Skip to main content

Safely running local commands

In the desktop application, the assistant can run commands and tests in the working directory of your chat. How this works in chat is explained under Local file access. On this page, you configure when this may happen without asking and how isolated commands are run.

Opening command settings​

In a chat, open the Commands panel and choose Command settings for this folder. The settings apply per folder.

When may the assistant run a command?​

Choose one of these three modes:

  • Always ask: you approve every command.
  • Automatically trusted commands: commands you have saved start without asking. Other commands still ask for permission.
  • Automatic in sandbox: everything starts without asking, but in an isolated environment.

These rules also apply in every mode:

  • Safe commands start without a card: mkdir, ls, cat, head, tail, wc, grep, find (without -exec or -delete), touch, pwd, tree, and version checks (--version, -v or -V for node, npm, npx, python, pip and aischool-python). They do no more than the built-in file tools already do without asking. They run in the sandbox without network and only with paths inside the working directory, even after following links (no absolute paths, ~ or ..). If a link points outside the folder, a card does appear. This requires a sandbox (macOS) and local commands, but not Allow automatic execution from your administrator. In the Commands panel, this appears as Automatic (safe command). A brace list, such as mkdir -p src/{components,utils}, also starts without a card: the app expands it into separate paths and checks them all.
  • Every card shows the exact command and, for online actions, the exact address. Below that, the assistant’s explanation is shown in smaller text.
  • If the sandbox is available and your administrator allows automatic execution, then a card for a command that runs in the sandbox also has the button Automatically in the sandbox for this folder from now on. This sets the folder to Automatic in sandbox, so future commands start without a card. Commands that need network will still ask once, unless package installations are allowed.
  • The first card in a folder that runs in the sandbox and does not require network shows Trust this project once. This runs the command, sets the folder to Automatic in sandbox, and turns on Allow package installations without asking. After that, tests and builds such as npm test, npm run build and node --test start without a card, in the sandbox without network. Commands that still need network or run outside the sandbox will continue to ask. After Run or Deny, the prompt will not return in this folder; you change the mode in the command settings. If automatic execution is off, every card will say whether your administrator or this computer’s management policy is doing that.

Saving trusted commands​

For a command, choose Always allow in this folder and then Exactly this command or Everything that starts with this. Saved commands will start without questions from now on. Commands with special characters (such as ; | > $) always ask for permission.

The saved rules are in the command settings under Always allowed in this folder. There you can also remove them again.

Sandbox and network​

  • Use sandbox: commands can only write in this folder. This option is on by default on macOS.
  • Allow network: determines whether commands have internet access. This option is off by default. Without a sandbox, commands always have network access.

Each command card shows whether the sandbox and network are on.

If Allow network is off and the assistant wants to download something, for example with npm install, the command card asks whether you want to run exactly that command with network. So you do not need to enable network for the whole folder.

Windows

A sandbox is not yet available on Windows.

Package installations​

The app includes its own Node.js with npm. Commands such as node, npm and npx therefore work even if Node.js is not installed on your computer. If you have installed Node.js yourself, the app uses that version. Exception: a project that starts Electron itself (electron .) needs a Node.js that you installed yourself.

Allow package installations without asking​

In Command settings for this folder, turn on Allow package installations without asking. Installations of packages with a name then start without a card: npm install <name> and npm install from package.json, pnpm, yarn or bun with install or add, and pip install <name> (also via uv). They always run in the sandbox, with network. Other commands follow the mode you chose for the folder.

These installations still show a card for:

  • project starters such as npm create vite@latest and npx create-…, because they run their own code;
  • pip install ., pip install -r requirements.txt, installations from another registry (--registry, -i, --index-url) and packages from a git address, URL or path.

The switch only works with a sandbox (macOS) and if your administrator allows automatic execution. Otherwise, you cannot turn it on.

No install scripts

Packages installed this way never run their own install scripts (npm runs with --ignore-scripts). Python packages are installed only as ready-made wheels.

