Tauri Commands Reference

Slice F exposes start_graph {target:{type:story|plan,id},expected_revision?,definition_id,definition_revision,request_id,limits?} through the existing owning-daemon service. Story starts require the current native revision and pin the selected publication; the request ID is bound to its payload. Omitted limits use Rust defaults. Plan dispatch remains unavailable in this build and its start control says so. The workflow_run MCP tool uses an inline schema generated from RunAction and the public RunCommand variants; it returns the same scoped snapshots and cursor-ordered events as IPC/HTTP. Run history shows pinned activations, decisions/evidence, repair counters, pause targets and complete event payloads across pages. Graph recovery uses resume_graph {execution_id,activation_id,resolution} after answering pending input; pause and cancel use the existing sequence-fenced commands. Legacy runs offer inspection and cancellation in the UI. No new persistence or client scheduler is added.

Workflow runs

Workflow definitions

Native stories

Project Progress

The journal is append-only. There is no pause, clear, correction or export command: an entry is written once and either kept or deleted. intent entries are written by TUIC from the agent’s intent: marker and cannot be reported. Every stored entry has secret-shaped text and step values redacted; agent and target names are redacted and capped at 80 characters.

All commands are invoked from the frontend via invoke(command, args). In browser mode, these map to HTTP endpoints (see HTTP API).

Grid-frame channels and terminal_styled_rows share the optional TCX1 cell-text trailer with HTTP/WS. Complete cell text includes retained zero-width characters. terminal_search_buffer returns UTF-16 string ranges; terminal_search retains grid-cell coordinates. Both match the stored sequence without normalization.

PTY Session Management (pty.rs)

Every terminal grid read — the two rows above plus terminal_get_block_rows, terminal_scroll_info, terminal_search, terminal_search_buffer, terminal_get_row_text, terminal_get_logical_line, terminal_get_lines, terminal_get_cursor_line, terminal_hyperlink_at and terminal_hyperlink_span and read_vt_log — is an async fn that runs on the blocking pool via pty::vt_try_read, so it returns Result<T, String> rather than a bare T. The Err arm means the pool task itself failed; a session that is gone is still the old default (or a 404 over HTTP). See docs/backend/command-threading.md.

MCP session action=submit deliberately has no new Tauri command. It is a request-scoped orchestration contract in mcp_transport.rs: it reuses the PTY injection claim, writer, input FSM, and output ring, then keeps the MCP response open for a bounded terminal-movement receipt. Desktop write_pty and write_pty_parts remain raw input primitives and make no acknowledgement claim.

Design Mode (design_mode/tauri_commands.rs)

The desktop commands and their HTTP equivalents control the same per-repository Chrome inspector. A start is bound to the named agent session; a second start for the repository rebinds its existing Chrome window. A grab is inserted into that session’s input draft without submitting it.

Command responses use { repoPath, sessionId, status }, with status equal to armed or stopped. The backend also emits design-mode-changed with a snake_case event payload { repo_path, session_id, status }; browser clients receive it on /events.

Generators (generators.rs)

Git Operations (git.rs)

Commit Graph (git_graph.rs)

GitHub Authentication (github_auth.rs)

GitHub Integration (github.rs)

Review, Changelog and Improvement Scan (pr_review.rs, changelog.rs, improvement_scan.rs)

Each of the first three is one unattended acp::oneshot turn (#795-320b): the whole input goes inline, ego is offered no host tools, and every permission request is refused. No API key is stored and no provider HTTP call is made from TUICommander; which model runs is ego’s own configuration. An ego that cannot be reached is an error carrying ego’s own sentence, never an empty result.

Worktree Management (worktree.rs)

Configuration (config.rs)

SSH Tunnels (tunnels/tauri_commands.rs)

Remote Connections (remote_connection.rs)

Remote Connection Runtime (remote_runtime.rs)

remote_connection.rs above says what a connection is; these say whether it is up. The state machine — health probe, token exchange, status poll, SSH tunnel and base URL — runs in Rust so that backend tasks, not only the WebView, can reach a remote daemon.

