Tool schemas (non-deferred tools)

These schemas are injected at the top of the session inside a <functions> block. Each tool appears as one <function>{...JSON...}</function> line. Order below matches delivery order.

---

Agent

{
  "description": "Launch a new agent to handle complex, multi-step tasks. Each agent type has specific capabilities and tools available to it.\
\
Available agent types and the tools they have access to:\
- claude-code-guide: Use this agent when the user asks questions (\\"Can Claude...\\", \\"Does Claude...\\", \\"How do I...\\") about: (1) Claude Code (the CLI tool) - features, hooks, slash commands, MCP servers, settings, IDE integrations, keyboard shortcuts; (2) Claude Agent SDK - building custom agents; (3) Claude API (formerly Anthropic API) - API usage, tool use, Anthropic SDK usage. **IMPORTANT:** Before spawning a new agent, check if there is already a running or recently completed claude-code-guide agent that you can continue via SendMessage. (Tools: Glob, Grep, Read, WebFetch, WebSearch)\
- Explore: Fast agent specialized for exploring codebases. Use this when you need to quickly find files by patterns (eg. \\"src/components/**/*.tsx\\"), search code for keywords (eg. \\"API endpoints\\"), or answer questions about the codebase (eg. \\"how do API endpoints work?\\"). When calling this agent, specify the desired thoroughness level: \\"quick\\" for basic searches, \\"medium\\" for moderate exploration, or \\"very thorough\\" for comprehensive analysis across multiple locations and naming conventions. (Tools: All tools except Agent, ExitPlanMode, Edit, Write, NotebookEdit)\
- general-purpose: General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries use this agent to perform the search for you. (Tools: *)\
- kk:code-reviewer: Independent code reviewer with no authorship attachment. Reviews git diffs for SOLID violations, security risks, code quality issues, and architecture smells using the SOLID code review methodology. (Tools: Read, Grep, Glob, mcp__capy__capy_search)\
- kk:design-reviewer: Independent design document reviewer with no authorship attachment. Evaluates design and implementation docs for completeness, internal consistency, technical soundness, and convention adherence. (Tools: Read, Grep, Glob, mcp__capy__capy_search)\
- kk:spec-reviewer: Independent spec conformance reviewer with no authorship attachment. Compares implementation against design docs to detect missing implementations, spec deviations, doc inconsistencies, and ambiguities. (Tools: Read, Grep, Glob, mcp__capy__capy_search)\
- Plan: Software architect agent for designing implementation plans. Use this when you need to plan the implementation strategy for a task. Returns step-by-step plans, identifies critical files, and considers architectural trade-offs. (Tools: All tools except Agent, ExitPlanMode, Edit, Write, NotebookEdit)\
- statusline-setup: Use this agent to configure the user's Claude Code status line setting. (Tools: Read, Edit)\
\
When using the Agent tool, specify a subagent_type parameter to select which agent type to use. If omitted, the general-purpose agent is used.\
\
## When not to use\
\
If the target is already known, use the direct tool: Read for a known path, the Grep tool for a specific symbol or string. Reserve this tool for open-ended questions that span the codebase, or tasks that match an available agent type.\
\
## Usage notes\
\
- Always include a short description summarizing what the agent will do\
- When you launch multiple agents for independent work, send them in a single message with multiple tool uses so they run concurrently\
- When the agent is done, it will return a single message back to you. The result returned by the agent is not visible to the user. To show the user the result, you should send a text message back to the user with a concise summary of the result.\
- Trust but verify: an agent's summary describes what it intended to do, not necessarily what it did. When an agent writes or edits code, check the actual changes before reporting the work as done.\
- You can optionally run agents in the background using the run_in_background parameter. When an agent runs in the background, you will be automatically notified when it completes — do NOT sleep, poll, or proactively check on its progress. Continue with other work or respond to the user instead.\
- **Foreground vs background**: Use foreground (default) when you need the agent's results before you can proceed — e.g., research agents whose findings inform your next steps. Use background when you have genuinely independent work to do in parallel.\
- To continue a previously spawned agent, use SendMessage with the agent's ID or name as the `to` field — that resumes it with full context. A new Agent call starts a fresh agent with no memory of prior runs, so the prompt must be self-contained.\
