extensions.md Raw History Folder

zot extensions

zot can be extended with custom slash commands by running an external program as a subprocess and exchanging newline-delimited JSON over its stdin/stdout. Extensions can be written in any language that can read and write JSON lines from stdio — Go, TypeScript, Python, Rust, shell with jq, anything.

Three phases shipped so far:

Phase 1: slash commands + chat notifications.
Phase 2: tools the LLM can call.
Phase 3: lifecycle event subscriptions + tool-call interception for guardrail extensions.

Quick start

The simplest extension is a script that prints a hello frame, reads commands, and prints responses. Here's the whole thing in Python, no SDK required:

#!/usr/bin/env python3
# $ZOT_HOME/extensions/hello-py/hello.py
import json, sys, threading

def emit(obj):
    sys.stdout.write(json.dumps(obj) + "\n")
    sys.stdout.flush()

emit({"type":"hello","name":"hello-py","version":"1.0.0","capabilities":["commands"]})
emit({"type":"register_command","name":"hellopy","description":"say hi (python)"})

for line in sys.stdin:
    msg = json.loads(line)
    if msg["type"] == "command_invoked":
        emit({"type":"command_response","id":msg["id"],"action":"prompt",
              "prompt": "Greet me very briefly. Add one emoji."})
    elif msg["type"] == "shutdown":
        emit({"type":"shutdown_ack"})
        break

Drop it in a directory with this extension.json:

{
  "name": "hello-py",
  "version": "1.0.0",
  "exec": "./hello.py",
  "language": "python",
  "enabled": true
}

chmod +x hello.py, install:

zot ext install ./hello-py

Restart zot, type /hellopy, the agent greets you. Done.

Layout & discovery

zot scans two directories on startup, in this order:

Project-local: ./.zot/extensions/<name>/extension.json
Global: $ZOT_HOME/extensions/<name>/extension.json

A project-local extension with the same name wins over a global one. On macOS $ZOT_HOME defaults to ~/Library/Application Support/zot/; on Linux it's $XDG_STATE_HOME/zot or ~/.local/state/zot.

Each extension owns its own subdirectory. The extension.json manifest tells zot how to launch it:

{
  "name": "weather",
  "version": "1.0.0",
  "exec": "./weather",
  "args": ["--mode", "daemon"],
  "language": "go",
  "description": "current weather for any city",
  "enabled": true
}

field	meaning
`name`	required. how zot identifies the extension; must match what's sent in the `hello` frame.
`version`	optional. shown in `zot ext list`.
`exec`	required. path to the executable (relative to the manifest).
`args`	optional. extra argv passed to `exec`.
`language`	optional. informational only (`go`, `python`, `typescript`, ...).
`description`	optional. shown in `zot ext list`.
`enabled`	optional, defaults to `true`. set to `false` to disable without removing.

Lifecycle

Discovery: zot reads every extension.json in the search dirs.
Spawn: enabled extensions are launched as subprocesses. stderr redirects to $ZOT_HOME/logs/ext-<name>.log (one file per extension, append-mode).
Hello handshake: the extension sends a hello frame; zot replies with hello_ack containing the protocol version and the active provider/model/cwd.
Registration: the extension sends register_command frames. First-come-first-served: a name already taken by a built-in or by a previously-loaded extension is silently shadowed (logged in the extension's own log file).
Runtime: zot dispatches command_invoked frames when the user runs a registered command; the extension responds with command_response. Extensions can also push notify frames at any time.
Shutdown: when zot exits, it sends shutdown and waits up to 2s for the extension to send shutdown_ack. Holdouts are SIGTERM'd, then SIGKILL'd.

A crashing extension does not bring down zot. The slash command it owned simply stops working until the extension is fixed and zot is restarted.

Wire format

All frames are one JSON object per line. Top-level type is the discriminator. Optional id correlates request frames with their responses.

Extension → host

`hello` (required, first frame)

{"type":"hello","name":"weather","version":"1.0.0",
 "capabilities":["commands","tools"]}

`register_command`

{"type":"register_command","name":"weather",
 "description":"current weather for a city"}

`register_tool`

Registers a tool the LLM can call. schema is a JSON Schema object describing the tool's args (the same shape Anthropic and OpenAI accept).

