[{"data":1,"prerenderedAt":5034},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader":1849,"docs-surround:\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader":5029},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":1219,"body":1851,"description":5020,"extension":5021,"links":5022,"meta":5023,"navigation":5026,"path":1220,"seo":5027,"stem":1221,"__hash__":5028},"docs\u002F06.govern\u002F12.command-rules\u002F03.command-reader.md",{"type":1852,"value":1853,"toc":4996},"minimark",[1854,1858,1863,1875,1879,1882,1916,1920,2223,2227,2241,2295,2312,2352,2370,2399,2405,2423,2427,2440,2557,2575,2613,2634,2638,2641,2646,2706,2710,2713,2849,2853,2856,2859,2952,3000,3061,3065,3095,3099,3106,3131,3164,3192,3199,3242,3256,3260,3281,3285,3335,3339,3406,3410,3490,3539,3563,3568,3571,3807,3846,3850,3912,3915,3986,4002,4005,4103,4112,4116,4128,4232,4271,4311,4315,4318,4365,4368,4501,4505,4597,4674,4703,4707,4831,4834,4838,4841,4861,4864,4868,4881,4885,4896,4920,4924,4927,4971,4979,4992],[1855,1856,1857],"p",{},"For: tenant admins and governance reviewers.",[1859,1860,1862],"h2",{"id":1861},"what-the-reader-reads","What the reader reads",[1855,1864,1865,1866,1870,1871,1874],{},"The reader reads a command as bash runs it, and it reads only what it models exactly. A command is ",[1867,1868,1869],"strong",{},"readable"," when every construct in it is one of those below; anything else is ",[1867,1872,1873],{},"unreadable",", and the floor asks. This is the safe way round: a reader that tries to know every way a command can be dangerous never stops finding more of them, while one that asks about everything it has not modelled can only be wrong by asking too often.",[1859,1876,1878],{"id":1877},"evidence-for-supported-syntax","Evidence for supported syntax",[1855,1880,1881],{},"Each construct below has a row in the shared cases that bash 5.2 runs in a sandbox with stand-in programs, so the reader's reading of it is checked against what bash does, and the list grows only that way.",[1855,1883,1884,1885,1889,1890,1889,1893,1889,1896,1889,1899,1889,1902,1905,1906,1889,1909,1889,1912,1915],{},"The wrappers coreutils and util-linux install (",[1886,1887,1888],"code",{},"timeout",", ",[1886,1891,1892],{},"nice",[1886,1894,1895],{},"env",[1886,1897,1898],{},"nohup",[1886,1900,1901],{},"setsid",[1886,1903,1904],{},"flock"," and the like) run as themselves there, so how the reader reads their options is checked against theirs; ",[1886,1907,1908],{},"sudo",[1886,1910,1911],{},"doas",[1886,1913,1914],{},"chrt"," and the other wrappers that need a privilege run as stand-ins, and how it reads their options is checked by the cases' answers alone.",[1859,1917,1919],{"id":1918},"supported-command-forms","Supported command forms",[1921,1922,1923,1931,1960,1999,2043,2075,2091,2185,2204],"ul",{},[1924,1925,1926,1927,1930],"li",{},"Simple commands: a program and its words, each literal or plainly quoted (single quotes, double quotes, a backslash, a ",[1886,1928,1929],{},"$'...'"," string whose escapes make ASCII characters other than a NUL, where bash ends the string and zsh does not), with comments and lines joined by a backslash.",[1924,1932,1933,1934,1937,1938,1889,1941,1889,1944,1947,1948,1951,1952,1955,1956,1959],{},"Lists and pipelines: commands joined by ",[1886,1935,1936],{},";",", a newline, ",[1886,1939,1940],{},"&&",[1886,1942,1943],{},"||",[1886,1945,1946],{},"|"," and ",[1886,1949,1950],{},"|&",", a pipeline after ",[1886,1953,1954],{},"!"," or the ",[1886,1957,1958],{},"time"," keyword.",[1924,1961,1962,1963,1889,1966,1889,1969,1889,1972,1889,1975,1889,1978,1889,1981,1984,1985,1889,1988,1889,1991,1994,1995,1998],{},"Redirections to or from a literal path (",[1886,1964,1965],{},"\u003C",[1886,1967,1968],{},">",[1886,1970,1971],{},">>",[1886,1973,1974],{},">|",[1886,1976,1977],{},"\u003C>",[1886,1979,1980],{},"&>",[1886,1982,1983],{},"&>>","), a descriptor copied or closed (",[1886,1986,1987],{},"2>&1",[1886,1989,1990],{},">&2",[1886,1992,1993],{},"2>&-","), a here-document whose end word is quoted or whose body holds no ",[1886,1996,1997],{},"$",", backquote or backslash, and a here-string of literal text.",[1924,2000,2001,2002,2005,2006,2009,2010,1889,2013,1947,2016,2019,2020,1889,2023,2026,2027,2030,2031,2034,2035,2038,2039,2042],{},"Variables the command sets itself: ",[1886,2003,2004],{},"name=text"," for a name neither bash nor zsh gives a meaning of its own, before a command for that command alone, or in ",[1886,2007,2008],{},"export name=text","; and ",[1886,2011,2012],{},"$name",[1886,2014,2015],{},"${name}",[1886,2017,2018],{},"\"$name\""," of such a name where the assignment certainly ran (",[1886,2021,2022],{},"d=build; rm -r \"$d\"",[1886,2024,2025],{},"true && d=build && rm -r $d",", but not after ",[1886,2028,2029],{},"false || d=build","). Unquoted, its value must hold no blank, newline, pattern character or backslash, so bash neither splits nor matches it. ",[1886,2032,2033],{},"LANG"," and the ",[1886,2036,2037],{},"LC_"," names may be set before a command (",[1886,2040,2041],{},"LC_ALL=C sort",").",[1924,2044,2045,2046,1947,2049,2052,2053,2056,2057,2059,2060,2063,2064,2067,2068,2071,2072,2074],{},"The home folder: ",[1886,2047,2048],{},"~",[1886,2050,2051],{},"~\u002Fpath"," at a word's start. The command cannot change ",[1886,2054,2055],{},"HOME",", so ",[1886,2058,2048],{}," is the account's home; ",[1886,2061,2062],{},"cd"," with no operand goes there. The reader does not know how deep that home stands: a path that climbs out of it is read both from ",[1886,2065,2066],{},"\u002Fhome"," and, as a home one deep such as ",[1886,2069,2070],{},"\u002Froot"," puts it, from the root, and the fixed aliases below are read after ",[1886,2073,2048],{}," too, as a container's account may have the root for a home.",[1924,2076,2077,2079,2080,1889,2083,2086,2087,2090],{},[1886,2078,2062],{}," to one literal path (after ",[1886,2081,2082],{},"-L",[1886,2084,2085],{},"-P"," or ",[1886,2088,2089],{},"--","), in this shell.",[1924,2092,2093,2094,1889,2097,2100,2101,1889,2104,1889,2107,1889,2110,1889,2113,1889,2116,1947,2119,2100,2122,2086,2124,1889,2127,2130,2131,1889,2134,1889,2137,1889,2140,1889,2142,1889,2145,1947,2148,2151,2152,1889,2155,1889,2158,1889,2161,1889,2164,1889,2167,2086,2170,1889,2173,2176,2177,2180,2181,2184],{},"A few builtins: ",[1886,2095,2096],{},"echo",[1886,2098,2099],{},"printf"," without ",[1886,2102,2103],{},"-v",[1886,2105,2106],{},"true",[1886,2108,2109],{},"false",[1886,2111,2112],{},":",[1886,2114,2115],{},"pwd",[1886,2117,2118],{},"test",[1886,2120,2121],{},"[",[1886,2123,2103],{},[1886,2125,2126],{},"-R",[1886,2128,2129],{},"set"," with ",[1886,2132,2133],{},"-e",[1886,2135,2136],{},"-u",[1886,2138,2139],{},"-x",[1886,2141,2103],{},[1886,2143,2144],{},"-f",[1886,2146,2147],{},"-C",[1886,2149,2150],{},"-o"," for ",[1886,2153,2154],{},"errexit",[1886,2156,2157],{},"nounset",[1886,2159,2160],{},"xtrace",[1886,2162,2163],{},"verbose",[1886,2165,2166],{},"noglob",[1886,2168,2169],{},"noclobber",[1886,2171,2172],{},"pipefail",[1886,2174,2175],{},"shopt"," for how patterns match, and ",[1886,2178,2179],{},"exec"," alone with its output sent to ",[1886,2182,2183],{},"\u002Fdev\u002Fnull"," or another descriptor.",[1924,2186,2187,2188,1889,2190,1889,2192,1889,2194,1889,2196,1889,2198,1889,2201,2203],{},"Wrappers: ",[1886,2189,1908],{},[1886,2191,1895],{},[1886,2193,1892],{},[1886,2195,1898],{},[1886,2197,1888],{},[1886,2199,2200],{},"command",[1886,2202,2179],{}," and the others the defaults list, their options read as each documents them, and the command each runs read as a command.",[1924,2205,2206,2207,2210,2211,2214,2215,2218,2219,2222],{},"A shell that runs no text of the command: a script file (",[1886,2208,2209],{},"bash scripts\u002Fbuild.sh","), or what a download writes to it (",[1886,2212,2213],{},"curl ... | sh",", which ",[1886,2216,2217],{},"cmd.download-run"," asks about, and a tenant may allow), when no other part of the command may have written a file first (below).",[2220,2221],"br",{},"A script that may be the shell's own input is no file of the folder, however a path spells it, so such a shell is unreadable, and so is one with no plain file to run that has a here-document or a here-string on any descriptor, or that takes its input from a descriptor.",[1859,2224,2226],{"id":2225},"path-resolution","Path resolution",[1855,2228,2229,2230,2232,2233,2236,2237,2240],{},"The reader resolves paths against the working directory and a ",[1886,2231,2062],{}," earlier in the command. A path that climbs two or more folders above the working directory is read as the same path from the root would be, since the working directory may be that shallow: ",[1886,2234,2235],{},"rm -rf ..\u002F..\u002F..\u002Fetc"," asks as ",[1886,2238,2239],{},"\u002Fetc"," would.",[1855,2242,2243,2244,1889,2247,1947,2250,2253,2254,2257,2258,2261,2262,2265,2266,1889,2269,1947,2272,2275,2276,1889,2278,1947,2281,2284,2285,2288,2289,2236,2292,2240],{},"A fixed alias reads as the path it names, however the path reaches it, one that climbed above the working directory by any number of folders included: ",[1886,2245,2246],{},"\u002Fproc\u002Fself\u002Froot",[1886,2248,2249],{},"\u002Fproc\u002Fthread-self\u002Froot",[1886,2251,2252],{},"\u002Fproc\u002F\u003Cpid>\u002Froot"," (and those under ",[1886,2255,2256],{},"task\u002F\u003Ctid>",") as the root, ",[1886,2259,2260],{},"\u002Fproc\u002Fself\u002Fcwd"," as the working directory, and macOS's ",[1886,2263,2264],{},"\u002FSystem\u002FVolumes\u002FData"," as the root and ",[1886,2267,2268],{},"\u002Fprivate\u002Fetc",[1886,2270,2271],{},"\u002Fprivate\u002Fvar",[1886,2273,2274],{},"\u002Fprivate\u002Ftmp"," as ",[1886,2277,2239],{},[1886,2279,2280],{},"\u002Fvar",[1886,2282,2283],{},"\u002Ftmp",", and ",[1886,2286,2287],{},"\u002FVolumes\u002FMacintosh HD"," as the root, so ",[1886,2290,2291],{},"rm -rf \u002Fproc\u002Fself\u002Froot\u002Fhome\u002Fkevin",[1886,2293,2294],{},"\u002Fhome\u002Fkevin",[1855,2296,2297,2298,2300,2301,2130,2304,2307,2308,2311],{},"A working directory the call itself names is read the same way, as a ",[1886,2299,2062],{}," to it is: ",[1886,2302,2303],{},"rm -rf kevin",[1886,2305,2306],{},"\u002Fproc\u002Fself\u002Froot\u002Fhome"," as its ",[1886,2309,2310],{},"cwd"," asks too.",[1855,2313,2314,2315,2318,2319,1889,2322,1889,2325,2328,2329,2332,2333,2336,2337,2340,2341,2343,2344,2347,2348,2351],{},"Another process's working folder (",[1886,2316,2317],{},"\u002Fproc\u002F\u003Cpid>\u002Fcwd",") and a path through an open descriptor (",[1886,2320,2321],{},"\u002Fproc\u002Fself\u002Ffd\u002F3\u002Fx",[1886,2323,2324],{},"\u002Fdev\u002Ffd\u002F3\u002Fx",[1886,2326,2327],{},"\u002Fdev\u002Fstdin\u002Fx",", and with a final ",[1886,2330,2331],{},"\u002F",", a ",[1886,2334,2335],{},"."," or a ",[1886,2338,2339],{},".."," after it, or a ",[1886,2342,2062],{}," to one, which all open what it holds) may lead anywhere, so they are read as a place the reader cannot tell, a write there as a write to a disk as well, since what is open may be ",[1886,2345,2346],{},"\u002Fdev","; and a pattern that may make one of these (",[1886,2349,2350],{},"\u002Fproc\u002F*\u002Froot",") is read as both.",[1855,2353,2354,2355,2358,2359,2362,2363,1947,2366,2369],{},"The descriptor alone is a file, except to a program that follows a link it is given into what it holds: to a recursive ",[1886,2356,2357],{},"chmod",", to ",[1886,2360,2361],{},"find"," with its options or primary that follow links, and to ",[1886,2364,2365],{},"chown",[1886,2367,2368],{},"chgrp"," with theirs, it is a place the reader cannot tell.",[1855,2371,2372,2373,2375,2376,1889,2379,1889,2382,1889,2385,2388,2389,2392,2393,2396,2397,2335],{},"The folders that are links on every Linux system leave a path where the link leads, so a ",[1886,2374,2339],{}," straight after one (",[1886,2377,2378],{},"\u002Fdev\u002Ffd",[1886,2380,2381],{},"\u002Fproc\u002Fnet",[1886,2383,2384],{},"\u002Fproc\u002Fthread-self",[1886,2386,2387],{},"\u002Fvar\u002Frun"," and Debian's ",[1886,2390,2391],{},"\u002Fusr\u002Fbin\u002FX11",") is read as that same place: ",[1886,2394,2395],{},"\u002Fdev\u002Ffd\u002F..\u002Froot"," is ",[1886,2398,2246],{},[1855,2400,2401,2402,2404],{},"The reader reads no file system, so any other link, one a command made or one of a system's own that this list leaves out, is read as its text says; that a ",[1886,2403,2339],{}," after it climbs elsewhere is the sandbox's to bound.",[1855,2406,2407,2408,1889,2411,1889,2414,2417,2418,2042],{},"That is how a path gets its class (",[1886,2409,2410],{},"home",[1886,2412,2413],{},"root",[1886,2415,2416],{},"device","), and how an Ask's or a Refuse's own path is compared (",[2419,2420,2422],"a",{"href":2421},"\u002Fgovern\u002Fcommand-rules\u002Fpatterns#patterns","Patterns",[1859,2424,2426],{"id":2425},"supported-filename-patterns","Supported filename patterns",[1855,2428,2429,2430,1889,2433,1947,2436,2439],{},"The reader supports patterns in a program's file arguments (",[1886,2431,2432],{},"*",[1886,2434,2435],{},"?",[1886,2437,2438],{},"[...]",") when every word bash can make of a pattern is a word the reader reads the same way, whatever the folder holds: none, many or the pattern itself. These forms qualify:",[1921,2441,2442,2521,2544],{},[1924,2443,2444,2445,2086,2448,2451,2452,1889,2455,1889,2458,2461,2462,1889,2465,1889,2468,1889,2471,1889,2474,1889,2477,1889,2480,1889,2483,2486,2487,2490,2491,2493,2494,2497,2498,2236,2501,2504,2505,2507,2508,1947,2510,2512,2513,2516,2517,2520],{},"A word whose text before its first pattern character is literal and starts with a character other than ",[1886,2446,2447],{},"-",[1886,2449,2450],{},"+"," (",[1886,2453,2454],{},"docs\u002F*.md",[1886,2456,2457],{},"src\u002F[ab]?.go",[1886,2459,2460],{},"x*","), in the files of ",[1886,2463,2464],{},"ls",[1886,2466,2467],{},"cat",[1886,2469,2470],{},"wc",[1886,2472,2473],{},"head",[1886,2475,2476],{},"tail",[1886,2478,2479],{},"du",[1886,2481,2482],{},"rm",[1886,2484,2485],{},"grep"," (after its pattern) or ",[1886,2488,2489],{},"sed"," (after a script given with ",[1886,2492,2133],{},"): every match starts with that text, so none is an option, and each is read as a file with the class a literal path with that start has (",[1886,2495,2496],{},"rm -rf .\u002F*"," deletes in the working folder; ",[1886,2499,2500],{},"rm -rf ..