What W1 can do
W1 works through a fixed set of tools. Knowing what is on the list tells you what to ask for — and what it will never quietly do.
There is no hidden thirty-first tool, and nothing is added at runtime except what you install yourself as a plugin. The whole surface is below.
Tools are capability, not permission.
Being on this list means W1 can call it. Whether a particular call runs without asking you is a separate question, answered on Permissions and access.
Reading and searching#
| Tool | What it does |
|---|---|
read | Read a file, or a slice of one. Reads PDFs too, by page range or by searching inside them. |
grep | Search the workspace by regular expression, optionally narrowed by glob. Can return just the file paths, which is far cheaper for "where does this live". |
explore | Hand a read-only question to a fast subagent — "where is X handled", "how does Y flow" — and get back a compact digest with file paths and evidence. It reads in its own context and returns a short answer, so twenty files cost a fraction of reading them in the main thread. |
view_image | Look at an image, a screenshot you attached, or a rendered PDF page, and describe what is actually there. |
skill_read | Load one skill from the index when the task calls for it. |
Changing files#
| Tool | What it does |
|---|---|
edit | Exact, non-overlapping replacements in one file. Several related replacements go in one call, and the whole set is validated before the first byte is written. |
write | Write a file in full. Used for new files, and for rewrites where a patch would be nonsense. |
Both are confined to the project folder, and both are covered by rewind.
Running things#
| Tool | What it does |
|---|---|
bash | Run a command in the project, with a timeout it has to choose deliberately (90 seconds by default, 15 minutes at the very most). Each call declares its own risk level. |
services | Start a long-lived process — a dev server, a watcher — as a background service with its own log, then list, tail or stop it. A service keeps running after the turn ends, so nothing sits blocking on it. |
wake | Wait for a set time or for a long command to land, and wake W1 when it does, instead of burning the run on a sleep. |
task_start | Start a background task: a read-only scout that investigates, or a worker that does real work with the full tool set. task_status and task_cancel manage them. |
Working with you#
| Tool | What it does |
|---|---|
task_update | Publish the plan as a checklist you can see, and keep its statuses current as the work moves. The checklist is what W1 declared it would do — never an inferred one. |
ask_user | Ask you one blocking question, usually with a few suggested answers, when guessing would waste the run. |
memory_read / memory_update | Read and write memory. Ordinary file tools are never used for this. |
The web#
| Tool | What it does |
|---|---|
web_search | Search the live web and return a compact list of results. |
web_fetch | Open one page and read it as clean markdown. |
artifact_publish | Share one finished HTML page as a link. W1 encrypts it on your machine and uploads only ciphertext — the key stays in the link's #fragment, which browsers never send to a server. It asks you first, and offers private or public. Declining is a normal answer. |
The collaborative browser#
On the desktop app and in VS Code, W1 has a browser it drives next to you: browser_open, browser_navigate, browser_snapshot, browser_click, browser_type, browser_press, browser_scroll, browser_wait, browser_resize, browser_evaluate, browser_tabs and browser_status.
It is how W1 checks its own front-end work — open the page, look at the real rendered state, click the thing, read the console — rather than asking you whether the button works. It reads the page's semantic structure by default and only looks at pixels when it has to.
The CLI has no browser, and the browser tools are not offered there at all. A surface never advertises tools it cannot host.
It is collaborative on purpose.
Tabs open in the background instead of grabbing your screen, and you can watch or take over at any point. Writes on a site are an approval boundary — see Permissions.
What is not on the list#
There is no "commit and push" tool, no deploy tool, no send-email tool. Work like that happens through bash, which means it goes through the same approval and denylist path as everything else, and it shows up in the run as the command it actually was.