Skip to main content

Running local commands safely

In the desktop application, the assistant can run commands and tests in your chat's workspace. How this works in the chat is explained in Local File Access. On this page you set when this may happen without asking and how isolated commands run.

Opening the command settings​

In a chat, open the Commands panel and choose Command settings for this folder. The settings apply per folder.

When may the assistant run a command?​

Choose one of these three modes:

  • Always ask: you approve every command.
  • Trusted commands automatically: commands you have saved start without asking. Other commands still ask for approval.
  • Automatically in sandbox: everything starts without asking, but in an isolated environment.

These rules also apply in every mode:

  • Harmless commands start without a card: mkdir, ls, cat, head, tail, wc, grep, find (without -exec or -delete), touch, pwd, tree and version checks (--version, -v or -V of node, npm, npx, python, pip and aischool-python). They do no more than the built-in file tools already do without asking. They run in the sandbox without network, and only with paths inside the workspace, also after following links (no absolute paths, ~ or ..). If a link points outside the folder, a card does appear. This needs a sandbox (macOS and Linux) and local commands, but not your administrator's Allow automatic runs. The Commands panel then shows Automatic (harmless command). A list in braces, such as mkdir -p src/{components,utils}, also starts without a card: the app turns it into separate paths and checks each of them.
  • Every card shows the exact command and, for online actions, the exact address. Below it, in smaller text, is the assistant's explanation.
  • If the sandbox is available and your administrator allows automatic runs, a card for a command that runs in the sandbox also has the button Always automatically in the sandbox in this folder. It switches the folder to Automatically in sandbox, so later commands start without a card. Commands that need network still ask once, unless package installs are allowed.
  • The first card in a folder that runs in the sandbox and does not ask for network shows Trust this project once. It runs the command, switches the folder to Automatically in sandbox and turns on Allow package installs without asking. Tests and builds such as npm test, npm run build and node --test then start without a card, in the sandbox without network. Commands that need the network for anything else or run outside the sandbox keep asking. After Run or Deny the question does not come back in this folder; you change the mode in the command settings. If automatic runs are switched off, every card says whether your administrator or this computer's device policy does that.

Saving trusted commands​

On a command, choose Always allow in this folder and then Exactly this command or Anything that starts with. Saved commands then start without asking. Commands with special characters (such as ; | > $) always ask for approval.

The saved rules are listed in the command settings under Always allowed in this folder. You can also remove them there.

Sandbox and network​

  • Use sandbox: commands can only write in this folder. This option is on by default on macOS and Linux.
  • Allow network: determines whether commands have internet access. This option is off by default. Without a sandbox, commands always have network access.

Every command card shows whether the sandbox and the network are on.

If Allow network is off and the assistant wants to download something, for example with npm install, the command card asks whether you want to run exactly that command with network access. So you don't have to turn on the network for the whole folder.

Windows

No sandbox is available on Windows yet.

Installing packages​

The app comes with its own Node.js, including npm. Commands such as node, npm and npx therefore work even if Node.js is not installed on your computer. If you have installed Node.js yourself, the app uses that version. Exception: a project that starts Electron itself (electron .) needs a Node.js you have installed yourself.

Allow package installs without asking​

In Command settings for this folder, turn on the Allow package installs without asking switch. Installs of named packages then start without a card: npm install <name> and npm install from package.json, pnpm, yarn or bun with install or add, and pip install <name> (also via uv). They always run in the sandbox, with network access. Other commands follow the mode you have chosen for the folder.

These installs still show a card:

  • project starters such as npm create vite@latest and npx create-…, because they run their own code;
  • pip install ., pip install -r requirements.txt, installs from another registry (--registry, -i, --index-url) and packages from a git address, URL or path.

The switch only works with a sandbox (macOS and Linux) and if your administrator allows automatic runs. Otherwise you cannot turn it on.

No install scripts

Packages installed this way never run their own install scripts (npm runs with --ignore-scripts). Python packages are only installed as ready-made wheels.

