Read · 5 tools
| listFiles | Browse project files with cursor pagination. Skips .git and node_modules; respects .gitignore by default. A directory path typed by the user can also be listed for that turn. |
| readFile | Read numbered UTF-8 lines in bounded pages (exact or outline mode). A small signature-checked sparse index makes later pages cheap. User-typed paths may open files outside the workspace, read-only, for that turn. |
| grep | Regex search over the workspace using a bundled ripgrep binary. Results carry a global cap; ignored paths require an explicit override, and traversal stays out of .git and dependency roots either way. |
| readToolOutput | Re-page raw output that was too large for the original tool result, by offset or substring query. Retained data has fixed per-entry and total memory limits. |
| lsp* | Optional symbol-path retrieval, enriched references, diagnostics, rename, and safe-delete operations through a language server configured with /lsp. See below. |
All file tools refuse protected secret files before any filesystem access: SSH keys, shell history files, .env/.envrc files, *.pem/*.key, and common home credential stores. The refusal is terminal (secret_file_protected, recoverable: false), cannot be bypassed by user-typed path mentions, ignore overrides, or symlinks, and grep traversal skips those names entirely. Documentation variants (.env.example, .env.sample, .env.template, id_*.pub) stay readable.
Write · 4 tools
| editFile | Batched unique text replacements with line-prefix tolerance and recovery hints on failure. Small edits render as inline diffs; large ones as summaries. |
| replaceInFiles | Guarded literal or regex replacement across files, with dry-run previews, stable occurrence IDs, include/exclude globs, and an expected-count guard. Matched files pass the same read policy as every file tool — protected secret files are refused before the scan opens anything. |
| replaceLines | 1-based inclusive line-range replacement with EOF clamping for slightly-oversized ranges. The fallback when exact text matching is ambiguous. |
| writeFile | Create files and parent directories. Overwriting an existing file requires an explicit flag. |
Shell · 2 tools
| shell | Run commands in the user's login shell with capped, classification-aware output. Each result reports cwd, duration, and exit status; validation output (tests, typecheck, lint) is parsed into pass/fail summaries. Validation-classified pipelines run under pipefail, masking command lists are not accepted as passing evidence, and generic custom checks cannot erase a classified failure. Set background=true to register a dev server or watcher. On timeout or abort, haze kills the full process tree and never waits on orphaned pipes. |
| process | List registered background processes, read their rolling output (256 KB each, up to five processes), or kill them. A session reset or haze exit stops every registered process tree. Background processes are unavailable inside fleet workers. |
Network · 1 tool
| fetch | Read public http(s) URLs as Markdown, pretty JSON, or raw text. haze rejects private/loopback/metadata hosts and unsafe schemes, validates every redirect, pins each connection to the public IP it checked, and enforces one total deadline. Non-streamable responses are refused rather than buffered without a cap. Oversize responses are retrievable by handle. |
Agent state · 3 tools
| writeTasks | Maintain a visible task list for substantial work; haze clears completed lists automatically. There is deliberately no user-facing task command — the model owns this. |
| skill | Load one global or project Markdown skill by name, then read its references as needed. Results show the skill's provenance; project skills are labeled as untrusted repository content. |
| subagent | Send self-contained work to disposable, context-isolated workers with a fixed mode (inspect / research / implement / validate) and tool budget. Workers start from project instructions; the parent conversation receives only the compact deliverable. /fleet orchestrates several at once. |
LSP & MCP
Language servers — /lsp
Configure language-server navigation and refactoring interactively. Presets exist for TypeScript, Rust, Python, Go, and PHP, or add any custom command. Tools can retrieve hierarchical symbols and bodies, enrich references with enclosing symbols and snippets, inspect symbol-scoped diagnostics, perform semantic renames, and delete only unreferenced symbols. Warm servers receive external file-change notifications, wait for bounded indexing progress, and restart once after termination. All returned locations and workspace edits remain workspace-confined. haze does not install servers: LSP tools appear only when an enabled server binary is on PATH.
MCP servers — /mcp
Connect Model Context Protocol servers to extend the toolset: presets (Context7 for live library docs), or custom http / sse / stdio servers. HTTP API keys are entered masked and sent as bearer tokens; discovery has bounded deadlines, failures are isolated, and MCP tools never shadow built-ins. Servers persist in ~/.haze/settings.json under mcpServers.
Safety boundaries
- Workspace confinement. Mutating tools never leave
process.cwd(). User-typed paths can bless host locations for read-only tools for one turn; that never expands write access.
- Secrets stay local. API keys live in
~/.haze/settings.json (0600), not in environment variables. Remote endpoints require HTTPS when credentials are sent.
- Bounded output. Command and tool output is capped at collection time; oversize raw data stays retrievable by handle with fixed memory limits.
- No hangs. Foreground timeouts and aborts kill process trees; subprocess teardown does not wait on escaped descendants holding stdio pipes.
- Untrusted output. Fetched pages, MCP/LSP output, and files outside the workspace are treated as data, not instructions.
- Debug logs.
--debug logs can contain secrets and file content. Review and redact them before sharing.
Trust model. haze is intended for attended expert use. Shell classification is informational and there are no command confirmation gates. Project skills and repository instructions are labeled as untrusted content, but user supervision remains part of the security boundary. Read the
security policy.