A desk acts through tools. Each tool is a class with a JSON schema, and the same tools are offered to every model. The table below lists all 49, grouped by what they are for.
The full description each model reads is in the API reference, one page per tool, such as place_order. A tool call that runs longer than 60 seconds is stopped, and the loop guard stops a tool called three times with the same arguments in one turn. A tool listed in [approvals], which is only flatten_desk on this machine, is held until you allow it, as Questions, plans and permissions explains.
Each desk has one bash session that keeps running between commands, so the current folder and variables carry over. It runs inside bwrap, a sandbox: the desk's scratch/ folder and /tmp are the only places it may write, the project and your files are read-only, and the folders that hold secrets appear empty.
What the desk's bash session can reach. It may write only in its scratch folder; the project is read-only; credential folders and every .env appear empty; the network is open so it can fetch data.
The sandbox starts with an empty environment, so no secret reaches it unless [sandbox] passed_environment names it.
Each desk has its own headless Chrome with a clean profile, never your own, because your profile holds your broker logins. A page comes back as a snapshot: its title, its clickable elements numbered so the model can click by number, and its visible text. The models can also take a screenshot and look at it, and Chat shows it under the tool's card. Pictures and documents explains view_image and send_image.
The browser tools. A request guard blocks local addresses, so a page cannot reach UBI or the gateway through the desk's browser; what comes back is numbered elements and text, or a screenshot.
web_search asks the local SearXNG server, and web_fetch turns one page into its main text with its title and date. Both are far cheaper than the browser for reading news. web_fetch and the browser share the address guard: every address a host name resolves to must be a public internet address, checked again at each redirect, so a page cannot steer a desk to UBI, the databases or a router on the home network. Text from the web is labelled as untrusted data before the model reads it, as Extensions explains.
Every tool call, result, order, risk decision and fill is written to the desk's journal, one file per day, after secrets are masked. The Activity page reads it, and so does search_sessions.
The broker reader reads UBI for the desk; every event passes through the secret redactor before the journal writes it and the live stream sends it.