\u002F*",[1886,2502,2503],{},"rm -rf .."," would).",[2220,2506],{},"For ",[1886,2509,2482],{},[1886,2511,2489],{},", which remove or rewrite what they name, the pattern must stand in the word's last part (",[1886,2514,2515],{},"rm -rf build\u002Fcache\u002F*",", not ",[1886,2518,2519],{},"rm -rf build\u002F*\u002Fcache","): a match the word goes on through may be a link the folder already holds to a folder outside it.",[1924,2522,2523,2524,1889,2527,1947,2530,2533,2534,2536,2537,1947,2540,2543],{},"A name pattern attached to an option that only matches names against it: grep's ",[1886,2525,2526],{},"--include=*.go",[1886,2528,2529],{},"--exclude",[1886,2531,2532],{},"--exclude-dir",", du's ",[1886,2535,2529],{},", ls's ",[1886,2538,2539],{},"--hide",[1886,2541,2542],{},"--ignore",", named in full. Every match starts with the option's own text, so it is the same option.",[1924,2545,2546,2547,2549,2550,1889,2553,2556],{},"A word that starts with a pattern character after a ",[1886,2548,2089],{}," that ends the program's options (",[1886,2551,2552],{},"grep -n x -- *.md",[1886,2554,2555],{},"rm -- *.tmp","), in the same files: every match is a file, even one named like an option.",[1855,2558,2559,2560,2562,2563,2566,2567,2570,2571,2574],{},"A program's options are read as its GNU, BSD and busybox forms take them, and for ",[1886,2561,2485],{}," the ugrep a harness may run under that name too: a word counts as a file only when it is one in every one of them, so ",[1886,2564,2565],{},"sed -i 's\u002Fa\u002Fb\u002F' src\u002F*.go"," asks (BSD's sed reads ",[1886,2568,2569],{},"'s\u002Fa\u002Fb\u002F'"," as the backup's suffix and the first match as its script) and ",[1886,2572,2573],{},"sed -i -e 's\u002Fa\u002Fb\u002F' src\u002F*.go"," does not.",[1855,2576,2577,2578,1889,2581,1889,2584,1889,2587,1889,2590,2593,2594,1889,2597,1889,2600,1889,2602,1889,2604,1889,2607,1947,2610,2612],{},"The reading holds whatever matching options an account's startup file gives the shell (",[1886,2579,2580],{},"dotglob",[1886,2582,2583],{},"nullglob",[1886,2585,2586],{},"nocaseglob",[1886,2588,2589],{},"globstar",[1886,2591,2592],{},"set -f",", and zsh's ",[1886,2595,2596],{},"markdirs",[1886,2598,2599],{},"globdots",[1886,2601,2583],{},[1886,2603,2586],{},[1886,2605,2606],{},"extendedglob",[1886,2608,2609],{},"globstarshort",[1886,2611,2166],{},"), which the reader cannot see: the cases run under each.",[1855,2614,2615,2616,2619,2620,2623,2624,2086,2627,2236,2630,2633],{},"A bracket expression is read as the shell reads it, a ",[1886,2617,2618],{},"]"," first in it and a ",[1886,2621,2622],{},"[:class:]"," inside it included, so ",[1886,2625,2626],{},"rm -rf \u002Fusr\u002F[[:print:]]*",[1886,2628,2629],{},"rm -rf ..\u002F[!]]*",[1886,2631,2632],{},"rm -rf \u002Fusr\u002F*"," does.",[1859,2635,2637],{"id":2636},"unreadable-constructs","Unreadable constructs",[1855,2639,2640],{},"Everything else is unreadable, and the approval card names the construct that made it so. Among them:",[2642,2643,2645],"h3",{"id":2644},"shell-evaluation","Shell evaluation",[1855,2647,2648,2649,1889,2652,1889,2655,2658,2659,1889,2662,1889,2665,2668,2669,1889,2672,1889,2675,2678,2679,2682,2683,1889,2686,1889,2689,2086,2692,1889,2695,1889,2698,2701,2702,2705],{},"The reader asks about what bash evaluates or reads again: arithmetic (",[1886,2650,2651],{},"$((...))",[1886,2653,2654],{},"((...))",[1886,2656,2657],{},"let","), ",[1886,2660,2661],{},"eval",[1886,2663,2664],{},"trap",[1886,2666,2667],{},"source",", a command or process substitution, a parameter expansion with an operator (",[1886,2670,2671],{},"${x:-y}",[1886,2673,2674],{},"${#x}",[1886,2676,2677],{},"${!x}","), arrays, and a shell that reads text of the command (",[1886,2680,2681],{},"sh -c '...'",", a here-document or here-string fed to a shell, ",[1886,2684,2685],{},"bash -i",[1886,2687,2688],{},"su",[1886,2690,2691],{},"sudo -s",[1886,2693,2694],{},"-i",[1886,2696,2697],{},"flock -c",[1886,2699,2700],{},"watch",", a command ",[1886,2703,2704],{},"ssh"," runs on another machine).",[2642,2707,2709],{"id":2708},"values-that-steer-the-shell","Values that steer the shell",[1855,2711,2712],{},"The reader asks about values or filenames that can steer bash:",[1921,2714,2715,2737,2753,2768,2794,2809],{},[1924,2716,2717,2718,2720,2721,2100,2724,1889,2726,2729,2730,1889,2733,2736],{},"Patterns outside the supported file positions, where a match could become an option, program, ",[1886,2719,2062],{}," directory or redirection target. Examples are ",[1886,2722,2723],{},"ls *.txt",[1886,2725,2089],{},[1886,2727,2728],{},"grep *.go"," (its first match becomes the pattern), ",[1886,2731,2732],{},"cd src\u002F*",[1886,2734,2735],{},"cat \u003C in*",", patterns in a wrapper's words or an option's value, and programs not listed above.",[1924,2738,2739,2742,2743,2746,2747,2749,2750,2752],{},[1886,2740,2741],{},"**",", a part beginning with a dot (",[1886,2744,2745],{},".*"," matches ",[1886,2748,2339],{}," in bash before 5.2), a pattern with a variable or ",[1886,2751,2048],{}," in its word, and extended patterns.",[1924,2754,2755,2756,1889,2758,2086,2760,2763,2764,2767],{},"Every pattern in a command that runs ",[1886,2757,2175],{},[1886,2759,2592],{},[1886,2761,2762],{},"set -o noglob",", or sets a non-locale name for the program. For example, ",[1886,2765,2766],{},"X=1 ls docs\u002F*"," may read program options from its environment.",[1924,2769,2770,2771,2086,2773,2775,2776,1889,2779,1889,2782,1889,2785,2788,2789,2086,2792,2335],{},"Brace expansion and tildes other than ",[1886,2772,2048],{},[1886,2774,2051],{},": ",[1886,2777,2778],{},"~user",[1886,2780,2781],{},"~+",[1886,2783,2784],{},"~-",[1886,2786,2787],{},"~1",", or a tilde after ",[1886,2790,2791],{},"=",[1886,2793,2112],{},[1924,2795,2796,2797,2799,2800,1889,2803,1947,2806,2335],{},"A variable not certainly set to literal text by the command, including environment variables and assignments after ",[1886,2798,1943],{},"; positional or special parameters such as ",[1886,2801,2802],{},"$1",[1886,2804,2805],{},"$@",[1886,2807,2808],{},"$?",[1924,2810,2811,2812,1889,2814,1889,2817,1889,2820,1889,2823,1889,2826,1889,2829,1889,2832,2835,2836,1889,2839,1889,2842,1889,2845,2848],{},"Any name bash assigns a special meaning, whether read or set: ",[1886,2813,2055],{},[1886,2815,2816],{},"PWD",[1886,2818,2819],{},"OLDPWD",[1886,2821,2822],{},"IFS",[1886,2824,2825],{},"PATH",[1886,2827,2828],{},"CDPATH",[1886,2830,2831],{},"BASH_ENV",[1886,2833,2834],{},"ENV",", prompts, ",[1886,2837,2838],{},"PROMPT_COMMAND",[1886,2840,2841],{},"SHELLOPTS",[1886,2843,2844],{},"BASHOPTS",[1886,2846,2847],{},"GLOBIGNORE"," and the rest in bash's manual.",[2642,2850,2852],{"id":2851},"bash-and-zsh-differences","Bash and zsh differences",[1855,2854,2855],{},"The reader asks about constructs zsh reads differently from bash: the command's shell may be zsh (macOS's, and an account's at sandbox tier 0), so a command is read only where its shape means the same in both.",[1855,2857,2858],{},"The zsh forms that the reader cannot safely read as bash are:",[1921,2860,2861,2883,2903,2919,2929],{},[1924,2862,2863,2864,1889,2867,1889,2870,1889,2873,1889,2876,1889,2879,2882],{},"Parameter flags and modifiers without braces: ",[1886,2865,2866],{},"$=x",[1886,2868,2869],{},"$~x",[1886,2871,2872],{},"$^x",[1886,2874,2875],{},"$+x",[1886,2877,2878],{},"$x[1]",[1886,2880,2881],{},"$x:h",", and a name with letters past ASCII, which zsh reads on.",[1924,2884,2885,2886,2775,2888,2086,2891,2894,2895,2898,2899,2902],{},"A word or value starting with an unquoted ",[1886,2887,2791],{},[1886,2889,2890],{},"rm =python",[1886,2892,2893],{},"x==ls",". zsh