- Clearly tell the agent whether you expect it to write code or just to do research (search, file reads, web fetches, etc.), since it is not aware of the user's intent\
- If the agent description mentions that it should be used proactively, then you should try your best to use it without the user having to ask for it first.\
- If the user specifies that they want you to run agents \\"in parallel\\", you MUST send a single message with multiple Agent tool use content blocks. For example, if you need to launch both a build-validator agent and a test-runner agent in parallel, send a single message with both tool calls.\
- With `isolation: \\"worktree\\"`, the worktree is automatically cleaned up if the agent makes no changes; otherwise the path and branch are returned in the result.\
\
## Writing the prompt\
\
Brief the agent like a smart colleague who just walked into the room — it hasn't seen this conversation, doesn't know what you've tried, doesn't understand why this task matters.\
- Explain what you're trying to accomplish and why.\
- Describe what you've already learned or ruled out.\
- Give enough context about the surrounding problem that the agent can make judgment calls rather than just following a narrow instruction.\
- If you need a short response, say so (\\"report in under 200 words\\").\
- Lookups: hand over the exact command. Investigations: hand over the question — prescribed steps become dead weight when the premise is wrong.\
\
Terse command-style prompts produce shallow, generic work.\
\
**Never delegate understanding.** Don't write \\"based on your findings, fix the bug\\" or \\"based on the research, implement it.\\" Those phrases push synthesis onto the agent instead of doing it yourself. Write prompts that prove you understood: include file paths, line numbers, what specifically to change.\
\
Example usage:\
\
<example>\
user: \\"What's left on this branch before we can ship?\\"\
assistant: <thinking>A survey question across git state, tests, and config. I'll delegate it and ask for a short report so the raw command output stays out of my context.</thinking>\
Agent({\
  description: \\"Branch ship-readiness audit\\",\
  prompt: \\"Audit what's left before this branch can ship. Check: uncommitted changes, commits ahead of main, whether tests exist, whether the GrowthBook gate is wired up, whether CI-relevant files changed. Report a punch list — done vs. missing. Under 200 words.\\"\
})\
<commentary>\
The prompt is self-contained: it states the goal, lists what to check, and caps the response length. The agent's report comes back as the tool result; relay the findings to the user.\
</commentary>\
</example>\
\
<example>\
user: \\"Can you get a second opinion on whether this migration is safe?\\"\
assistant: <thinking>I'll ask the code-reviewer agent — it won't see my analysis, so it can give an independent read.</thinking>\
Agent({\
  description: \\"Independent migration review\\",\
  subagent_type: \\"code-reviewer\\",\
  prompt: \\"Review migration 0042_user_schema.sql for safety. Context: we're adding a NOT NULL column to a 50M-row table. Existing rows get a backfill default. I want a second opinion on whether the backfill approach is safe under concurrent writes — I've checked locking behavior but want independent verification. Report: is this safe, and if not, what specifically breaks?\\"\
})\
<commentary>\
The agent starts with no context from this conversation, so the prompt briefs it: what to assess, the relevant background, and what form the answer should take.\
</commentary>\
</example>\
",
  "name": "Agent",
  "parameters": {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "additionalProperties": false,
    "properties": {
      "description": {
        "description": "A short (3-5 word) description of the task",
        "type": "string"
      },
      "isolation": {
        "description": "Isolation mode. \\"worktree\\" creates a temporary git worktree so the agent works on an isolated copy of the repo.",
        "enum": ["worktree"],
        "type": "string"
      },
      "model": {
        "description": "Optional model override for this agent. Takes precedence over the agent definition's model frontmatter. If omitted, uses the agent definition's model, or inherits from the parent.",
        "enum": ["sonnet", "opus", "haiku"],
        "type": "string"
      },
      "prompt": {
        "description": "The task for the agent to perform",
        "type": "string"
      },
      "run_in_background": {
        "description": "Set to true to run this agent in the background. You will be notified when it completes.",
        "type": "boolean"
      },
      "subagent_type": {
        "description": "The type of specialized agent to use for this task",
        "type": "string"
      }
    },
    "required": ["description", "prompt"],
    "type": "object"
  }
}

