Ribhu guide / 02

Tools, with boundaries.

A tool is an ability, not a standing permission. Ribhu brings reading, editing, shell work and code intelligence into one workbench; the approval path still matters when they’re composed.

Choose the right tool

Documented coding surfaces
Need	Surface	Useful distinction
Understand a repository	`repo_map`, `read`, `grep`	Locate the relevant code before reading whole files.
Follow a symbol	`code_query`	Definitions and references can fall back to grep; hover and symbols need a language server.
Change code	`edit`, `ast_edit`, `code_rename`	A symbol rename is a workspace edit, not a read-only lookup.
Check the result	`diagnostics`, shell checks	The checker, language and project trust determine what can run.

Use /commands inside a session to see the live command catalog, including loaded extensions and plugins. A checked-in catalog isn’t proof that every optional tool is present in a particular turn.

Compose with code mode

Code mode lets the model write a short JavaScript script that calls the turn’s tools. Filtering, loops and small transformations happen inside the script; only printed or returned results reach the model.

Illustrative read-only script

const source = await read({ path: "src/parser.rs" });
const tests = await read({ path: "tests/parser.rs" });
const results = [source, tests];

for (let i = 0; i < results.length; i++) {
  print(i, results[i].split("\n").length, "lines");
}

The engine is compiled to WebAssembly and has no filesystem, network, process or environment access of its own. It calls only tools already selected for the turn.

Code mode is read-only by default.
RIBHU_CODE_MODE=write allows changing tools through their normal approvals.
RIBHU_CODE_MODE=0 removes the code tool.

Understand workspace trust

A newly opened repository is untrusted by default. Trust gates project-supplied instructions, extensions, prompts and MCP processes, plus analysis that may execute project code.

For example, Rust build scripts and procedural macros are disabled in untrusted rust-analyzer sessions; Rust and Go compiling diagnostics are skipped with a notice. Static TypeScript and Python checks are documented separately.

Inspect the user-owned trust decision

/trust status

After reviewing a repository, the operator can use /trust project allow. /trust project deny revokes the decision. Restarting applies startup-loaded resources and the full analysis behavior.

Add tools deliberately

Ribhu supports prompt extensions, sandboxed Wasm plugins and MCP tools. Workspace and project resources remain behind project trust; user-scope resources belong to the operator.

Tool filtering happens before the model sees the inventory. When Chitragupta supplies a per-turn tool-selection receipt, that selection is authoritative. A stale or invented tool call outside the selected set is refused.

Keep the distinction simple: loading a tool, selecting it for a turn, approving an action and authorizing a workspace write are separate decisions.

Reading basis

Adapted from the project’s project reference documents: usage.md, commands.md, workspace-trust.md, code-mode.md, code-intelligence.md and extensions.md.

No installer or public-release availability is implied. Test the exact build and environment before relying on runtime behavior.