focus_application
Bring an already-running application window to the foreground.
application: string
get_case_evidenceread-only
List every piece of evidence recorded on the board so far (ids, sections, summaries).
get_emailread-onlyuntrusted content
Read one email's full text by id (e.g. mail_101). Then consider open_email so the player sees it too.
emailId: string
get_image_metadataread-only
Read EXIF-style metadata for a photo (timestamps, GPS, camera, software, hash, notes). This is ALL you can know about an image — you cannot see its pixels. To have the player look at it, call open_image and then tell…
photoId: string
get_investigation_contextread-only
Get your role briefing, the rules of play and the current case state. Call this first and follow the returned 'protocol' exactly. You are the workstation's onboard research AI; the player is an authorized…
get_message_threadread-onlyuntrusted content
Read one full chat thread by id. Use search_messages or get_investigation_context to discover thread ids for this corpus.
threadId: string
get_system_logsread-onlyuntrusted content
Read system log entries, optionally filtered by date, time, category ('NETWORK'/'LOGIN'/'DEVICE'/'POWER'/'SECURITY'), or free text. Call get_investigation_context first for the window that matters in this case.
filter: string?
get_timelineread-onlyuntrusted content
Get a merged chronological timeline of system logs, photo timestamps, and message saliency across a time window. A human would need to open five apps and read them side by side; this synthesizes it in one call.
window: string?
highlight_evidence
Pulse-highlight an already-recorded item on the Evidence board to draw the player's attention.
evidenceId: string
open_application
Open and focus one of the workstation's applications. Visible to the player — the window opens on their desktop.
application: string
open_browser_entry
Open the fictional Browser at a history entry's cached page (entry ids like hist_001 from search_browser_history).
entryId: string
open_directory
Navigate the File Manager to a directory on the player's screen.
path: string
open_email
Open Mail and display a specific email on screen for the player to read.
emailId: string
open_evidence_board
Open the shared Evidence board application.
open_file
Open a document in the text viewer on the player's screen (opens File Manager context automatically). Does not scroll — use show_in_document when you want to guide them to a specific line or phrase.
path: string
open_image
Open a photo in the image viewer on screen so the player can visually inspect it. You cannot zoom, pan, or see it yourself.
photoId: string
open_messages_thread
Open the Messages app on screen and show a specific chat thread. Visible to the player — they can then read the bubbles.
threadId: string
read_fileread-onlyuntrusted content
Read the full text content of a specific file by exact path. Prefer show_in_document for long files so the PLAYER reads it on screen instead.
path: string
record_evidence
Record a discovered item on the shared Evidence board. Only meaningful ids from get_case_evidence may be added; you cannot invent evidence.
evidenceId: string
search_browser_historyread-onlyuntrusted content
Search the browser history entries by title or URL fragment.
query: string
search_emailsread-onlyuntrusted content
Search the mail store (inbox/sent/drafts/archive/trash) by sender, subject or body text.
query: string
search_filesread-onlyuntrusted content
Search filenames and readable file contents across the filesystem. Returns matching paths plus a short content excerpt per match. Returns at most 25 results with 120-char excerpts — refine query for pagination.
query: string
search_messagesread-onlyuntrusted content
Full-text search of the on-device chat threads. Call get_investigation_context for who is on this machine.
query: string
show_in_document
Open a document (if not open), scroll to a line, and pin a persistent highlight on it that stays until the player clicks, scrolls, types, or closes. Provide either a 1-based `line` or a `query` (first match is shown).…
path: string, line: number?, query: string?
terminal_command
Run one command in the workstation terminal on screen: ls [path], cd [path], cat <file>, unlock <w1> <w2> <w3>, help, clear. Use 'unlock' ONLY when the player has derived the three-word sequence themselves.
command: string