Use relationId from listMemoryRelations or a prior confirmed relation.

Recall the original content of a tool result reduced during context compaction, using the rawRef embedded in its reduced view (format history:<turn>:<hash>:<index>:<hash>). When a user asks for an exact historical value/detail and a relevant earlier tool result is marked reduced or omitted, call thi…

Internal: handles --permission-prompt-tool requests by asking the workbench UI to allow/deny a tool call.

Run a one-shot PowerShell command on Windows. For a persistent/interactive terminal that keeps state across calls, use shell_start/shell_send instead.

Start a persistent PowerShell session (keeps cwd/vars/background processes across calls). Provider engine only. Returns {shellId}. Then drive it with shell_send / shell_poll.

Send a line of input to a shell session and return the output that settles within timeoutMs (best-effort; long tasks: track with shell_poll). output is the increment since the last cursor.

Read new output from a shell session since an absolute byte cursor. Returns {output, cursor, running, exitCode?, truncated?}. Pass the returned cursor back next time to tail incrementally.

Terminate a shell session and its process tree. CAUTION: any un-consumed buffered output of that session is lost, and any long-running command inside it is killed.

List active shell sessions: [{shellId,name,cwd,running,exitCode,startedAt,lastUsedAt,bytes}].

Run a temporary PowerShell, Python, or Node script

Read a local file. Char slice via offset/limit, or line mode via lineOffset (1-based) / lineLimit (returns cat -n style content with totalLines). Image/binary files are refused (use the vision channel).

Write a local file

Replace text in a local file

Delete a local file (checkpointed first, so it can be rolled back). Directories are refused.

移动或重命名一个文件（from→to）。已先存检查点，可一键撤销。默认不覆盖已存在的目标（overwrite=true 才覆盖）。仅支持单个文件，不支持文件夹；跨磁盘自动退化为复制+删除。

复制一个文件（from→to）。目标已存在时会先存检查点，可一键撤销。默认不覆盖（overwrite=true 才覆盖）。仅支持单个文件，不支持文件夹。

把工作区内的文件/文件夹打包成一个 .zip（deflate 压缩，中文文件名正确保留）。dest 已存在时先存检查点，可撤销。单文件上限 100MB、总量上限 500MB，超限会人话拒绝。

把一个 .zip 解压到 destDir（支持 stored/deflate 两种压缩方式）。含越界路径（Zip Slip，如 ..\）的压缩包会被整包拒绝；符号链接条目会被跳过。条目数上限 2000、解压总量上限 500MB。覆盖已存在文件需 overwrite=true，覆盖前会存检查点。

从一个 http(s) 网址下载文件保存到工作区内的 dest（内网/回环地址会被 SSRF 防护拒绝）。dest 已存在时先存检查点，可撤销。默认单文件上限 100MB（maxBytes 可调），Content-Length 与实际字节都会卡上限，超限拒绝。返回 {path, bytes, contentType}。

List files under a directory

Search text (regex, per line) in files under a directory. Optional context lines, relative-path glob filter, and per-file grouping.

Find files by glob pattern (** crosses dirs, * within a segment, ? one char). Returns matches sorted by mtime (newest first).

Open a URL or local HTML file in a new tab of the default browser. Never navigate or close the current Ruyi Workbench tab.

List the currently configured built-in and external MCP connectors, their launch command, argument list, working directory, environment key names, and browser target. Secret environment values are never returned. Use this before changing tool/MCP configuration.

Configure tools/MCP on the user's explicit request. Supports upsert/remove/enable of an external stdio MCP connector and changing the ai-computer-control browser target. This is an exec-tier persistent configuration change: inspect with mcp_list first, explain the diff, and rely on the permission pr…

Open a local Office document with the default application

Capture the primary Windows screen to a PNG file

Send keystrokes to the active Windows application. CAUTION: keys go to whatever window currently has focus; SendKeys meta characters + ^ % ~ ( ) { } [ ] are live modifiers (e.g. ^s = Ctrl+S, %{F4} = Alt+F4). Confirm the focus target before sending, and prefer explicit app control over raw keys when …

Return a compact project tree snapshot

Show the git status of a folder (current branch, ahead/behind, and how many files changed). Read-only. Returns a plain-language summary plus the raw porcelain status.

Show what changed in a git repo as a unified diff (the +added / -removed lines). Read-only. Use staged:true to see staged changes, path to limit to one file, contextLines to widen/narrow context.

List recent git commits (hash, date, author, subject) as a table. Read-only. maxCount defaults to 10 (clamped 1..100); path limits history to one file.

Save a version: stage changes then create a git commit with the given message. This RUNS git hooks (pre-commit etc.), so it is an exec-tier action. If the repo has no Git identity configured, it returns a guiding error (it never invents a fake name/email).

