Skip to main content

Safely running local commands

In the desktop application, the assistant can run commands and tests in the working directory of your chat. How this works in the chat is explained under Local file access. On this page, you configure when this may happen without asking and how restricted commands run.

Open command settings​

In a chat, open the Commands panel and choose Command settings for this folder. The settings apply per folder.

When may the assistant run a command?​

Choose one of these three modes:

  • Always ask: you approve every command.
  • Automatically trust known commands: commands you have saved start without asking. Other commands still require permission.
  • Automatically in sandbox: everything starts without asking, but in a restricted environment.

These rules also apply in every mode:

  • Safe commands start without a card: mkdir, ls, cat, head, tail, wc, grep, find (without -exec or -delete), touch, pwd, tree and version checks (--version, -v or -V of node, npm, npx, python, pip and aischool-python). They do no more than the built-in file tools already do without asking. They run in the sandbox without network and only with paths inside the working directory, even after following links (no absolute paths, ~ or ..). If a link points outside the folder, a card is shown. This requires a sandbox (macOS and Linux) and local commands, but not Allow automatic execution from your administrator. In the Commands panel, it then says Automatic (safe command). A brace list, such as mkdir -p src/{components,utils}, also starts without a card: the app expands it into separate paths and checks them all.
  • Every card shows the exact command and, for online actions, the exact address. Underneath is the assistant’s explanation in smaller text.
  • If the sandbox is available and your administrator allows automatic execution, then a card for a command that runs in the sandbox also has the button Always run automatically in the sandbox in this folder. This sets the folder to Automatically in sandbox, so the next commands start without a card. Commands that need network still ask once more, unless package installs are allowed.
  • The first card in a folder that runs in the sandbox and does not request network shows Trust this project once. This runs the command, sets the folder to Automatically in sandbox, and turns on Allow package installs without asking. After that, tests and builds such as npm test, npm run build and node --test start without a card, in the sandbox without network. Commands that still need network or run outside the sandbox will keep asking. After Run or Deny, the question does not return in this folder; you change the mode in the command settings. If automatic execution is off, every card indicates whether your administrator or this computer’s management policy does that.

Save trusted commands​

For a command, choose Always allow in this folder and then Exactly this command or Anything that starts with this. Saved commands will then start without questions. Commands with special characters (such as ; | > $) always ask for permission.

The saved rules are listed in the command settings under Always allowed in this folder. There you can also remove them again.

Sandbox and network​

  • Use sandbox: commands can only write in this folder. This option is on by default on macOS and Linux.
  • Allow network: determines whether commands have internet access. This option is off by default. Without a sandbox, commands always have network access.

Every command card shows whether the sandbox and network are on.

If Allow network is off and the assistant wants to download something, for example with npm install, then the command card asks whether you want to run exactly that command with network. So you do not need to enable network for the whole folder.

Windows

A sandbox is not yet available on Windows.

Installing packages​

The app has its own Node.js with npm built in. Commands like node, npm and npx therefore also work if Node.js is not installed on your computer. If you have installed Node.js yourself, the app uses that version. Exception: a project that starts Electron itself (electron .) needs a Node.js that you have installed yourself.

Allow package installs without asking​

In Command settings for this folder, turn on Allow package installs without asking. Package installs with a name will then start without a card: npm install <name> and npm install from package.json, pnpm, yarn or bun with install or add, and pip install <name> (also via uv). They always run in the sandbox, with network. Other commands follow the mode you selected for the folder.

These installs still show a card for:

  • project starters such as npm create vite@latest and npx create-…, because they run their own code;
  • pip install ., pip install -r requirements.txt, installs from another registry (--registry, -i, --index-url) and packages from a git address, URL or path.

The toggle only works with a sandbox (macOS and Linux) and if your administrator allows automatic execution. Otherwise, you cannot turn it on.

No install scripts

Packages installed this way never run their own install scripts (npm runs with --ignore-scripts). Python packages are installed only as ready-made wheels.