puts the program's path there. A word starting with ",[1886,2896,2897],{},"==",", such as ",[1886,2900,2901],{},"echo ====",", names a program zsh fails to find; that command runs nothing and is read.",[1924,2904,2905,1947,2908,2911,2912,2914,2915,2918],{},[1886,2906,2907],{},">!",[1886,2909,2910],{},">>!",", which mean zsh's ",[1886,2913,1974],{},"; bash writes to a file named ",[1886,2916,2917],{},"!..."," instead.",[1924,2920,2921,2922,1947,2925,2928],{},"Numeric patterns such as ",[1886,2923,2924],{},"\u003C1-10>",[1886,2926,2927],{},"\u003C->",", which bash reads as two redirections.",[1924,2930,2931,2932,2934,2935,2938,2939,2942,2943,2946,2947,1889,2950,2335],{},"Redirections without a program, unless each sends to or from ",[1886,2933,2183],{},". ",[1886,2936,2937],{},"\u003C file"," runs zsh's ",[1886,2940,2941],{},"$READNULLCMD",", a pager, and ",[1886,2944,2945],{},"> file"," runs its ",[1886,2948,2949],{},"$NULLCMD",[1886,2951,2467],{},[1855,2953,2954,2955,1889,2958,1889,2961,1889,2964,1889,2967,1889,2970,1947,2973,2976,2977,1889,2980,1889,2983,1947,2986,2989,2990,1889,2993,1889,2996,2999],{},"Any name zsh gives a meaning of its own is unreadable too, case for case, read or set, before a command or alone: ",[1886,2956,2957],{},"path",[1886,2959,2960],{},"cdpath",[1886,2962,2963],{},"fpath",[1886,2965,2966],{},"manpath",[1886,2968,2969],{},"module_path",[1886,2971,2972],{},"mailpath",[1886,2974,2975],{},"psvar"," (where a program, a folder, a function or a module is looked up), ",[1886,2978,2979],{},"NULLCMD",[1886,2981,2982],{},"READNULLCMD",[1886,2984,2985],{},"STTY",[1886,2987,2988],{},"ARGV0"," (a program zsh runs, or the name it runs one as), ",[1886,2991,2992],{},"status",[1886,2994,2995],{},"argv",[1886,2997,2998],{},"USERNAME"," and the rest of zsh's manual.",[1855,3001,3002,3003,1889,3005,1947,3008,3010,3011,2236,3014,2658,3017,1889,3020,1889,3023,1889,3026,1889,3029,1889,3032,1889,3035,1889,3038,1889,3041,1889,3044,1889,3047,1889,3050,3053,3054,3057,3058,3060],{},"So are the words zsh runs as its own builtins, reserved words and precommand modifiers where bash runs a program of that name: ",[1886,3004,2166],{},[1886,3006,3007],{},"nocorrect",[1886,3009,2447],{}," (the command after them is read too, so ",[1886,3012,3013],{},"noglob rm -rf ~",[1886,3015,3016],{},"cmd.delete-home",[1886,3018,3019],{},"repeat",[1886,3021,3022],{},"foreach",[1886,3024,3025],{},"emulate",[1886,3027,3028],{},"setopt",[1886,3030,3031],{},"unsetopt",[1886,3033,3034],{},"zmodload",[1886,3036,3037],{},"autoload",[1886,3039,3040],{},"zpty",[1886,3042,3043],{},"sched",[1886,3045,3046],{},"print",[1886,3048,3049],{},"r",[1886,3051,3052],{},"whence"," and the rest; zsh's ",[1886,3055,3056],{},"which",", which only prints where a program is, as the ",[1886,3059,3056],{}," program does, is read.",[2642,3062,3064],{"id":3063},"compound-commands","Compound commands",[1855,3066,3067,3068,1889,3071,1889,3074,1889,3077,1947,3080,3083,3084,3087,3088,3091,3092,2335],{},"The reader asks about compound commands: ",[1886,3069,3070],{},"if",[1886,3072,3073],{},"case",[1886,3075,3076],{},"for",[1886,3078,3079],{},"while",[1886,3081,3082],{},"until"," loops, functions, subshells and ",[1886,3085,3086],{},"{ ...; }"," groups, ",[1886,3089,3090],{},"[[ ... ]]"," tests, and commands run in the background with ",[1886,3093,3094],{},"&",[2642,3096,3098],{"id":3097},"write-then-execute","Write then execute",[1855,3100,3101,3102,3105],{},"The reader asks about files a command writes and then runs. A part may have written a file if it uses a file redirection, ",[1886,3103,3104],{},"\u002Fusr\u002Fbin\u002Ftime -o",", or a program outside the reader's short list of programs that only print.",[1855,3107,3108,3109,1889,3112,1889,3115,1889,3118,1889,3121,2284,3124,2086,3127,3130],{},"Examples include ",[1886,3110,3111],{},"tee",[1886,3113,3114],{},"cp",[1886,3116,3117],{},"sed -i",[1886,3119,3120],{},"curl -o",[1886,3122,3123],{},"git clone",[1886,3125,3126],{},"git fetch",[1886,3128,3129],{},"git pull"," from a URL or path on the command line.",[1855,3132,3133,3134,1889,3136,1889,3138,1889,3140,1889,3142,1889,3145,1889,3147,1889,3150,1889,3153,1889,3155,1889,3158,1947,3161,2335],{},"After such a part, every later part and every other stage of its pipeline is unreadable unless its program is known to run no code or command from files it reads. That short list includes ",[1886,3135,2467],{},[1886,3137,2485],{},[1886,3139,2464],{},[1886,3141,2482],{},[1886,3143,3144],{},"mkdir",[1886,3146,3114],{},[1886,3148,3149],{},"mv",[1886,3151,3152],{},"jq",[1886,3154,2489],{},[1886,3156,3157],{},"curl",[1886,3159,3160],{},"tar",[1886,3162,3163],{},"sort",[1855,3165,3166,3167,3170,3171,3174,3175,1889,3177,1947,3180,3183,3184,3187,3188,3191],{},"Any other program may run what the command wrote: a shell its script, ",[1886,3168,3169],{},"make"," its makefile, ",[1886,3172,3173],{},"git"," its configuration and hooks, ",[1886,3176,2704],{},[1886,3178,3179],{},"scp",[1886,3181,3182],{},"rsync"," the commands of their configuration, ",[1886,3185,3186],{},"pip install ."," a project's ",[1886,3189,3190],{},"setup.py",", and the code would then be text of the command the reader did not read.",[1855,3193,3194,3195,3198],{},"A program run by its path (",[1886,3196,3197],{},".\u002Fx",") or by the name of a file the command wrote always counts.",[1855,3200,3201,3202,1889,3204,1889,3207,1889,3210,1889,3213,3216,3217,1889,3220,3223,3224,2658,3227,1889,3230,2332,3233,2086,3235,3237,3238,3241],{},"Writing does not count for what the working folder's own code writes while its output goes to no file (",[1886,3203,3169],{},[1886,3205,3206],{},"go build",[1886,3208,3209],{},"cargo test",[1886,3211,3212],{},"npm run",[1886,3214,3215],{},"pytest","), a formatter rewriting files of the folder it names (",[1886,3218,3219],{},"gofmt -w",[1886,3221,3222],{},"ruff","), an install from the folder's lockfile (",[1886,3225,3226],{},"npm ci",[1886,3228,3229],{},"git add",[1886,3231,3232],{},"git commit",[1886,3234,3126],{},[1886,3236,3129],{}," of a remote the repository names, and what an interpreter or ",[1886,3239,3240],{},"awk"," writes, whose code the reader does not read and which could run it itself.",[1855,3243,3244,3245,3248,3249,2130,3252,3255],{},"It does count for ",[1886,3246,3247],{},"go list -f",", a formatter reading its input, ",[1886,3250,3251],{},"curl -w",[1886,3253,3254],{},"%output{}",", and the output of any of them sent to a file, since what they print may be the command's own words.",[2642,3257,3259],{"id":3258},"shell-network-redirections","Shell network redirections",[1855,3261,3262,3263,1947,3266,3269,3270,3273,3274,3276,3277,3280],{},"The reader asks about network connections bash opens for a redirection: ",[1886,3264,3265],{},"\u002Fdev\u002Ftcp\u002Fhost\u002Fport",[1886,3267,3268],{},"\u002Fdev\u002Fudp\u002Fhost\u002Fport"," are not file paths, so ",[1886,3271,3272],{},"bash \u003C \u002Fdev\u002Ftcp\u002F..."," is a download run unread (",[1886,3275,2217],{}," asks about it too), and ",[1886,3278,3279],{},"cat secret > \u002Fdev\u002Ftcp\u002F..."," sends a file away.",[2642,3282,3284],{"id":3283},"links-made-by-the-command","Links made by the command",[1855,3286,3287,3288,1889,3291,1889,3293,1947,3296,1889,3299,3301,3302,1889,3305,1889,3307,1889,3310,1889,3313,1889,3315,1889,3318,3321,3322,2658,3324,2086,3327,1889,3329,3331,3332,3334],{},"The