Inventory local dependency and runtime configuration files without installing anything

Run a lightweight offline code review scan for common security and quality risks

Audit frontend files for offline asset and UI polish issues

Find and audit CLAUDE.md project memory files

Search local project documentation as an offline docs lookup

Search a codebase for where a symbol (function/class/method/variable name) is defined and referenced, returning file-level definition/reference evidence grouped by file. Grep-level lexical scan (not AST/type-aware): it matches identifier occurrences by word boundary. Use when auditing or tracing whe…

Advisory hypothesis/experiment/refutation ledger for structured debugging (bisect/elimination method). Tracks which hypotheses are pending/refuted/supported/confirmed so you can see how many remain unrefuted, catch repeated experiments, and avoid locking a root cause before excluding alternatives. I…

Profile a data file (CSV/TSV/JSON/JSONL/text log) into a machine-computed summary: row/column counts, per-column type, null/unique counts, numeric min/max/mean/median/std + IQR outlier count, and sample values. Use to replace eyeballing a large file with file_read when you need its structure, scale …

Make an HTTP request to a local or intranet endpoint for API debugging

Search the web via the configured search backend (searxng/bing/brave/custom). Returns {results:[{title,url,snippet}]}. Use it for time-sensitive facts, external information, or anything that may have changed after your knowledge cutoff — search first, then answer. Then use web_fetch to read a promis…

Fetch a public web page over http/https and return its extracted main text + title. Follows redirects (≤3), 10s timeout, ≤2MB. Internal/loopback/metadata addresses are refused for safety. Offline, it serves a cached copy if one exists (fromCache:true). Use it to read a page found via web_search.

Pause and ask the user one to three concise questions in the workbench UI. Prefer 2-5 concrete, mutually exclusive options whenever the answer can be enumerated; put the recommended option first and label it (Recommended). Choice questions include an Other typed fallback by default. Use text-only mo…

Record/replace the task list for the current turn (full replace each call). Use it to plan multi-step work and mark progress. items:[{id?,text,status:pending|in_progress|done}]. Drives the workbench step-bar.

Update the long-running task ledger (Mission): mark milestones done/blocked, add milestones, or record evidence. Use it ONLY when a Mission is active for this session (the system prompt shows a <mission-ledger> block). action="update" merges; provide milestones:[{id,desc?,status:pending|done|blocked…

只读查询本工作台自身的运行时状态:版本号、启动模式(exe/源码)、安装位置、数据目录、服务地址与实例标识、健康检查项、原生/ACC 工具数与技能/命令/Playbook/工作流数量,以及当前设置(引擎/端点/模型/权限模式/输出风格/界面语言,已做密钥掩码,绝不含 apiKey/token)。何时用:用户问「你是哪个版本/装在哪/端口是多少/数据目录在哪/当前用哪个模型和权限模式/有多少工具、技能、Playbook」,或你需要核对自身运行环境再回答时,调用本工具而不是凭记忆回答或猜测。何时别用:查询用户项目文件、工作区结构或桌面/浏览器状态时——那应改用 project_snapshot/f…

只读查询如意工作台自身状态,并附带管家自己的运行段(管家相关设置的掩码回显 + 收件箱状态:是否启用/是否在轮询/当前 inboxSeq/各类事件计数)。何时用:用户问「你是哪个版本/装在哪/端口多少/当前用哪个模型/管家开着吗/收件箱里攒了什么」,或你要核对自身运行环境再作答时。何时别用:查线程进度用 steward_thread_status,查费用用 steward_usage,查健康项细节用 steward_health;本工具不接受也不触碰任何用户文件路径。section 可选,缩小返回范围省上下文。

按关键词检索线程(会话)——同时匹配标题与正文内容,返回命中线程的 id、所属事项、标题、类型、五态、最后一句助手原话(≤200 字,已中和)、更新时间与相关度分。何时用:用户提到某件事但没说是哪条线程(「上次那个爬虫的事怎么样了」),或你要在递话前先定位目标线程时。何时别用:你已经知道 sessionId 时直接用 steward_thread_status;要看线程里具体说了什么用 steward_thread_read。结果永不包含管家自己的会话。

读一条线程的当前状态:五态(交办中/进行中/需要你/已收工/已停工)、当前动作与最近一步、待决摘要(类型 + 一句话)、权限档、引擎与模型、累计费用与 token、最后一句助手原话(≤200 字)。何时用:用户问「那条线在干嘛/卡在哪/花了多少钱」,或你要判断能不能递话、该不该替他答复待决之前。何时别用:要看具体对话内容用 steward_thread_read;要看班组(Agent 工作流)节点进度用 steward_runs_status。线程不存在返回 {ok:false,error:"not_found"}。