{"type":"register_tool","name":"weather",
 "description":"Get the current weather for a city.",
 "schema":{
   "type":"object",
   "properties":{"city":{"type":"string"}},
   "required":["city"]
 }}

Tool names live in the same namespace as built-in tools (read, write, edit, bash, skill). Conflicts are silently shadowed by the built-in.

`ready`

Sentinel telling zot "all initial registrations are flushed". Send it right after your last register_* frame so the host can build the agent's tool registry without racing the registration window.

{"type":"ready"}

`tool_result`

Reply to a tool_call from the host. content[] is a list of message blocks; each block is {"type":"text","text":"..."} or {"type":"image","mime_type":"image/png","data":"<base64>"}. Set is_error: true to mark the call as failed.

{"type":"tool_result","id":"...",
 "content":[{"type":"text","text":"Berlin: 16°C, fog"}]}

`subscribe`

Declares which lifecycle events the extension wants to observe and which it wants to intercept. Send once after hello, before ready.

{"type":"subscribe",
 "events":["session_start","turn_start","tool_call","turn_end","assistant_message"],
 "intercept":["tool_call"]}

Recognised event names: session_start, turn_start, turn_end, tool_call, assistant_message. Only tool_call is interceptable in this version; other names listed under intercept are ignored.

`event_intercept_response`

Reply to an event_intercept from the host. block: true refuses the action; reason is shown to the model as the tool error text. Missing the response within 5s is treated as "allow" (i.e. an unresponsive extension never stalls the agent).

{"type":"event_intercept_response","id":"...",
 "block":true,"reason":"refused: matches danger pattern \"rm -rf\""}

`command_response` (reply to `command_invoked`)

{"type":"command_response","id":"...","action":"prompt",
 "prompt":"Show today's weather for Berlin in one line."}

action is one of:

"prompt" — submits prompt as a fresh user message; the agent runs a turn against it.
"insert" — inserts insert into the editor at the cursor without submitting.
"display" — appends display to the chat as a one-shot styled note. No model call, nothing written to the transcript.
"noop" — the extension handled it itself (e.g. it pushed notify frames or kicked off background work). zot doesn't change the UI in response.

If error is non-empty, zot renders it as a red status line regardless of action.

`notify` (one-way, any time)

{"type":"notify","level":"info",
 "message":"refreshed cache (12 entries)"}

level is one of info, success, warn, error. The note shows up below the transcript with the extension's name in brackets.

`shutdown_ack`

Sent in response to shutdown. Extension should exit promptly after.

Host → extension

`hello_ack`

{"type":"hello_ack","protocol_version":1,
 "zot_version":"0.0.7","provider":"anthropic",
 "model":"claude-opus-4-7","cwd":"/Users/pat/Developer/zot"}

Sent immediately after hello. The extension can use these fields to decide which commands to register (e.g. only register a Python tool on macOS, only register a model-specific shortcut for opus, etc.).

`command_invoked`

{"type":"command_invoked","id":"...",
 "name":"weather","args":"berlin"}

args is everything the user typed after the command name, trimmed.

`tool_call`

Sent when the LLM invokes a tool the extension registered. args is the parsed JSON object the model produced; the extension is responsible for validating/coercing it.

{"type":"tool_call","id":"...","name":"weather",
 "args":{"city":"Berlin"}}

Reply with tool_result within the host's tool timeout (default 60s). Missing the timeout surfaces an error to the model and the call is marked as failed.

`event`

Lifecycle notification for events the extension subscribed to via subscribe. One-way — no response expected.

{"type":"event","event":"turn_start","step":1}
{"type":"event","event":"tool_call",
 "tool_id":"...","tool_name":"read","tool_args":{"path":"foo.go"}}
{"type":"event","event":"turn_end","stop":"end_turn"}

`event_intercept`

Sent when zot wants to give the extension a chance to block a lifecycle event before it happens. Same payload shape as event. Reply with event_intercept_response within 5s; missing the deadline is treated as "allow".

Only event: "tool_call" is sent in this version.

{"type":"event_intercept","id":"...","event":"tool_call",
 "tool_id":"...","tool_name":"bash",
 "tool_args":{"command":"rm -rf /tmp/foo"}}

`shutdown`

Sent during graceful zot exit (or /reload-ext once that lands). Reply with shutdown_ack and then exit.