reader asks about a link the command may make before another part runs: ",[1886,3289,3290],{},"ln",[1886,3292,3149],{},[1886,3294,3295],{},"cp -s",[1886,3297,3298],{},"cp -l",[1886,3300,3114],{}," copying links as links (",[1886,3303,3304],{},"-r",[1886,3306,2126],{},[1886,3308,3309],{},"-a",[1886,3311,3312],{},"-d",[1886,3314,2085],{},[1886,3316,3317],{},"--no-dereference",[1886,3319,3320],{},"--preserve=links",", unless ",[1886,3323,2082],{},[1886,3325,3326],{},"rsync -l",[1886,3328,3309],{},[1886,3330,3160],{}," extracting, and any program not known to make none. A path through it may lead anywhere, the root or a home included: ",[1886,3333,2246],{}," is a link to the root, and copying it copies the link. A link a shell's script, an interpreter's code or the working folder's own code makes is theirs, as one already on disk is.",[2642,3336,3338],{"id":3337},"shell-state-changes","Shell state changes",[1855,3340,3341,3342,1889,3345,1889,3348,1889,3351,1889,3354,1889,3357,1889,3360,1889,3363,1889,3366,1889,3369,1889,3372,1889,3375,1889,3378,1889,3381,1889,3384,1889,3387,3390,3391,1947,3393,3395,3396,3399,3400,1889,3403,3405],{},"The reader asks about builtins that change the shell: ",[1886,3343,3344],{},"declare",[1886,3346,3347],{},"typeset",[1886,3349,3350],{},"local",[1886,3352,3353],{},"readonly",[1886,3355,3356],{},"unset",[1886,3358,3359],{},"read",[1886,3361,3362],{},"mapfile",[1886,3364,3365],{},"getopts",[1886,3367,3368],{},"alias",[1886,3370,3371],{},"hash",[1886,3373,3374],{},"enable",[1886,3376,3377],{},"pushd",[1886,3379,3380],{},"popd",[1886,3382,3383],{},"fc",[1886,3385,3386],{},"history",[1886,3388,3389],{},"kill"," and the rest, ",[1886,3392,2129],{},[1886,3394,2175],{}," options beyond those above, ",[1886,3397,3398],{},"export"," with an option, and ",[1886,3401,3402],{},"cd -",[1886,3404,2062],{}," to more than one operand or through a program that is not the shell's.",[2642,3407,3409],{"id":3408},"programs-that-launch-commands","Programs that launch commands",[1855,3411,3412,3413,1889,3416,1889,3419,1947,3422,1889,3425,1889,3428,3431,3432,1889,3435,1889,3438,1889,3441,1889,3444,1889,3447,1889,3450,1947,3453,3456,3457,1889,3460,1889,3463,1889,3466,1889,3469,1889,3472,1889,3475,1947,3478,1889,3481,3456,3484,1947,3487,3489],{},"The reader asks about programs that run a command their options, configuration or environment name: ",[1886,3414,3415],{},"xargs",[1886,3417,3418],{},"find -exec",[1886,3420,3421],{},"-execdir",[1886,3423,3424],{},"-ok",[1886,3426,3427],{},"git -c",[1886,3429,3430],{},"git config"," and the git subcommands that run a command (",[1886,3433,3434],{},"rebase -x",[1886,3436,3437],{},"bisect run",[1886,3439,3440],{},"submodule foreach",[1886,3442,3443],{},"instaweb",[1886,3445,3446],{},"help -w",[1886,3448,3449],{},"--upload-pack",[1886,3451,3452],{},"--receive-pack",[1886,3454,3455],{},"--exec"," on ",[1886,3458,3459],{},"clone",[1886,3461,3462],{},"fetch",[1886,3464,3465],{},"pull",[1886,3467,3468],{},"ls-remote",[1886,3470,3471],{},"fetch-pack",[1886,3473,3474],{},"send-pack",[1886,3476,3477],{},"push",[1886,3479,3480],{},"archive",[1886,3482,3483],{},"--template",[1886,3485,3486],{},"init",[1886,3488,3459],{},", and the like).",[1855,3491,3492,3493,1889,3495,1889,3498,1889,3501,1889,3504,1889,3507,1889,3510,3512,3513,3516,3517,1889,3520,1889,3523,1889,3526,1889,3529,3532,3533,3536,3537,2335],{},"git's subcommands are read by a reviewed list of the built-in ones that run no program their options name (",[1886,3494,2992],{},[1886,3496,3497],{},"log",[1886,3499,3500],{},"diff",[1886,3502,3503],{},"add",[1886,3505,3506],{},"commit",[1886,3508,3509],{},"checkout",[1886,3511,3477],{}," and the rest): any other name asks, since git runs an alias of that name from its configuration, or a ",[1886,3514,3515],{},"git-"," program, and the command may have written the alias (",[1886,3518,3519],{},"git st",[1886,3521,3522],{},"git lfs",[1886,3524,3525],{},"git maintenance",[1886,3527,3528],{},"git credential",[1886,3530,3531],{},"git hook","), and so does an empty subcommand (",[1886,3534,3535],{},"git \"\" status","), which git runs as the program ",[1886,3538,3515],{},[1855,3540,3541,3542,1889,3544,1889,3547,1889,3550,1889,3553,3556,3557,2396,3560,2335],{},"git's own options before the subcommand are read the same way: an option the reader does not know asks, since it may take the next word as its value and leave another word as the subcommand, and those that take a value (",[1886,3543,2147],{},[1886,3545,3546],{},"--git-dir",[1886,3548,3549],{},"--work-tree",[1886,3551,3552],{},"--attr-source",[1886,3554,3555],{},"--shallow-file"," and the like) take the next word, as git does; ",[1886,3558,3559],{},"git --help",[1886,3561,3562],{},"git help",[3564,3565,3567],"h4",{"id":3566},"options-that-name-code-or-configuration","Options that name code or configuration",[1855,3569,3570],{},"The reader also asks about these options that can load code or run another program:",[3572,3573,3574,3587],"table",{},[3575,3576,3577],"thead",{},[3578,3579,3580,3584],"tr",{},[3581,3582,3583],"th",{},"Program",[3581,3585,3586],{},"Options or environment",[3588,3589,3590,3605,3621,3640,3655,3667,3679,3694,3706,3721,3732,3749,3761,3777,3791],"tbody",{},[3578,3591,3592,3597],{},[3593,3594,3595],"td",{},[1886,3596,3160],{},[3593,3598,3599,1889,3602],{},[1886,3600,3601],{},"-I",[1886,3603,3604],{},"--use-compress-program",[3578,3606,3607,3611],{},[3593,3608,3609],{},[1886,3610,3182],{},[3593,3612,3613,1889,3615,1889,3618],{},[1886,3614,2133],{},[1886,3616,3617],{},"-M",[1886,3619,3620],{},"--daemon",[3578,3622,3623,3630],{},[3593,3624,3625,1889,3627],{},[1886,3626,3179],{},[1886,3628,3629],{},"sftp",[3593,3631,3632,1889,3634,1889,3637],{},[1886,3633,2150],{},[1886,3635,3636],{},"-F",[1886,3638,3639],{},"-S",[3578,3641,3642,3646],{},[3593,3643,3644],{},[1886,3645,3629],{},[3593,3647,3648,3651,3652,3654],{},[1886,3649,3650],{},"-b",": a batch file runs its ",[1886,3653,1954],{}," lines in a local shell",[3578,3656,3657,3662],{},[3593,3658,3659],{},[1886,3660,3661],{},"split",[3593,3663,3664],{},[1886,3665,3666],{},"--filter",[3578,3668,3669,3674],{},[3593,3670,3671],{},[1886,3672,3673],{},"install",[3593,3675,3676],{},[1886,3677,3678],{},"--strip-program",[3578,3680,3681,3689],{},[3593,3682,3683,1889,3686],{},[1886,3684,3685],{},"sdiff",[1886,3687,3688],{},"diff3",[3593,3690,3691],{},[1886,3692,3693],{},"--diff-program",[3578,3695,3696,3701],{},[3593,3697,3698],{},[1886,3699,3700],{},"cpio",[3593,3702,3703],{},[1886,3704,3705],{},"--rsh-command",[3578,3707,3708,3712],{},[3593,3709,3710],{},[1886,3711,3157],{},[3593,3713,3714,3717,3718],{},[1886,3715,3716],{},"--engine"," (an OpenSSL engine is code), ",[1886,3719,3720],{},"-K",[3578,3722,3723,3728],{},[3593,3724,3725],{},[1886,3726,3727],{},"man",[3593,3729,3730],{},[1886,3731,2147],{},[3578,3733,3734,3739],{},[3593,3735,3736],{},[1886,3737,3738],{},"fakeroot",[3593,3740,3741,1889,3744,1889,3746],{},[1886,3742,3743],{},"--faked",[1886,3745,2144],{},[1886,3747,3748],{},"-l",[3578,3750,3751,3756],{},[3593,3752,3753],{},[1886,3754,3755],{},"torsocks",[3593,3757,3758],{},[1886,3759,3760],{},"--shell",[3578,3762,3763,3768],{},[3593,3764,3765],{},[1886,3766,3767],{},"ssh-keygen",[3593,3769,3770,1889,3773,3776],{},[1886,3771,3772],{},"-D",[1886,3774,3775],{},"-w",": a