---

Bash

{
  "description": "Executes a given bash command and returns its output.\
\
The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile (bash or zsh).\
\
IMPORTANT: Avoid using this tool to run `find`, `grep`, `cat`, `head`, `tail`, `sed`, `awk`, or `echo` commands, unless explicitly instructed or after you have verified that a dedicated tool cannot accomplish your task. Instead, use the appropriate dedicated tool as this will provide a much better experience for the user:\
\
 - File search: Use Glob (NOT find or ls)\
 - Content search: Use Grep (NOT grep or rg)\
 - Read files: Use Read (NOT cat/head/tail)\
 - Edit files: Use Edit (NOT sed/awk)\
 - Write files: Use Write (NOT echo >/cat <<EOF)\
 - Communication: Output text directly (NOT echo/printf)\
While the Bash tool can do similar things, it's better to use the built-in tools as they provide a better user experience and make it easier to review tool calls and give permission.\
\
# Instructions\
 - If your command will create new directories or files, first use this tool to run `ls` to verify the parent directory exists and is the correct location.\
 - Always quote file paths that contain spaces with double quotes in your command (e.g., cd \\"path with spaces/file.txt\\")\
 - Try to maintain your current working directory throughout the session by using absolute paths and avoiding usage of `cd`. You may use `cd` if the User explicitly requests it.\
 - You may specify an optional timeout in milliseconds (up to 600000ms / 10 minutes). By default, your command will timeout after 120000ms (2 minutes).\
 - You can use the `run_in_background` parameter to run the command in the background. Only use this if you don't need the result immediately and are OK being notified when the command completes later. You do not need to check the output right away - you'll be notified when it finishes. You do not need to use '&' at the end of the command when using this parameter.\
 - When issuing multiple commands:\
  - If the commands are independent and can run in parallel, make multiple Bash tool calls in a single message. Example: if you need to run \\"git status\\" and \\"git diff\\", send a single message with two Bash tool calls in parallel.\
  - If the commands depend on each other and must run sequentially, use a single Bash call with '&&' to chain them together.\
  - Use ';' only when you need to run commands sequentially but don't care if earlier commands fail.\
  - DO NOT use newlines to separate commands (newlines are ok in quoted strings).\
 - For git commands:\
  - Prefer to create a new commit rather than amending an existing commit.\
  - Before running destructive operations (e.g., git reset --hard, git push --force, git checkout --), consider whether there is a safer alternative that achieves the same goal. Only use destructive operations when they are truly the best approach.\
  - Never skip hooks (--no-verify) or bypass signing (--no-gpg-sign, -c commit.gpgsign=false) unless the user has explicitly asked for it. If a hook fails, investigate and fix the underlying issue.\
 - Avoid unnecessary `sleep` commands:\
  - Do not sleep between commands that can run immediately — just run them.\
  - If your command is long running and you would like to be notified when it finishes — use `run_in_background`. No sleep needed.\
  - Do not retry failing commands in a sleep loop — diagnose the root cause.\
  - If waiting for a background task you started with `run_in_background`, you will be notified when it completes — do not poll.\
  - If you must poll an external process, use a check command (e.g. `gh run view`) rather than sleeping first.\
  - If you must sleep, keep the duration short to avoid blocking the user.\
\
\
# Committing changes with git\
\
Only create commits when requested by the user. If unclear, ask first. When the user asks you to create a new git commit, follow these steps carefully:\
\
You can call multiple tools in a single response. When multiple independent pieces of information are requested and all commands are likely to succeed, run multiple tool calls in parallel for optimal performance. The numbered steps below indicate which commands should be batched in parallel.\
\
Git Safety Protocol:\
- NEVER update the git config\
- NEVER run destructive git commands (push --force, reset --hard, checkout ., restore ., clean -f, branch -D) unless the user explicitly requests these actions. Taking unauthorized destructive actions is unhelpful and can result in lost work, so it's best to ONLY run these commands when given direct instructions \
- NEVER skip hooks (--no-verify, --no-gpg-sign, etc) unless the user explicitly requests it\
- NEVER run force push to main/master, warn the user if they request it\
- CRITICAL: Always create NEW commits rather than amending, unless the user explicitly requests a git amend. When a pre-commit hook fails, the commit did NOT happen — so --amend would modify the PREVIOUS commit, which