Managing extensions from the CLI

zot ext list                    list installed extensions and their state
zot ext install <path|git-url>  copy / clone into $ZOT_HOME/extensions/
zot ext remove <name>           delete an extension directory
zot ext enable <name>           re-enable a disabled extension
zot ext disable <name>          disable without removing
zot ext logs <name> [-f]        cat / tail the extension's stderr

zot ext install <path> does a recursive copy; <git-url> does a shallow clone. Both validate that the destination contains an extension.json and roll back if not.

SDKs

Writing the wire protocol by hand is fine for one-off scripts, but for anything bigger the SDKs handle the boilerplate.

Go — `pkg/zotext`

package main

import (
    "encoding/json"
    "github.com/patriceckhart/zot/pkg/zotext"
)

func main() {
    ext := zotext.New("hello", "1.0.0")

    // Slash command
    ext.Command("hello", "say hi", func(args string) zotext.Response {
        return zotext.Prompt("Greet me in one short sentence.")
    })

    // LLM-callable tool
    ext.Tool("weather", "Current weather for a city.",
        json.RawMessage(`{"type":"object","properties":{"city":{"type":"string"}},"required":["city"]}`),
        func(args json.RawMessage) zotext.ToolResult {
            var in struct{ City string `json:"city"` }
            json.Unmarshal(args, &in)
            return zotext.TextResult(in.City + ": sunny")
        })

    ext.Run()
}

Build with go build -o hello ., drop the binary + an extension.json into $ZOT_HOME/extensions/hello/.

See:

examples/extensions/hello/ — slash commands
examples/extensions/clock/ — slash commands in plain Node, no SDK
examples/extensions/weather/ — LLM-callable tool
examples/extensions/guard/ — event subscriptions + tool-call interception (refuses dangerous bash patterns)

TypeScript / Python

These SDKs aren't in the main repo yet; the wire format is small enough that a ~30 line raw script gets you started in either language. See the Quick start Python example for the shape. SDK packages will land in follow-up commits.

Security

Extensions run with the user's full filesystem and network permissions. Treat installing an extension the same as installing any other binary on your machine.

zot ext install <git-url> clones from any URL you give it. There's no sandbox in v1; if you need isolation, install only extensions you trust or run zot under your platform's sandboxing tool (bwrap / sandbox-exec / AppContainer).

Roadmap

Phase 1 (shipped):

subprocess lifecycle + hello handshake
register_command + command_invoked
notify
zot ext CLI

Phase 2 (shipped):

register_tool + tool_call + tool_result
ready sentinel for safe agent-registry build timing
tool result attribution surfaces extension name in details

Phase 3 (shipped):

event subscriptions (session_start, turn_start, turn_end, tool_call, assistant_message)
tool-call interception (block before execution)

Future (no firm timeline):

interception for additional events beyond tool_call
modify (not just block) tool args mid-flight
/reload-ext slash command (hot-reload without restarting zot)