Local servers and the built-in browser​

The assistant can also start a development server that keeps running, such as npm run dev for a small React project with Vite. The same rules apply as for other commands: you approve the exact command, or it starts through a saved rule or automatically in the sandbox. Instead of the maximum run time, the card says "Keeps running as a local server until you stop it."

The server keeps running after the assistant has responded. In the Commands panel, the card shows the status Server running, with the buttons Open in browser and Stop. Up to 4 servers can run at the same time. Servers stop when you stop them or close the app.

In the sandbox without network, a server may only listen on this computer (localhost). How the assistant installs packages is explained under Installing packages.

Showing a simple web page​

For a regular web page (an index.html with CSS and JavaScript, without a build step), no command is needed. The assistant then uses the app’s built-in web server:

  • The folder is visible only on this computer, at http://127.0.0.1 with a random port.
  • Hidden files, such as .git and .env, are never shown.
  • If a file changes, the page reloads automatically.

No approval card appears for this. The server is shown in the Commands panel, with Open in browser and Stop, and counts toward the maximum of 4 servers.

You view the result in the built-in browser: the Browser button (the globe icon) on the right in the top bar. The panel opens next to the chat, with back, forward, reload (stop while loading), an address bar and Open in your default browser.

  • The assistant opens the browser itself to show the result of a local server. That only works with local addresses, such as http://localhost:5173.
  • If you click a localhost link in an answer, it opens in the built-in browser. Other links open in your default browser.
  • You can also type any web address yourself.
  • The browser has its own separate session: you are not signed in there to AI-Public, websites do not get permissions such as camera or microphone, and downloading is not possible.
  • As long as a menu or dialog of the app is open, the page is temporarily hidden.

Example:

In this folder, create a small React app with Vite with a counter. Install the dependencies, start the dev server and show the result in the browser.

Let the assistant look along​

If you ask the assistant to look at the page in the built-in browser, it reads the address, title, visible text, a screenshot and the latest error messages from the page. These go to the AI model.

  • A page on this computer (localhost or 127.0.0.1) is viewed by the assistant without asking.
  • On any other website, for example a page where you are signed in, the assistant first shows a card: "The assistant wants to look along on onedrive.live.com." Click Allow looking along or Deny. It asks again every time.
  • If the page goes to another website after you give permission, the assistant does not read anything.
  • Only on a page on this computer does the assistant click and type itself, to test what it has made. On other websites, it does not click, type or navigate. It does not get cookies or passwords.
  • In offline mode, the assistant only views pages on this computer.

Versions and GitHub​

The assistant has built-in git. So you do not need to install git, not even on Windows. The assistant can save versions, show what has changed, create branches and put a project online.

  • Actions in this folder, such as saving a version, start without asking. Files that look like secrets (such as .env files, keys or tokens in code, including Google API keys that start with AIza) are never included in a version. The assistant reports if it skips something.
  • Online actions (downloading a project, fetching the latest version, publishing it and creating a GitHub repository) first show a card with the exact address and the labels Built into the app and Network on. If the address is not github.com or a new repository is made public, the card warns you. When publishing, the card shows which files are being sent. Choose Run or Deny.
  • Connecting a repository outside github.com also asks for permission first.

How to connect GitHub and put a project online is explained under Vibe coding.

Offline mode

In offline mode, commands always run in the sandbox without network. Package installs with network and the online actions of built-in git (download, fetch, publish and GitHub) do not work then. Saving versions and showing a simple web page do work.

Administrator settings​

Administrators can turn off local commands or automatic execution for everyone in the environment. They do this in the admin environment under Features (at the environment level), in the Desktop app card:

  • Allow local commands: if this is off, the assistant cannot run commands. The online actions of built-in git also do not work then. Saving versions and branches will still work: they only modify files in the folder, just like the file tools.
  • Allow automatic execution: if this is off, every command asks for permission and you cannot turn on Allow package installs without asking.
  • Allow the app’s Python for Office files: for templates, charts and analyses. This Python works without internet, writes only in the working directory and cannot start other programs. If nothing is configured, it follows Allow local commands. Without a sandbox (Windows), it is only available if local commands are on, and it asks every time for permission.

On this page