Agent Detection (agent.rs)

Agent Session Discovery (agent_session.rs)

Panel Windows (panel_window.rs)

Detaching a panel into its own OS window. Used by the AI Chat panel, the Activity Dashboard and the Git panel.

The embedded AI engine is gone (#784-0aec)

There is no ai_chat.rs, ai_chat_registry.rs, provider_registry.rs, llm_api.rs, diff_triage.rs, improvement_scan.rs or changelog.rs, and ai_agent/ holds only knowledge.rs and tui_detect.rs. Every command those modules registered is unregistered, every /ai/* route is unmounted, and the matching COMMAND_TABLE entries are removed from src/transport.ts. TUICommander makes no provider HTTP call and stores no model API key.

ego supplies the intelligence over ACP — see ACP client for ego below. What comes back where is tabulated in docs/sync-matrix.md under What #784-0aec removed.

Command knowledge is the one thing that stayed, because recording it involves no model: pty.rs still writes CommandOutcome rows per session and ai_agent::knowledge::spawn_persist_task still flushes them to <config_dir>/ai-sessions/<session_id>.json. No command reads them back — the get_session_knowledge, list_knowledge_sessions and get_knowledge_session_detail accessors went with the UI that called them.

MCP OAuth 2.1 (mcp_oauth/commands.rs)

OAuth 2.1 authorization for upstream MCP servers. Full RFC 9728 (Protected Resource Metadata) + RFC 8414 (Authorization Server Discovery) flow with PKCE S256. Completion via the tuic://oauth-callback deep link.

MCP Upstream Proxy (mcp_upstream_config.rs, mcp_upstream_credentials.rs)

Commands for managing upstream MCP servers proxied through TUICommander’s /mcp endpoint.

UpstreamMcpConfig schema

interface UpstreamMcpConfig {
  servers: UpstreamMcpServer[];
}

interface UpstreamMcpServer {
  id: string;              // Unique UUID, used for config diff tracking
  name: string;            // Namespace prefix — must match [a-z0-9_-]+
  transport: UpstreamTransport;
  enabled: boolean;        // Default: true
  timeout_secs: number;    // Default: 30 (0 = no timeout, HTTP only)
  tool_filter?: ToolFilter; // Optional allow/deny filter
}

type UpstreamTransport =
  | { type: "http"; url: string }
  | { type: "stdio"; command: string; args: string[]; env: Record<string, string> };

interface ToolFilter {
  mode: "allow" | "deny";
  patterns: string[];  // Exact names or trailing-* glob prefix patterns
}

Upstream status values

The live registry exposes status via SSE events (upstream_status_changed). Valid status strings:

Agent MCP Configuration (agent_mcp.rs)

Prompt Processing (prompt.rs)

Smart Prompt Execution (smart_prompt.rs)

Claude Usage (claude_usage.rs)

scope values: "all" (all projects) or a specific project slug. days defaults to 7.

Uses incremental parsing with a file-size-based cache (claude-usage-cache.json) so only newly appended JSONL data is processed on each call. The cache is persisted across app restarts.

Voice Dictation (dictation/)

These commands stay in the root dictation/commands.rs adapter; their audio and speech operations use tuic-dictation. The command names and payloads are unchanged by the crate split.

Native file dialogs (native_dialog.rs)

Desktop-only, therefore INTENTIONALLY_UNMAPPED in transport.ts: the panel browses the host’s filesystem, and a remote client uses the in-app file browser instead.

Call it through src/utils/nativeDialog.ts (openDialog/saveDialog), not directly, and do not import open/save from @tauri-apps/plugin-dialog. The plugin builds NSOpenPanel/NSSavePanel inside its own main-thread closure, so when AppKit’s window-server link is interrupted — the state the Mac wakes into after standby — the binding’s NULL check panics on the main thread and the process dies with every live PTY session. native_dialog.rs owns that closure so the unwind is caught and returned as an error. The plugin’s confirm/message are unaffected (they build NSAlert) and stay as they are.