source

1# zot extensions
2
3zot can be extended with custom slash commands by running an external
4program as a subprocess and exchanging newline-delimited JSON over
5its stdin/stdout. Extensions can be written in **any language** that
6can read and write JSON lines from stdio — Go, TypeScript, Python,
7Rust, shell with `jq`, anything.
8
9Three phases shipped so far:
10
11- **Phase 1**: slash commands + chat notifications.
12- **Phase 2**: tools the LLM can call.
13- **Phase 3**: lifecycle event subscriptions + tool-call interception
14  for guardrail extensions.
15
16## Quick start
17
18The simplest extension is a script that prints a hello frame, reads
19commands, and prints responses. Here's the whole thing in **Python**,
20no SDK required:
21
22```python
23#!/usr/bin/env python3
24# $ZOT_HOME/extensions/hello-py/hello.py
25import json, sys, threading
26
27def emit(obj):
28    sys.stdout.write(json.dumps(obj) + "\n")
29    sys.stdout.flush()
30
31emit({"type":"hello","name":"hello-py","version":"1.0.0","capabilities":["commands"]})
32emit({"type":"register_command","name":"hellopy","description":"say hi (python)"})
33
34for line in sys.stdin:
35    msg = json.loads(line)
36    if msg["type"] == "command_invoked":
37        emit({"type":"command_response","id":msg["id"],"action":"prompt",
38              "prompt": "Greet me very briefly. Add one emoji."})
39    elif msg["type"] == "shutdown":
40        emit({"type":"shutdown_ack"})
41        break
42```
43
44Drop it in a directory with this `extension.json`:
45
46```json
47{
48  "name": "hello-py",
49  "version": "1.0.0",
50  "exec": "./hello.py",
51  "language": "python",
52  "enabled": true
53}
54```
55
56`chmod +x hello.py`, install:
57
58```bash
59zot ext install ./hello-py
60```
61
62Restart `zot`, type `/hellopy`, the agent greets you. Done.
63
64## Layout & discovery
65
66zot scans two directories on startup, in this order:
67
681. **Project-local**: `./.zot/extensions/<name>/extension.json`
692. **Global**: `$ZOT_HOME/extensions/<name>/extension.json`
70
71A project-local extension with the same name wins over a global one.
72On macOS `$ZOT_HOME` defaults to `~/Library/Application Support/zot/`;
73on Linux it's `$XDG_STATE_HOME/zot` or `~/.local/state/zot`.
74
75Each extension owns its own subdirectory. The `extension.json`
76manifest tells zot how to launch it:
77
78```json
79{
80  "name": "weather",
81  "version": "1.0.0",
82  "exec": "./weather",
83  "args": ["--mode", "daemon"],
84  "language": "go",
85  "description": "current weather for any city",
86  "enabled": true
87}
88```
89
90| field | meaning |
91|---|---|
92| `name` | required. how zot identifies the extension; must match what's sent in the `hello` frame. |
93| `version` | optional. shown in `zot ext list`. |
94| `exec` | required. path to the executable (relative to the manifest). |
95| `args` | optional. extra argv passed to `exec`. |
96| `language` | optional. informational only (`go`, `python`, `typescript`, ...). |
97| `description` | optional. shown in `zot ext list`. |
98| `enabled` | optional, defaults to `true`. set to `false` to disable without removing. |
99
100## Lifecycle
101
1021. **Discovery**: zot reads every `extension.json` in the search dirs.
1032. **Spawn**: enabled extensions are launched as subprocesses. stderr
104   redirects to `$ZOT_HOME/logs/ext-<name>.log` (one file per
105   extension, append-mode).
1063. **Hello handshake**: the extension sends a `hello` frame; zot
107   replies with `hello_ack` containing the protocol version and the
108   active provider/model/cwd.
1094. **Registration**: the extension sends `register_command` frames.
110   First-come-first-served: a name already taken by a built-in or by
111   a previously-loaded extension is silently shadowed (logged in the
112   extension's own log file).
1135. **Runtime**: zot dispatches `command_invoked` frames when the
114   user runs a registered command; the extension responds with
115   `command_response`. Extensions can also push `notify` frames at
116   any time.
1176. **Shutdown**: when zot exits, it sends `shutdown` and waits up to
118   2s for the extension to send `shutdown_ack`. Holdouts are
119   SIGTERM'd, then SIGKILL'd.
120
121A crashing extension does not bring down zot. The slash command it
122owned simply stops working until the extension is fixed and zot is
123restarted.
124
125## Wire format
126
127All frames are one JSON object per line. Top-level `type` is the
128discriminator. Optional `id` correlates request frames with their
129responses.
130
131### Extension → host
132
133#### `hello` (required, first frame)
134
135```json
136{"type":"hello","name":"weather","version":"1.0.0",
137 "capabilities":["commands","tools"]}
138```
139
140#### `register_command`
141
142```json
143{"type":"register_command","name":"weather",