library it loads",[3578,3778,3779,3784],{},[3593,3780,3781],{},[1886,3782,3783],{},"ssh-add",[3593,3785,3786,1889,3789,3776],{},[1886,3787,3788],{},"-s",[1886,3790,3639],{},[3578,3792,3793,3797],{},[3593,3794,3795],{},[1886,3796,1895],{},[3593,3798,3799,1889,3801,1889,3803,1889,3805],{},[1886,3800,2694],{},[1886,3802,2136],{},[1886,3804,3639],{},[1886,3806,2147],{},[1855,3808,3809,3810,3813,3814,3817,3818,1889,3821,1889,3824,1889,3827,1947,3830,3833,3834,1889,3837,1889,3840,1947,3843,2335],{},"Environment names from which programs run or load code also ask, including ",[1886,3811,3812],{},"GIT_SSH_COMMAND",", other ",[1886,3815,3816],{},"GIT_"," names, ",[1886,3819,3820],{},"PAGER",[1886,3822,3823],{},"EDITOR",[1886,3825,3826],{},"VISUAL",[1886,3828,3829],{},"LESSOPEN",[1886,3831,3832],{},"LD_PRELOAD",". So do programs whose commands the reader does not read at all, including ",[1886,3835,3836],{},"parallel",[1886,3838,3839],{},"tmux",[1886,3841,3842],{},"strace",[1886,3844,3845],{},"systemd-run",[3564,3847,3849],{"id":3848},"wrappers-and-package-runners","Wrappers and package runners",[1855,3851,3852,3853,1889,3856,1889,3859,1889,3862,1889,3865,1889,3868,1889,3871,1889,3874,1889,3877,1889,3880,3883,3884,1889,3887,1889,3890,1889,3893,1889,3896,1889,3899,1889,3902,1889,3905,1889,3908,3911],{},"The reader asks about programs that run a command their operands, a subcommand or an option name: ",[1886,3854,3855],{},"setarch",[1886,3857,3858],{},"prlimit",[1886,3860,3861],{},"sshpass",[1886,3863,3864],{},"perf",[1886,3866,3867],{},"run0",[1886,3869,3870],{},"gosu",[1886,3872,3873],{},"hyperfine",[1886,3875,3876],{},"start-stop-daemon",[1886,3878,3879],{},"runcon",[1886,3881,3882],{},"setuidgid"," and daemontools' other programs, ",[1886,3885,3886],{},"dumb-init",[1886,3888,3889],{},"tini",[1886,3891,3892],{},"systemd-cat",[1886,3894,3895],{},"logsave",[1886,3897,3898],{},"dtach",[1886,3900,3901],{},"abduco",[1886,3903,3904],{},"nq",[1886,3906,3907],{},"daemonize",[1886,3909,3910],{},"flatpak-spawn"," and the like.",[1855,3913,3914],{},"The reader asks about package runners:",[1921,3916,3917,3944,3968],{},[1924,3918,3919,1889,3922,1889,3925,3928,3929,1947,3932,2658,3935,1889,3938,1947,3941,2335],{},[1886,3920,3921],{},"uvx",[1886,3923,3924],{},"npx",[1886,3926,3927],{},"npm exec"," (including npm's ",[1886,3930,3931],{},"exe",[1886,3933,3934],{},"x",[1886,3936,3937],{},"npm explore",[1886,3939,3940],{},"npm edit",[1886,3942,3943],{},"--browser",[1924,3945,3946,1947,3948,3951,3952,1947,3955,3958,3959,1889,3962,1947,3965,2335],{},[1886,3947,2179],{},[1886,3949,3950],{},"dlx"," in ",[1886,3953,3954],{},"pnpm",[1886,3956,3957],{},"yarn",", including through ",[1886,3960,3961],{},"yarn workspace \u003Cname>",[1886,3963,3964],{},"yarn workspaces foreach",[1886,3966,3967],{},"pnpm recursive",[1924,3969,3970,1889,3973,1889,3976,1889,3979,1947,3982,3985],{},[1886,3971,3972],{},"npm init",[1886,3974,3975],{},"npm create",[1886,3977,3978],{},"pnpm create",[1886,3980,3981],{},"yarn create",[1886,3983,3984],{},"bun create"," of a package, which fetch and run it.",[1855,3987,3988,3989,3991,3992,3995,3996,2086,3999,2335],{},"A ",[1886,3990,3954],{}," word that is not one of its commands, and the word after ",[1886,3993,3994],{},"bun run",", names a folder script or a program. The reader asks when it reads that program as more than its name, as in ",[1886,3997,3998],{},"pnpm sh -c '...'",[1886,4000,4001],{},"pnpm find ~ -delete",[1855,4003,4004],{},"Other command-launching forms include:",[1921,4006,4007,4022,4053,4064,4086],{},[1924,4008,4009,1889,4012,1889,4015,1947,4018,4021],{},[1886,4010,4011],{},"uv run",[1886,4013,4014],{},"poetry run",[1886,4016,4017],{},"ip netns exec",[1886,4019,4020],{},"ssh-agent"," with a command.",[1924,4023,4024,4025,4028,4029,1889,4032,1889,4035,1889,4038,1889,4041,1947,4044,2130,4047,2086,4050,2335],{},"sed's ",[1886,4026,4027],{},"e"," command and flag, ",[1886,4030,4031],{},"man -P",[1886,4033,4034],{},"zip -TT",[1886,4036,4037],{},"tcpdump -z",[1886,4039,4040],{},"wget --use-askpass",[1886,4042,4043],{},"nc -e",[1886,4045,4046],{},"socat",[1886,4048,4049],{},"EXEC:",[1886,4051,4052],{},"SYSTEM:",[1924,4054,4055,4057,4058,2086,4061,4063],{},[1886,4056,3169],{}," with a variable, ",[1886,4059,4060],{},"--eval",[1886,4062,2144],{}," on its command line.",[1924,4065,4066,2130,4069,2086,4072,2284,4075,2086,4078,4081,4082,4085],{},[1886,4067,4068],{},"go",[1886,4070,4071],{},"-exec",[1886,4073,4074],{},"-toolexec",[1886,4076,4077],{},"go run",[1886,4079,4080],{},"go tool"," of a module at a version such as ",[1886,4083,4084],{},"example.com\u002Fx@latest",", which is fetched and run.",[1924,4087,4088,1889,4091,1889,4094,1889,4097,1947,4100,2335],{},[1886,4089,4090],{},"cargo --config",[1886,4092,4093],{},"rg --pre",[1886,4095,4096],{},"rg --hostname-bin",[1886,4098,4099],{},"fd -x",[1886,4101,4102],{},"fd -X",[1855,4104,4105,4106,1947,4109,2335],{},"A word straight after an option may be its value. The reader therefore looks past it for the subcommand, as in ",[1886,4107,4108],{},"go -C . run",[1886,4110,4111],{},"npm --prefix . exec",[3564,4113,4115],{"id":4114},"containers-and-remote-execution","Containers and remote execution",[1855,4117,2507,4118,1889,4121,1947,4124,4127],{},[1886,4119,4120],{},"docker",[1886,4122,4123],{},"podman",[1886,4125,4126],{},"nerdctl",", the reader asks about:",[3572,4129,4130,4140],{},[3575,4131,4132],{},[3578,4133,4134,4137],{},[3581,4135,4136],{},"Form",[3581,4138,4139],{},"What it can run or expose",[3588,4141,4142,4169,4179,4207,4217],{},[3578,4143,4144,4166],{},[3593,4145,4146,1889,4149,1889,4151,1889,4154,1889,4157,1889,4160,1889,4163],{},[1886,4147,4148],{},"run",[1886,4150,2179],{},[1886,4152,4153],{},"create",[1886,4155,4156],{},"start",[1886,4158,4159],{},"restart",[1886,4161,4162],{},"restore",[1886,4164,4165],{},"debug",[3593,4167,4168],{},"A container's command, with any host files it mounts.",[3578,4170,4171,4176],{},[3593,4172,4173],{},[1886,4174,4175],{},"attach",[3593,4177,4178],{},"Standard input sent to a container's main process.",[3578,4180,4181,4204],{},[3593,4182,4183,1889,4186,1889,4189,1889,4192,1889,4195,1889,4198,1889,4201],{},[1886,4184,4185],{},"compose",[1886,4187,4188],{},"service",[1886,4190,4191],{},"stack",[1886,4193,4194],{},"plugin",[1886,4196,4197],{},"kube",[1886,4199,4200],{},"play",[1886,4202,4203],{},"pod",[3593,4205,4206],{},"Commands managed through these interfaces.",[3578,4208,4209,4214],{},[3593,4210,4211],{},[1886,4212,4213],{},"--config",[3593,4215,4216],{},"The folder from which the tool's own plugins run.",[3578,4218,4219,4229],{},[3593,4220,3988,4221,2130,4224,2086,4226],{},[1886,4222,4223],{},"build",[1886,4225,2103],{},[1886,4227,4228],{},"--volume",[3593,4230,4231],{},"Build steps receive host folders.",[1855,4233,4234,4235,4238,4239,4242,4243,1947,4246,4249,4250,1889,4253,1889,4256,1889,4259,1889,4262,1889,4265,1947,4268,2335],{},"Podman's ",[1886,4236,4237],{},"unshare"," runs a command on the host; ",[1886,4240,4241],{},"runlabel"," runs the command an image's label holds; ",[1886,4244,4245],{},"machine",[1886,4247,4248],{},"auto-update"," can run a newer image's command. These ask too, as do its global options that name a program run for any subcommand: ",[1886,4251,4252],{},"--runtime",[1886,4254,4255],{},"--runtime-flag",[1886,4257,4258],{},"--conmon",[1886,4260,4261],{},"--network-cmd-path",[1886,4263,4264],{},"--hooks-dir",[1886,4266,4267],{},"--module",[1886,4269,4270],{},"--storage-opt",[1855,4272,4273,4274,1947,4277,2284,4280,1947,4283,2130,4286,1889,4288,1889,4290,1889,4292,1889,4294,2086,4297,1889,4299,4301,4302,2658,4304,4307,4308,2335],{},"It also asks about ",[1886,4275,4276],{},"docker-compose",[1886,4278,4279],{},"podman-compose",[1886,4281,4282],{},"kubectl",[1886,4284,4285],{},"oc",[1886,4287,2179],{},[1886,4289,4175],{},[1886,4291,4165],{},[1886,4293,4148],{},[1886,4295,4296],{},"rsh",[1886,4298,3182],{},[1886,4300,4153],{}," of a job, a cron job or a deployment (its image's command runs, as with ",[1886,4303,4148],{},[1886,4305,4306],{},"--kubeconfig"," (which may name a program that gets credentials) or kustomize's exec and helm options, ",[1886,4309,4310],{},"oc login --exec-plugin",[3564,4312,4314],{"id":4313},"languages-with-shell-escapes","Languages with shell escapes",[1855,4316,4317],{},"The reader asks about shell escapes in languages with their own commands. It checks their words, here-documents, here-strings and here-text supplied through a descriptor. It also asks when their text is unseen: another command pipes it in, a file supplies standard input, or the command names a script file.",[1855,4319,4320,4321,1889,4324,1889,4327,1889,4330,1889,4333,1889,4336,1889,4339,1889,4342,1889,4345,1947,4348,4351,4352,1889,4355,1889,4358,1947,4361,4364],{},"This applies to ",[1886,4322,4323],{},"psql",[1886,4325,4326],{},"usql",[1886,4328,4329],{},"mysql",[1886,4331,4332],{},"mariadb",[1886,4334,4335],{},"sqlite3",[1886,4337,4338],{},"duckdb",[1886,4340,4341],{},"lftp",[1886,4343,4344],{},"dc",[1886,4346,4347],{},"ed",[1886,4349,4350],{},"m4",". Commands such as ",[1886,4353,4354],{},"psql -f schema.sql",[1886,4356,4357],{},"mysql db \u003C dump.sql",[1886,4359,4360],{},"m4 file.m4",[1886,4362,4363],{},"echo .tables | sqlite3 db"," ask, whereas an interpreter's script file does not. These languages are checked for escapes, and unseen text may contain any of them.",[1855,4366,4367],{},"The escape list is a best effort:",[1921,4369,4370,4405,4423,4452,4478],{},[1924,4371,2507,4372,1947,4374,2775,4376,2332,4379,4381,4382,1889,4384,2086,4387,4390,4391,1889,4394,4397,4398,4401,4402,2335],{},[1886,4373,4323],{},[1886,4375,4326],{},[1886,4377,4378],{},"\\!",[1886,4380,1946],{}," target of ",[1886,4383,2150],{},[1886,4385,4386],{},"\\o",[1886,4388,4389],{},"\\g"," after options or a newline, ",[1886,4392,4393],{},"\\copy",[1886,4395,4396],{},"\\i",", an editor, a backquote, ",[1886,4399,4400],{},"\\setenv"," for its pager or editor, and the word ",[1886,4403,4404],{},"PROGRAM",[1924,4406,4407,4408,4410,4411,1889,4414,1889,4417,1947,4420,4422],{},"For the ",[1886,4409,4329],{}," client: ",[1886,4412,4413],{},"system",[1886,4415,4416],{},"pager",[1886,4418,4419],{},"edit",[1886,4421,2667],{}," with their backslash forms, and options naming a pager, option file or plugin.",[1924,4424,2507,4425,2775,4427,1889,4429,1889,4432,1889,4434,1889,4436,1889,4439,2332,4441,4444,4445,4448,4449,4451],{},[1886,4426,4341],{},[1886,4428,1954],{},[1886,4430,4431],{},"shell",[1886,4433,1946],{},[1886,4435,2667],{},[1886,4437,4438],{},"module",[1886,4440,4419],{},[1886,4442,4443],{},"connect-program"," setting and ",[1886,4446,4447],{},"mirror --on-change",". Each counts with any prefix ",[1886,4450,4341],{}," accepts and with quotes anywhere in the word.",[1924,4453,2507,4454,1947,4456,2775,4458,1889,4461,4464,4465,1947,4468,4471,4472,1947,4475,2335],{},[1886,4455,4335],{},[1886,4457,4338],{},[1886,4459,4460],{},".shell",[1886,4462,4463],{},".system"," and similar commands, including accepted prefixes, preceding space and quoted dot-command names; ",[1886,4466,4467],{},"load_extension",[1886,4469,4470],{},"edit()","; and DuckDB's ",[1886,4473,4474],{},"LOAD",[1886,4476,4477],{},"INSTALL",[1924,4479,2507,4480,2775,4482,1889,4485,1889,4488,1947,4491,4494,4495,4498,4499,2335],{},[1886,4481,4350],{},[1886,4483,4484],{},"syscmd",[1886,4486,4487],{},"include",[1886,4489,4490],{},"sinclude",[1886,4492,4493],{},"undivert",", including their ",[1886,4496,4497],{},"m4_"," forms under ",[1886,4500,2085],{},[3564,4502,4504],{"id":4503},"configuration-that-runs-code-later","Configuration that runs code later",[1855,4506,4507,4508,4510,4511,1947,4513,4515,4516,1947,4519,4522,4523,4526,4527,4530,4531,1889,4534,1889,4537,1947,4539,4515,4541,4543,4544,1889,4547,1889,4550,1947,4553,2151,4556,1889,4559,1889,4562,1889,4565,1889,4568,1889,4571,4574,4575,4578,4579,2658,4582,1889,4585,1947,4588,1947,4591,2284,4594,2335],{},"Commands that keep a program in configuration for a later command to run ask as ",[1886,4509,3430],{}," does: ",[1886,4512,4282],{},[1886,4514,4285],{}," ",[1886,4517,4518],{},"config set",[1886,4520,4521],{},"config set-credentials"," with its ",[1886,4524,4525],{},"--exec-"," options (both read an option's underscores as dashes, so ",[1886,4528,4529],{},"--exec_command"," is one too), ",[1886,4532,4533],{},"go env -w",[1886,4535,4536],{},"npm",[1886,4538,3954],{},[1886,4540,3957],{},[1886,4542,4518],{}," (with npm's ",[1886,4545,4546],{},"c",[1886,4548,4549],{},"con",[1886,4551,4552],{},"conf",[1886,4554,4555],{},"confi",[1886,4557,4558],{},"config",[1886,4560,4561],{},"npm set",[1886,4563,4564],{},"--script-shell",[1886,4566,4567],{},"--node-gyp",[1886,4569,4570],{},"--userconfig",[1886,4572,4573],{},"--globalconfig",", each behind any number of dashes as npm reads it, pnpm's ",[1886,4576,4577],{},"--config.\u003Cname>"," and yarn's ",[1886,4580,4581],{},"--use-yarnrc",[1886,4583,4584],{},"gh config set",[1886,4586,4587],{},"gh alias set",[1886,4589,4590],{},"import",[1886,4592,4593],{},"gh extension",[1886,4595,4596],{},"aws configure set",[1855,4598,4599,4600,2130,4603,1889,4606,1889,4608,1889,4610,2086,4612,1889,4615,1889,4618,4620,4621,1889,4623,1889,4626,1889,4629,2086,4631,4634,4635,4637,4638,4641,4642,1889,4645,1889,4648,1889,4651,1889,4654,4657,4658,1889,4661,1889,4664,1889,4667,4670,4671,2042],{},"Other program-launching options include ",[1886,4601,4602],{},"cmake",[1886,4604,4605],{},"-E",[1886,4607,2085],{},[1886,4609,2147],{},[1886,4611,3772],{},[1886,4613,4614],{},"--toolchain",[1886,4616,4617],{},"sort --compress-program",[1886,4619,2485],{}," with ugrep's ",[1886,4622,3666],{},[1886,4624,4625],{},"--pager",[1886,4627,4628],{},"--view",[1886,4630,4213],{},[1886,4632,4633],{},"-Q"," (a harness may run ugrep as ",[1886,4636,2485],{},") and ",[1886,4639,4640],{},"ug",", the editors (",[1886,4643,4644],{},"vim",[1886,4646,4647],{},"nvim",[1886,4649,4650],{},"vi",[1886,4652,4653],{},"ex",[1886,4655,4656],{},"emacs"," and the like, which run their startup files and the commands their options give), ",[1886,4659,4660],{},"toybox",[1886,4662,4663],{},"coreutils",[1886,4665,4666],{},"wsl",[1886,4668,4669],{},"powershell"," and the dynamic loader run by its path (",[1886,4672,4673],{},"ld-linux-x86-64.so.2 prog",[1855,4675,4676,4677,1889,4680,1889,4683,1889,4686,1889,4689,1889,4692,4695,4696,2086,4699,4702],{},"The reader also asks about a program named by a link that may be any program, a shell among them (",[1886,4678,4679],{},"\u002Fproc\u002Fself\u002Fexe",[1886,4681,4682],{},"\u002Fproc\u002F\u003Cpid>\u002Fexe",[1886,4684,4685],{},"\u002Fproc\u002Fself\u002Ffd\u002F0",[1886,4687,4688],{},"\u002Fdev\u002Ffd\u002F3",[1886,4690,4691],{},"\u002Fdev\u002Fstdin",[1886,4693,4694],{},"\u002Fproc\u002Fself\u002Fmap_files\u002F...",", whatever is read through a descriptor, and ",[1886,4697,4698],{},".