Local servers and the built-in browser​

The assistant can also start a development server that keeps running, such as npm run dev for a small React project with Vite. The same rules apply as for other commands: you approve the exact command, or it starts via a saved rule or automatically in the sandbox. Instead of the maximum runtime, the card says: "Keeps running as a local server until you stop it."

The server keeps running after the assistant has answered. In the Commands panel, the card shows the status Server running, with the buttons Open in browser and Stop. A maximum of 4 servers can run at the same time. Servers stop when you stop them or close the app.

In the sandbox without network, a server may only listen on this computer (localhost). How the assistant installs packages is explained under Package installations.

Showing a simple web page​

For a normal web page (an index.html with CSS and JavaScript, without a build step), no command is needed. The assistant then uses the app’s built-in web server:

  • The folder is only visible on this computer, at http://127.0.0.1 with a random port.
  • Hidden files, such as .git and .env, are never shown.
  • If a file changes, the page reloads automatically.

No approval card appears for this. The server appears in the Commands panel, with Open in browser and Stop, and counts toward the maximum of 4 servers.

You view the result in the built-in browser: the Browser button (the globe icon) on the right in the top bar. The panel opens next to the chat, with back, forward, reload (stop while loading), an address bar and Open in your default browser.

  • The assistant opens the browser itself to show the result of a local server. This is only possible with local addresses, such as http://localhost:5173.
  • If you click a localhost link in a response, it opens in the built-in browser. Other links open in your default browser.
  • You can also type in any web address yourself.
  • The browser has its own separate session: you are not signed in there to AI-Corporate, websites do not get permissions such as camera or microphone, and downloads are not possible.
  • As long as a menu or dialog of the app is open, the page is temporarily hidden.

Example:

Create a small React app with Vite and a counter in this folder. Install the dependencies, start the dev server and show the result in the browser.

Letting the assistant look along​

If you ask the assistant to look at the page in the built-in browser, it reads the address, title, visible text, a screenshot and the page’s latest error messages. These are sent to the AI model.

  • The assistant can view a page on this computer (localhost or 127.0.0.1) without asking.
  • For any other website, for example a page where you are signed in, the assistant first shows a card: "The assistant wants to look at onedrive.live.com." Click Allow looking along or Deny. It asks again every time.
  • If the page navigates to another website after your permission, the assistant reads nothing.
  • The assistant only clicks and types on a page on this computer, to test what it has made. On other websites, it does not click, type or navigate. It does not get cookies or passwords.
  • In offline mode, the assistant only views pages on this computer.

Versions and GitHub​

The assistant has a built-in git. So you do not need to install git, even on Windows. The assistant can save versions, show what has changed, create branches and publish a project online.

  • Actions in this folder, such as saving a version, start without asking. Files that look like secrets (such as .env files, keys or tokens in code, including Google API keys starting with AIza) are never included in a version. The assistant reports it if it skips something.
  • Online actions (downloading a project, fetching the latest version, publishing and creating a GitHub repository) first show a card with the exact address and the labels Built into the app and Network on. If the address is not github.com or a new repository is made public, the card warns you. When publishing, the card shows which files will be sent. Choose Run or Deny.
  • Connecting a repository outside github.com also first asks for permission.

How to connect GitHub and publish a project is explained under Vibe coding.

Offline mode

In offline mode, commands always run in the sandbox without network. Package installations with network and the online actions of the built-in git (download, fetch, publish and GitHub) do not work there. Saving versions and showing a simple web page do work.

Settings for administrators​

Administrators can turn off local commands or automatic execution for everyone in the environment. They do this in the admin environment under Features (at the environment level), in the Desktop app card:

  • Allow local commands: if this is off, the assistant cannot run commands. The online actions of the built-in git also will not work. Saving versions and branches will still work: they only change files in the folder, just like the file tools.
  • Allow automatic execution: if this is off, every command asks for permission and you cannot turn on Allow package installations without asking.
  • Allow the app’s Python for Office files: for templates, charts and analyses. This Python works without internet, writes only in the working directory and cannot start other programs. If nothing is set, it follows Allow local commands. Without a sandbox (Windows), it is only available if local commands are on, and it asks every time for permission.

On this page