144 "description":"current weather for a city"}
145```
146
147#### `register_tool`
148
149Registers a tool the LLM can call. `schema` is a JSON Schema object
150describing the tool's args (the same shape Anthropic and OpenAI accept).
151
152```json
153{"type":"register_tool","name":"weather",
154 "description":"Get the current weather for a city.",
155 "schema":{
156   "type":"object",
157   "properties":{"city":{"type":"string"}},
158   "required":["city"]
159 }}
160```
161
162Tool names live in the same namespace as built-in tools (`read`,
163`write`, `edit`, `bash`, `skill`). Conflicts are silently shadowed by
164the built-in.
165
166#### `ready`
167
168Sentinel telling zot "all initial registrations are flushed". Send it
169right after your last `register_*` frame so the host can build the
170agent's tool registry without racing the registration window.
171
172```json
173{"type":"ready"}
174```
175
176#### `tool_result`
177
178Reply to a `tool_call` from the host. `content[]` is a list of
179message blocks; each block is `{"type":"text","text":"..."}` or
180`{"type":"image","mime_type":"image/png","data":"<base64>"}`. Set
181`is_error: true` to mark the call as failed.
182
183```json
184{"type":"tool_result","id":"...",
185 "content":[{"type":"text","text":"Berlin: 16°C, fog"}]}
186```
187
188#### `subscribe`
189
190Declares which lifecycle events the extension wants to observe and
191which it wants to intercept. Send once after `hello`, before `ready`.
192
193```json
194{"type":"subscribe",
195 "events":["session_start","turn_start","tool_call","turn_end","assistant_message"],
196 "intercept":["tool_call"]}
197```
198
199Recognised event names: `session_start`, `turn_start`, `turn_end`,
200`tool_call`, `assistant_message`. Only `tool_call` is interceptable
201in this version; other names listed under `intercept` are ignored.
202
203#### `event_intercept_response`
204
205Reply to an `event_intercept` from the host. `block: true` refuses
206the action; `reason` is shown to the model as the tool error text.
207Missing the response within 5s is treated as "allow" (i.e. an
208unresponsive extension never stalls the agent).
209
210```json
211{"type":"event_intercept_response","id":"...",
212 "block":true,"reason":"refused: matches danger pattern \"rm -rf\""}
213```
214
215#### `command_response` (reply to `command_invoked`)
216
217```json
218{"type":"command_response","id":"...","action":"prompt",
219 "prompt":"Show today's weather for Berlin in one line."}
220```
221
222`action` is one of:
223
224- `"prompt"` — submits `prompt` as a fresh user message; the agent
225  runs a turn against it.
226- `"insert"` — inserts `insert` into the editor at the cursor without
227  submitting.
228- `"display"` — appends `display` to the chat as a one-shot styled
229  note. No model call, nothing written to the transcript.
230- `"noop"` — the extension handled it itself (e.g. it pushed
231  `notify` frames or kicked off background work). zot doesn't change
232  the UI in response.
233
234If `error` is non-empty, zot renders it as a red status line
235regardless of `action`.
236
237#### `notify` (one-way, any time)
238
239```json
240{"type":"notify","level":"info",
241 "message":"refreshed cache (12 entries)"}
242```
243
244`level` is one of `info`, `success`, `warn`, `error`. The note shows
245up below the transcript with the extension's name in brackets.
246
247#### `shutdown_ack`
248
249Sent in response to `shutdown`. Extension should exit promptly after.
250
251### Host → extension
252
253#### `hello_ack`
254
255```json
256{"type":"hello_ack","protocol_version":1,
257 "zot_version":"0.0.7","provider":"anthropic",
258 "model":"claude-opus-4-7","cwd":"/Users/pat/Developer/zot"}
259```
260
261Sent immediately after `hello`. The extension can use these fields to
262decide which commands to register (e.g. only register a Python tool
263on macOS, only register a model-specific shortcut for opus, etc.).
264
265#### `command_invoked`
266
267```json
268{"type":"command_invoked","id":"...",
269 "name":"weather","args":"berlin"}
270```
271
272`args` is everything the user typed after the command name, trimmed.
273
274#### `tool_call`
275
276Sent when the LLM invokes a tool the extension registered. `args` is
277the parsed JSON object the model produced; the extension is
278responsible for validating/coercing it.
279
280```json
281{"type":"tool_call","id":"...","name":"weather",
282 "args":{"city":"Berlin"}}
283```
284
285Reply with `tool_result` within the host's tool timeout (default 60s).
286Missing the timeout surfaces an error to the model and the call is
287marked as failed.
288
289#### `event`
290
291Lifecycle notification for events the extension subscribed to via
292`subscribe`. One-way — no response expected.
293
294```json