Filesystem (fs.rs)

upload_attachment is the desktop IPC twin of POST /attachments/upload. It accepts kind, id, name, and binary bytes, returns the same { path, size } receipt, and uses the same destination, cap, and cleanup rules.

search_content_all reports why a repo produced nothing, so the UI can tell “no match” apart from “not searched yet”. Every ContentSearchResult and every content-search-batch carries repos_searched, repos_pending, and repos_indexing — the last being the subset of repos_pending with a build actually in flight. Only that subset justifies telling the user to retry; the rest are waiting on a scheduling event that may never come.

For both commands, every ContentMatch.match_start/match_end pair is a zero-based, end-exclusive UTF-16 code-unit range within line_text, matching JavaScript String.slice semantics for ASCII, accented text, and non-BMP emoji.

Plugin Management (plugins.rs)

Plugin Filesystem (plugin_fs.rs)

Plugin HTTP (plugin_http.rs)

Code Intelligence / MDKB (mdkb_commands.rs)

Line numbers are 1-based on this boundary. mdkb stores symbol ranges 0-based but takes a 1-based line as input to symbol_at_position. mdkb_commands::editor_line shifts every response so line/line_start/line_end reaching the frontend match CodeMirror’s doc.line(n). Request args (mdkb_goto_definition’s line) are already 1-based and pass through unchanged.

Each mdkb method has a different response shape — do not assume “a JSON array of symbols”:

code_graph’s symbols field was added after mdkb 3.7.17. Against an older daemon the field is absent and the call fails loudly — “no callers” is symbols: [], so an absent field can only mean a stale daemon and must never be reported as an empty result.

Plugin CLI Execution (plugin_exec.rs)

Plugin Credentials (plugin_credentials.rs)

Plugin Registry (registry.rs)

Watchers

System (lib.rs)

Global Hotkey

App Logger (app_logger.rs)

Notification Sound (notification_sound.rs)

ACP client for ego (acp_commands.rs)

Drives an ego agent over the Agent Client Protocol. Every command is a one-line pass-through to AcpClientManager; each has an identical HTTP route (see docs/api/http-api.md) so a browser or the PWA gets the same answers, including the same error bodies. The shared event stream sends turnFailed {message, state} when an accepted prompt later fails; the event envelope identifies its session and turn.

The binary this launches is not an argument. It comes from the ego_executable setting, read at each connect, so no caller over IPC or HTTP can choose what the host runs.

Errors are an AcpClientError — code, message, connectionId, sessionId, operation, retryable — identical on both transports.

acp_one_shot_prompt is the odd one out and deliberately so. It is what a Smart Prompt in api mode runs on, with no panel open and nobody watching, so its session is opened with no MCP server and every permission request and elicitation is refused the instant it arrives. EgoTurn is { text, stopReason, declined }; declined separates “ego had nothing to say” from “ego wanted a tool this mode cannot grant”. The turn is abandoned after 300s, a server-side constant rather than an argument.

ego command line (ego_cli.rs)

Reads and writes ego’s configuration by running ego, for the Settings → AI Chat page. TUIC stores no API key and makes no provider HTTP call; the one network call is ego models --refresh, which ego makes, and only when asked.

Four rules hold this surface down:

• The binary is the configured ego_executable, read per call. No argument names a program.
• There is no key parameter. Dedicated operations write only model, roots and network, so a caller cannot reach sandbox or permissions.judge at all.
• A model value may not look like a flag, carry whitespace or a control character, or contain " or \ — the last two would break out of ego’s TOML string.
• A failure carries what ego printed.

Perimeter operations select --profile from ego_profile and cwd from ai_chat_workspace (empty means host HOME); that directory must exist. They remove ambient EGO_PROFILE so the preview matches the configured ACP profile. Path strings are TOML-encoded in Rust, never written to the TOML file by TUIC. Each allowlist is newline-delimited; the primary root is one path. rootAccess is read or read-write. Paths must be absolute or start with ~/; limits are 128 entries and 64 KiB of path input. Empty fields encode explicit roots=[]. The response contains the edit fields, networkEnabled, selected profile, effective (ego’s original snake_case JSON schema), execEnforcement (enforcedByOs, promptOnly, notChecked), and a display-ready preview. Capability evidence remains exactly what ego reports: a measured string array or not_checked, with optional capabilities_reason and probe_evidence. Rust classifies the exec badge: ro needs read_scoped + write_denied, workspace needs read_scoped + write_scoped, and offline adds no_ip_network. An empty/partial measured set is Prompt only; unknown evidence is unverified. The measured form needs its probe reference. off + online is Prompt only, never a vacuous OS-enforcement success. Headless inspection currently has no measurement, so it reports not checked and its reason.