Local servers and the built-in browser​

The assistant can also start a development server that keeps running, such as npm run dev for a small React project with Vite. The same rules apply as for other commands: you approve the exact command, or it starts through a saved rule or automatically in the sandbox. Instead of the time limit, the card says "Keeps running as a local server until you stop it."

The server keeps running after the assistant has answered. In the Commands panel, the card shows the status Server running with the buttons Open in browser and Stop. Up to 4 servers can run at the same time. Servers stop when you stop them or quit the app.

In the sandbox without network access, a server may only listen on this computer (localhost). How the assistant installs packages is explained in Installing packages.

Showing a simple web page​

A plain web page (an index.html with CSS and JavaScript, without a build step) doesn't need a command. The assistant then uses the app's built-in web server:

  • The folder can only be viewed on this computer, at http://127.0.0.1 with a random port.
  • Hidden files, such as .git and .env, are never shown.
  • When a file changes, the page reloads automatically.

No approval card appears for this. The server is listed in the Commands panel, with Open in browser and Stop, and counts toward the maximum of 4 servers.

You view the result in the built-in browser: the Browser button (the globe icon) on the right of the top bar. The panel opens beside the chat with back, forward, reload (stop while loading), an address bar and Open in your default browser.

  • The assistant opens the browser itself to show the result of a local server. This only works with local addresses, such as http://localhost:5173.
  • If you click a localhost link in an answer, it opens in the built-in browser. Other links open in your default browser.
  • You can also type any web address yourself.
  • The browser has its own separate session: you are not signed in to AI-Public there, websites get no permissions such as camera or microphone, and downloads are not possible.
  • While an app menu or dialog is open, the page is temporarily hidden.

Example:

In this folder, create a small React app with Vite that has a counter. Install the dependencies, start the dev server and show the result in the browser.

Letting the assistant look​

When you ask the assistant to look at the page in the built-in browser, it reads the address, the title, the visible text, a screenshot and the latest error messages of the page. These go to the AI model.

  • The assistant looks at a page on this computer (localhost or 127.0.0.1) without asking.
  • For any other website, such as a page where you are signed in, the assistant first shows a card: "The assistant wants to look at onedrive.live.com." Click Allow viewing or Deny. It asks again every time.
  • If the page moves to another website after you allowed it, the assistant reads nothing.
  • Only on a page on this computer does the assistant click and type itself, to test what it made. On other websites it does not click, type or navigate. It gets no cookies or passwords.
  • In offline mode, the assistant only looks at pages on this computer.

Versions and GitHub​

The assistant has git built in. You don't need to install git, not even on Windows. The assistant can save versions, show what has changed, create branches and put a project online.

  • Actions in this folder, such as saving a version, start without asking. Files that look like secrets (such as .env files, or keys and tokens in code, including Google API keys that start with AIza) never end up in a version. The assistant tells you when it skips something.
  • Online actions (downloading a project, fetching the latest version, putting it online and creating a GitHub repository) first show a card with the exact address and the labels Built into the app and Network on. If the address is not github.com or a new repository becomes public, the card warns you. When putting a project online, the card shows which files will be sent. Choose Run or Deny.
  • Connecting a repository outside github.com also asks for permission first.

How to connect GitHub and put a project online is explained in Vibe coding.

Offline mode

In offline mode, commands always run in the sandbox without network. Package installs with network and the online actions of the built-in git (download, pull, push and GitHub) do not work then. Saving versions and showing a simple web page still work.

Settings for administrators​

Administrators can turn off local commands or automatic runs for everyone in the environment. They do this in the admin environment under Features (at environment level), in the Desktop app card:

  • Allow local commands: when this is off, the assistant cannot run commands. The online actions of the built-in git don't work either. Saving versions and branches do keep working: they only change files in the folder, just like the file tools.
  • Allow automatic runs: when this is off, every command asks for approval and you cannot turn on Allow package installs without asking.
  • Allow the app’s Python for Office files: for templates, charts and analyses. This Python works without internet, only writes in the workspace and cannot start other programs. If nothing is set, this follows Allow local commands. Without the sandbox (Windows), it is only available when local commands are on, and it asks for permission every time.

On this page