# Cli

`tonoman`, the one command every agent has in every turn — how an agent reaches what Tonoman gives it: brains, receipts, and the capabilities to come. It acts as the person speaking: the same command reaches different brains for Ana and for Ben.

**Has:** groups of commands (`tonoman brain …`, `tonoman receipts …`) · a help for each · the turn's own credential, which says whose turn it is · the tools the agent is granted ([AGENT-TOOLS-GRANTED](/docs/agent#agent-tools-granted)).

## One command, found by asking it

- Every agent, on Claude and on Codex, has `tonoman` in every turn. What Tonoman lets an agent do is a command of it, never an MCP tool.
- The turn's context carries one short paragraph about `tonoman`, whatever the number of commands; the agent learns the rest with `tonoman --help` and `tonoman <group> --help`.
  - e.g. forty commands later, the paragraph is the same length.
- Every command answers in a few thousand characters at most, says when there is more, and how to ask for it.

## Whose turn it is

- A command acts as the person the turn is for, with that person's reach, checked at every call ([BRAIN-GRANTS-DECIDE](https://tonoman.com/docs/brain#brain-grants-decide)); nothing the model types can change whose turn it is.
  - e.g. Ana's turn and Ben's turn run the same `tonoman brain list` and see their own brains.
- The turn's credential works only while the turn runs; a command run after the turn ended, or from another turn, is refused.
- `tonoman brain` is every agent's; a skill's group (`tonoman receipts`) is there only while that skill is on for the agent; otherwise it says so and does nothing.
- The agent may run `tonoman` and nothing else: any other command, a pipe or redirect around `tonoman`, or a path to another program is refused. On Claude its shell allows only `tonoman`; on Codex, which never asks before it runs something, there is no shell at all and `tonoman` is its one tool. This is what keeps a turn from reading its own login, reaching the network inside the platform, or leaving a process behind — things the turn's own user cannot be kept from.
  - e.g. `cat /root/.codex/auth.json` → refused; `tonoman --help; cat /etc/hostname` → refused; `tonoman brain read …` → runs.
- The shell is closed on every turn, on the path real turns take, whatever else is wrong: with the brain service down, or the speaker unknown, the agent still has no shell — it has less, never more.
  - e.g. the brain service fails to start → the turn runs with `tonoman` answering "brains are unavailable", not with `--dangerously-skip-permissions`.
- The shell setting and the turn's model reach the agent the same whether it runs beside the worker (every Tonoman Cloud agent) or in a container of its own (self-hosted).
- A Codex turn has no child agents, no plugins and no hooks: what it can do is `tonoman`, reading the photos it was sent, and the web.
- A conversation turn of an agent granted `web-search` ([TOOL-WEB-SEARCH](https://tonoman.com/docs/agent#tool-web-search)) can search the web and read a page on either provider: Claude through its web search, Codex through its live web search, which also opens pages. The provider does the fetching, never the worker, so a turn reaches nothing on the platform's own network this way. A lean turn (a skill's single completion) has none. Claude's page fetcher stays off: it fetches from the worker.
  - e.g. Nova on Codex is asked for a person's public profile → she searches and reads it; before this she said she could not reach the internet (Oct 3).
- The turn's credential is never on a command line, where any process on the machine can read it; it travels in the turn's environment only.
- A tool Tonoman Cloud serves an agent — listed on its roster with its commands and a short note — is a `tonoman` group in that agent's turns and in no other, and each call goes to the Cloud with the agent, the person speaking and the arguments; a file goes only if the person sent it ([CONVO-FILES-IN-THE-TURN](https://tonoman.com/docs/conversation#convo-files-in-the-turn)). The runtime knows nothing else of the tool.
  - e.g. Website on for Nova → `tonoman site` in Nova's turns; `tonoman site publish` reaches the Cloud, which decides it.