How the studio reads a command before it runs
The studio follows pipes, loops and names to the files a command really touches, and takes the careful side where it cannot tell.
When a session wants to run a shell command, AigoPilot reads the command before it runs and decides which permission group it belongs to. The first word is not enough. cat reads a note in your project and it reads a system file of Windows, and only the path tells which. So the studio follows a command the way a careful person would, part by part, and decides by what the command really touches.
It is not a shell and does not run anything. It is a reader, and where it cannot follow, it takes the safer side.
Two mistakes, and which one the studio prefers
A reader of commands can fail in two ways. It can ask about something you already allowed, and then you stop trusting the mode you chose. Or it can let through something that reaches outside the project, which is worse. The studio is built to avoid both, and where it has to pick, it picks the question. A path it cannot follow counts as outside. A word that is plainly no path, such as a piece of code or data in quotes, is not treated as one.
The reader was written against commands that strong models really write, recorded in trials: long, chained, full of text that is code or data. Commands written by hand to get past it found more holes than the trials did, and the holes they found were closed.
What it follows
- Pipes, chains and loops. A path handed on through a pipe is followed to the file it stands for. A name that a loop fills is taken as a file of the folder the loop works in, and a loop over a list of paths is judged by the paths in the list.
- Names given a value. After
src=notes/a.txtthe studio knows what$srcis. A name that nothing gave a value is not trusted with files. - A name is never taken for a folder. What
basenamegives back is a name, sobackup/$(basename "$src")stays inbackup. Whatdirnamegives back may be anywhere. The path of a web address is no folder either. - PowerShell as PowerShell. Calls into .NET that write or read files are read for the path they get. Handing text to
Invoke-Expression, whose content is made while the command runs, counts as outside, and so does changing machine settings, the clipboard or the registry. - Writes. A redirect or a program that writes a file is judged by where it writes, not by the name of the program.
Examples
| Command | Group |
|---|---|
cat /c/Windows/System32/drivers/etc/hosts | A command that reaches outside the project |
rm -rf build (a folder of the project) | Deleting in the project |
git push --force origin main | Things that cannot be undone |
pip install requests | Installing programs on the machine |
.venv/bin/pip install requests | Running a command in the project |
npm install -g typescript | Installing programs on the machine |
Stop-Process -Name chrome | A command that reaches outside the project |
The pip pair is deliberate. A package put into the project's own environment belongs to that project. A package put into the machine's Python is there for every project, and that is asked. Installing the project's own packages is part of running a command in the project, and the group for installing programs is for the whole machine.
Stopping programs of the machine
Closing or killing other programs is classed as outside the project and asked about. This rule exists because of a test run in which a session was asked to close every window of VS Code, ran the command unasked, and closed the windows of the person testing, with the sessions running in them. Now a command that finds a program by its name and stops it is outside. A program the session started itself, which it knows by its number, it may stop. Looking at processes is not stopping them, so Get-Process node is no question.
Where it stops
The reader is a judge of requests and nothing more. It cannot see inside a program you run, and a script that does something else when it runs is judged by its command line. The studio also makes no claim to be a sandbox. The guard of sessions outside the studio and the modes of the permission window are layers on top, and a backup of your work is still a good idea.
Small tips
Open Details before you allow
The card shows the reason it asks, and Details shows the whole command or change. Read the command when the group name alone does not tell you what it will touch.
Install packages into the project's own environment
pip install into the project's own virtual environment counts as a command in the project. Into the machine's Python it is the group for installing programs on the machine, and is asked.
Let a session stop only its own programs
A program that a session started itself, which it knows by its number, may be stopped without a question. A program found by its name, such as Chrome or Code, is asked about.
Questions
Why does a harmless looking command ask for permission?
The studio could not follow where it reaches, or it names a place outside the project. Where the studio is not sure, the command goes into the group of commands that reach outside the project.
Does the studio run a command to find out what it does?
No. It only reads the text of the command. It does not run anything.