All three reads must succeed. A partial answer would render as a tab silently missing one of the three things it exists to show.

Errors are an EgoCliError — code (notConfigured, invalidInput, launchFailed, commandFailed, unreadableOutput), message, command, stdout, stderr, exitCode — identical on both transports. command is spelled by file name only, and the captured output is clipped to 4000 characters on a character boundary.

Private secret form commands

secret_form_bootstrap takes no arguments and checks the native caller window against the backend-created private window. It is intentionally unmapped: an HTTP client must already possess the privately delivered capability. secret_form_submit {submission} checks the same native identity and uses the same schema and consumption logic as POST /secrets/forms/submit.

Workflow definition and human-decision IPC commands use host Human authority. HTTP equivalents require verified credentials for that authority; local address admission grants LocalApi only. Native story plan_state and plan_view use current integration receipts for workflow-owned plans.

Stored terminal marker coordinates

OSC 133 event line and hook-generated UserInput.line use all-time rows. terminal_scroll_to, terminal_get_lines and search results keep their retained-grid coordinates; callers subtract the current frame historyBase when using stored markers.

Telegram Settings

• telegram_settings: safe settings snapshot (enabled, token_set, bot_alias, registered_agent_name (nullable), decimal-string chats, connected, last_error, last_message_time). Never returns a token or message text.
• telegram_setup { change }: change.action is token (password token, checks getMe), pair (returns code, expires_in_seconds), add_chat/remove_chat (chat_id), or configure (enabled). Errors are typed safe Telegram categories.

The daemon executor now owns recovery and duration timers under an OS run-database lock. Reads never recover live work, and a non-owner daemon refuses run mutations. Graph resume uses resume_graph {execution_id,activation_id,resolution} with an explicit pending activation; status-only resume cannot bypass graph position. Graph start controls, Agent effects and delivery policy remain unavailable until their later slices.

acp_session_fork accepts optional atMessageId, with the same behavior as the ACP HTTP fork route. Capability snapshots expose forkAtMessage separately from tip fork support.

acp_session_list uses the same complete ancestry projection as HTTP: original ego lineage plus _meta.tuicommander.lineageDepth and disabled deleted-parent placeholders.

workflow_run_action also accepts the read-only incidents action with run_id. It returns the same project-scoped camelCase incident entries as POST /workflows/run/action; see the HTTP API run incident projection.

acp_chat_open

Arguments: { request: { sessionId?, profile?, workspace?, executable? } }. Returns { connection, sessionId, launch, replayed }. Creates a conversation with its own durable launch options, or reopens the saved sessionId. HTTP equivalent: POST /acp/chat/open with the request object as the body. Global ACP connect defaults remain unchanged.

MCP session action=declare_worktree is intentionally not a Tauri command. It requires a bound managed caller, which window IPC does not supply. Call it via HTTP POST /mcp. Its session-worktree-declared push is also emitted to Tauri; list_active_sessions and HTTP GET /sessions report the persisted declaration in their existing worktree fields. See MCP backend.

Desktop text clipboard

Both commands require the desktop feature and run blocking clipboard operations on worker threads. They have no focus or user-gesture requirement. The clipboard owner stays alive between calls and is released on application exit. They are INTENTIONALLY_UNMAPPED: browser clients use navigator.clipboard on their own machine; HTTP clients cannot read or write the host pasteboard.

Automations

automation_action(input: serde_json::Value) -> Result<serde_json::Value, String> is an async command that shares parsing, definition edits, history, schedule previews/presets, UTC run summaries and owner-guarded Run Now with POST /automations/action. Invoke with {input:{action:"list"}}; response values and application error messages match HTTP. See the HTTP Automations action table for every field and reply. Blocking storage/schedule work runs off the main thread. Run Now executes only on the addressed backend; phase 1 is Once-only.