按需深读一条线程最近若干回合的原话:用户说了什么、助手回了什么、调用了哪些工具(只给一行摘要与结果长度/rawRef,不给工具输出全文)。何时用:总览与 steward_thread_status 不够你判断下一步时,针对性读一条线程。何时别用:例行汇报——总览每回合都在,不必逐条深读;也不要用它来「补全上下文」批量扫线程,读取是记账的。配额:每回合最多 6 次、单次 ≤12000 字符、本次到访累计受 stewardReadBudgetChars 限制;超限返回 {ok:false,error:"quota_exceeded"} 或 {ok:false,error:"budget_excee…

读【事项】清单:一个事项是跨会话的容器(一件事可以有好几条线程)。每条返回事项标题与目标、事项级聚合状态(任一线程需要你则事项就是需要你;全部收工才算收工)、验收项进度(已勾选/总数)、累计费用与预算、以及它下面每条线程的 id/标题/五态/权限档/最后一句。何时用:用户问「XX 那件事进展怎么样/还差什么/花了多少」,或你要在开新线程前决定它该并进哪个事项。何时别用:要看某一条线程自己在干嘛用 steward_thread_status;要看班组节点用 steward_runs_status。没有事项文件的线程会以「未归类」事项出现(derived:true),标题取线程标题——这不是错误,…

读 Agent 班组运行(工作流 DAG)的概览:每个 run 的状态、节点完成进度、是否暂停/在等什么、累计费用。何时用:线程状态显示在跑班组,而用户问「跑到第几步了/卡住了吗」,或你要在 steward_run_action 之前确认 runId 与节点 id。何时别用:普通对话线程(没有班组)用 steward_thread_status 就够。省略 sessionId 时返回全部线程的班组概览(有界)。

读管家收件箱:五类归一化事件(需要你 needs_you / 失败 failed / 收工 done / 停滞 stalled / 预算 budget)按 inboxSeq 递增排列。何时用:每个回合开头拉取上次游标之后的新事件,决定该提议什么、该做什么。何时别用:它不是对话历史,也不是完整审计流——要看审计用 steward_audit_tail。传 since=上次拿到的最大 inboxSeq 做增量,不要每次从 0 全量拉。

读用量与费用台账:按线程或按日汇总 token 与花费,并把管家自身开销(kind=aux、note=steward)单列。何时用:用户问「今天/这条线花了多少」,或你要在开新线程前核对预算。何时别用:要看单条线程的状态与最近一步用 steward_thread_status。金额按币种分列,不做汇率换算(诚实优先)。

读工作台健康检查项(体检):每项的 id、是否正常与一句话细节。何时用:用户说「怎么不好使了/是不是坏了」,或某条线程反复失败而你怀疑是环境问题时。何时别用:线程自身失败的原因在 steward_thread_status 的待决摘要与 steward_runs_status 里,不在这里。返回原始项,人话解释由你来说。

读审计时间线尾部(最近的工作台事件,已过既有脱敏)。何时用:用户问「刚才发生了什么/是谁改的/我批准过什么」,或你要为一个决定给出可查证的依据时。何时别用:找线程内容用 steward_threads_search;找待办事件用 steward_inbox_read。limit 夹取到 1..100。

按【委托书】新开一条线程并立刻让它跑起来。委托书结构固定:brief.userText 是用户原话(逐字放在首条消息最前,绝不改写),你的补充(目标/验收项/相关文件/偏好/约束)经中和后放在其后的管家围栏里、总长 ≤1200 字。何时用:用户提出的是一件要动手做的新事(要读写文件、跑命令、联网、做东西)。何时别用:关于如意自身、事项、费用、设置的问题你直接回答,不要为此开线程;已有对口线程时改用 steward_thread_continue。本工具是管家唯一的「动世界」出口——你自己没有文件/shell/桌面工具,想动手就必须经由线程。返回 {ok,sessionId,missionId,…

把一句话递给一条已有线程。message 是【原话直递】——不改写、不加你的注解;有补充要说,先递原话再另行插话。工作台按目标线程【当前状态】自动选五条通道之一,你不用也不能指定:① 它正在等用户回答(待决 question)→ 这句话就是那道题的答案,直接答进去(channel:"answer",回执带 questionId;【不会】打断它的回合);② 它正在等你批准一个动作(待决 permission)→ 【不代答】,返回 {ok:false,error:"propose_required",reason:"pending_permission"},把它作为提议交给用户去批;③ 它已经排在…

给线程改一个更贴切的标题。何时用:自动命名明显词不达意,或用户说「把那条改叫 X」。何时别用:不要为了「整理」批量改名——标题是用户认线程的锚点。返回 {ok,sessionId,title,undoRef},undoRef 带旧标题可一键改回。