The shell and what it can reach

When your organization allows it, agents can run commands on your Mac. You allow commands per chat, and every command runs in a sandbox that writes only to your read-and-write trusted folders and cannot read your keys, keychain or the rest of your home folder.

When your organization’s Desktop policy allows the Shell, agents in app conversations can run commands on your Mac, for example tests or a build in a trusted project. The laptop strip shows Shell on.

Allow commands and file changes for a chat

The first command in a conversation asks Run a command? with the full command. The first file write asks Write a file? with the path.

Choice	What it means
Not now	The agent continues without it.
Allow once	Only this command or this file.
Allow for this chat	Commands, or file writes, in this conversation without asking again.

The first command in a conversation asks first. Shown with sample data.

Stopping a conversation, or a policy change, makes every conversation ask again.

What a command can reach

Each command runs in its own macOS sandbox, built from your trusted folders:

	A command can	A command cannot
Your trusted folders	Read every trusted folder; write in the ones you trusted Read and write	Write in a Read only folder
The rest of your home folder	Nothing	Read or write anything outside your trusted folders
Secrets	Nothing	Read SSH keys, cloud credentials, the keychain or app data, even inside a trusted folder
The system	Read the system and installed developer software (for example Xcode, Homebrew, Node, Python and Rust)	Change the system, control other apps, or start background services
Temporary files	Use its own temporary folder, removed when the command ends	Leave temporary files behind
The network	Download packages and call web services, when Shell network is on	Reach the network when Shell network is off

Shell network is on by default. Your organization can turn it off for everyone (Shell can reach the network in the Desktop policy), and you can turn it off for your Mac in Settings > Shell & files. Commands then still run, without network access.

When the shell does not run

• The policy turns the Shell off, or you turned Shell commands off in Settings.
• Files are off for this computer, in the policy or your Settings.
• No folder is trusted yet.
• The policy is read only, so the shell cannot write anywhere.
• The computer cannot run commands safely, for example on Windows today. The strip reads Shell unavailable and agents work with your files directly. See Where it runs.

Each command is recorded with its outcome and duration, never the content of your files.