295{"type":"event","event":"turn_start","step":1}
296{"type":"event","event":"tool_call",
297 "tool_id":"...","tool_name":"read","tool_args":{"path":"foo.go"}}
298{"type":"event","event":"turn_end","stop":"end_turn"}
299```
300
301#### `event_intercept`
302
303Sent when zot wants to give the extension a chance to block a
304lifecycle event before it happens. Same payload shape as `event`.
305Reply with `event_intercept_response` within 5s; missing the deadline
306is treated as "allow".
307
308Only `event: "tool_call"` is sent in this version.
309
310```json
311{"type":"event_intercept","id":"...","event":"tool_call",
312 "tool_id":"...","tool_name":"bash",
313 "tool_args":{"command":"rm -rf /tmp/foo"}}
314```
315
316#### `shutdown`
317
318Sent during graceful zot exit (or `/reload-ext` once that lands).
319Reply with `shutdown_ack` and then exit.
320
321## Managing extensions from the CLI
322
323```
324zot ext list                    list installed extensions and their state
325zot ext install <path|git-url>  copy / clone into $ZOT_HOME/extensions/
326zot ext remove <name>           delete an extension directory
327zot ext enable <name>           re-enable a disabled extension
328zot ext disable <name>          disable without removing
329zot ext logs <name> [-f]        cat / tail the extension's stderr
330```
331
332`zot ext install <path>` does a recursive copy; `<git-url>` does a
333shallow clone. Both validate that the destination contains an
334`extension.json` and roll back if not.
335
336## SDKs
337
338Writing the wire protocol by hand is fine for one-off scripts, but
339for anything bigger the SDKs handle the boilerplate.
340
341### Go — `pkg/zotext`
342
343```go
344package main
345
346import (
347    "encoding/json"
348    "github.com/patriceckhart/zot/pkg/zotext"
349)
350
351func main() {
352    ext := zotext.New("hello", "1.0.0")
353
354    // Slash command
355    ext.Command("hello", "say hi", func(args string) zotext.Response {
356        return zotext.Prompt("Greet me in one short sentence.")
357    })
358
359    // LLM-callable tool
360    ext.Tool("weather", "Current weather for a city.",
361        json.RawMessage(`{"type":"object","properties":{"city":{"type":"string"}},"required":["city"]}`),
362        func(args json.RawMessage) zotext.ToolResult {
363            var in struct{ City string `json:"city"` }
364            json.Unmarshal(args, &in)
365            return zotext.TextResult(in.City + ": sunny")
366        })
367
368    ext.Run()
369}
370```
371
372Build with `go build -o hello .`, drop the binary + an `extension.json`
373into `$ZOT_HOME/extensions/hello/`.
374
375See:
376- `examples/extensions/hello/` — slash commands
377- `examples/extensions/clock/` — slash commands in plain Node, no SDK
378- `examples/extensions/weather/` — LLM-callable tool
379- `examples/extensions/guard/` — event subscriptions + tool-call
380  interception (refuses dangerous bash patterns)
381
382### TypeScript / Python
383
384These SDKs aren't in the main repo yet; the wire format is small
385enough that a `~30 line` raw script gets you started in either
386language. See the [Quick start](#quick-start) Python example for the
387shape. SDK packages will land in follow-up commits.
388
389## Security
390
391Extensions run with **the user's full filesystem and network
392permissions**. Treat installing an extension the same as installing
393any other binary on your machine.
394
395`zot ext install <git-url>` clones from any URL you give it. There's
396no sandbox in v1; if you need isolation, install only extensions you
397trust or run zot under your platform's sandboxing tool (`bwrap` /
398`sandbox-exec` / AppContainer).
399
400## Roadmap
401
402Phase 1 (shipped):
403- [x] subprocess lifecycle + hello handshake
404- [x] `register_command` + `command_invoked`
405- [x] `notify`
406- [x] `zot ext` CLI
407
408Phase 2 (shipped):
409- [x] `register_tool` + `tool_call` + `tool_result`
410- [x] `ready` sentinel for safe agent-registry build timing
411- [x] tool result attribution surfaces extension name in details
412
413Phase 3 (shipped):
414- [x] event subscriptions (`session_start`, `turn_start`, `turn_end`,
415      `tool_call`, `assistant_message`)
416- [x] tool-call interception (block before execution)
417
418Future (no firm timeline):
419- [ ] interception for additional events beyond `tool_call`
420- [ ] modify (not just block) tool args mid-flight
421- [ ] `/reload-ext` slash command (hot-reload without restarting zot)

extensions.md RawHistoryFolder

zot extensions

Quick start

Layout & discovery

Lifecycle

Wire format

Extension → host

hello (required, first frame)

register_command

register_tool

ready

tool_result

subscribe

event_intercept_response

command_response (reply to command_invoked)

notify (one-way, any time)

shutdown_ack