\u002Fexe",[1886,4700,4701],{},".\u002F3"," from a folder the reader cannot tell).",[3564,4704,4706],{"id":4705},"environment-that-loads-code","Environment that loads code",[1855,4708,4709,4710,1889,4713,1889,4716,4719,4720,1889,4722,1889,4725,2034,4728,3817,4731,1889,4734,1889,4737,1889,4740,4743,4744,4746,4747,4750,4751,1889,4754,1947,4757,4760,4761,1889,4764,1889,4767,1889,4770,4773,4774,1889,4777,1947,4779,4781,4782,1889,4784,1889,4786,1947,4788,4790,4791,1889,4794,1889,4797,1889,4800,2658,4803,1889,4806,1947,4809,4812,4813,1889,4816,1889,4819,1889,4822,1889,4825,1947,4828,2042],{},"The reader asks about environment names that make a program load code (",[1886,4711,4712],{},"ZDOTDIR",[1886,4714,4715],{},"XDG_CONFIG_HOME",[1886,4717,4718],{},"GOFLAGS"," naming a program, such as ",[1886,4721,4074],{},[1886,4723,4724],{},"RUSTC_WRAPPER",[1886,4726,4727],{},"RUSTFLAGS",[1886,4729,4730],{},"CARGO_",[1886,4732,4733],{},"JAVA_TOOL_OPTIONS",[1886,4735,4736],{},"GCONV_PATH",[1886,4738,4739],{},"PERL5DB",[1886,4741,4742],{},"CC"," and the other compilers ",[1886,4745,3169],{}," runs, ",[1886,4748,4749],{},"CFLAGS"," and the other compilers' flags, ",[1886,4752,4753],{},"CCACHE_PREFIX",[1886,4755,4756],{},"GNUMAKEFLAGS",[1886,4758,4759],{},"MAKEFILES"," beside ",[1886,4762,4763],{},"MAKEFLAGS",[1886,4765,4766],{},"KUBECONFIG",[1886,4768,4769],{},"DOCKER_HOST",[1886,4771,4772],{},"RIPGREP_CONFIG_PATH",", the pagers and editors of ",[1886,4775,4776],{},"gh",[1886,4778,4323],{},[1886,4780,4282],{},", the folders ",[1886,4783,4341],{},[1886,4785,4329],{},[1886,4787,4332],{},[1886,4789,4323],{}," read their startup files from (",[1886,4792,4793],{},"LFTP_HOME",[1886,4795,4796],{},"MYSQL_HOME",[1886,4798,4799],{},"MARIADB_HOME",[1886,4801,4802],{},"PGSYSCONFDIR",[1886,4804,4805],{},"OPENSSL_CONF",[1886,4807,4808],{},"OPENSSL_ENGINES",[1886,4810,4811],{},"OPENSSL_MODULES",", which load code into any program that uses OpenSSL, ",[1886,4814,4815],{},"CURL_HOME",[1886,4817,4818],{},"BUNDLE_GEMFILE",[1886,4820,4821],{},"STRIPBIN",[1886,4823,4824],{},"CONTAINERS_CONF",[1886,4826,4827],{},"CONTAINERS_STORAGE_CONF",[1886,4829,4830],{},"SSH_SK_PROVIDER",[1855,4832,4833],{},"This list cannot be complete: any program may run a command it is given, and one the reader does not know is read as that program alone.",[2642,4835,4837],{"id":4836},"parser-bounds","Parser bounds",[1855,4839,4840],{},"The reader asks about work past any of these bounds:",[1921,4842,4843,4846,4849,4852,4855,4858],{},[1924,4844,4845],{},"65,536 characters in the command, or 65,536 characters parsed in all.",[1924,4847,4848],{},"5,000 commands.",[1924,4850,4851],{},"16 programs in one command, counting its wrappers and the program it runs.",[1924,4853,4854],{},"200,000 reading steps. A pattern costs a step for each character every time a path holds it.",[1924,4856,4857],{},"Commands reading the output of 20,000 commands in all.",[1924,4859,4860],{},"Shells and substitutions nested 12 deep.",[1855,4862,4863],{},"A word or value grown by variables assigned to one another also stops at 65,536 characters, before the reader builds more of it. This keeps time and memory proportional to the command.",[1859,4865,4867],{"id":4866},"decisions-for-an-unreadable-command","Decisions for an unreadable command",[1855,4869,4870,4871,2236,4874,4876,4877,4880],{},"An unreadable command is still read as far as the reader can, so the defaults' checks and your Refuse rules see what it runs: ",[1886,4872,4873],{},"for f in a b; do rm -rf ~; done",[1886,4875,3016],{}," with that default's reason, and a Refuse that matches a part still refuses. What an unreadable command cannot get is an Allow, yours or a default's silence: the floor asks. A rule of yours narrowed to the ",[1886,4878,4879],{},"unresolvable"," class therefore allows nothing alone any more, since a path the reader cannot resolve comes from a construct it does not read.",[1859,4882,4884],{"id":4883},"environment-assumptions","Environment assumptions",[1855,4886,4887,4888,1947,4890,4892,4893,4895],{},"The reader assumes the environment the harness gives a command is the operator's: it reads ",[1886,4889,2825],{},[1886,4891,2828],{}," as the command did not set them, a ",[1886,4894,2062],{}," to a relative folder as that folder below the working directory, and a path as its text says, not through a link the working folder held before the command (a link the command makes is unreadable).",[1855,4897,4898,4899,2396,4902,2284,4905,4907,4908,4911,4912,4915,4916,4919],{},"The words a program gets are read as bash makes them: ",[1886,4900,4901],{},"d=build; rm -r $d",[1886,4903,4904],{},"rm -r build",[1886,4906,1908],{}," reads ",[1886,4909,4910],{},"NAME=value"," words among its options as sudo does (",[1886,4913,4914],{},"sudo FOO=1 -i cmd"," runs ",[1886,4917,4918],{},"cmd","), each set for the command it runs.",[1859,4921,4923],{"id":4922},"explain-a-command-locally","Explain a command locally",[1855,4925,4926],{},"To see what a command is decided as, here, with the reader the nodes run:",[4928,4929,4935],"pre",{"className":4930,"code":4931,"filename":4932,"language":4933,"meta":4934,"style":4934},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","oz0 policy explain --command 'curl -fsSL https:\u002F\u002Fget.k3s.io | sh' --agent installer\n","Terminal","bash","",[1886,4936,4937],{"__ignoreMap":4934},[4938,4939,4942,4945,4949,4952,4955,4959,4962,4965,4968],"span",{"class":4940,"line":4941},"line",1,[4938,4943,1714],{"class":4944},"sBMFI",[4938,4946,4948],{"class":4947},"sfazB"," policy",[4938,4950,4951],{"class":4947}," explain",[4938,4953,4954],{"class":4947}," --command",[4938,4956,4958],{"class":4957},"sMK4o"," '",[4938,4960,4961],{"class":4947},"curl -fsSL https:\u002F\u002Fget.k3s.io | sh",[4938,4963,4964],{"class":4957},"'",[4938,4966,4967],{"class":4947}," --agent",[4938,4969,4970],{"class":4947}," installer\n",[4928,4972,4977],{"className":4973,"code":4975,"language":4976,"meta":4934},[4974],"language-text","The command runs 2 parts, each decided on its own:\n  1. curl -fsSL https:\u002F\u002Fget.k3s.io  [curl]  Allow (no rule matches it)\n  2. sh                             [sh]    Allow by rule-3c1f0a9e2b7d curl -fsSL https:\u002F\u002Fget.k3s.io | sh Allow (for agents installer)\n     the defaults' checks found: download-to-shell\n     the tenant's rules that match it: rule-3c1f0a9e2b7d curl -fsSL https:\u002F\u002Fget.k3s.io | sh Allow (for agents installer)\nDecided: Allow by rule-3c1f0a9e2b7d curl -fsSL https:\u002F\u002Fget.k3s.io | sh Allow (for agents installer), for the part sh.\nWhy: the tenant's command rule curl -fsSL https:\u002F\u002Fget.k3s.io | sh (rule-3c1f0a9e2b7d) decides sh\n","text",[1886,4978,4975],{"__ignoreMap":4934},[1855,4980,4981,4984,4985,1947,4988,4991],{},[1886,4982,4983],{},"--cwd"," gives the session's working directory, which ",[1886,4986,4987],{},"[inside-workdir]",[1886,4989,4990],{},"[outside-workdir]"," read against; without it, a relative path that stays below the working directory is inside, and an absolute path is outside.",[4993,4994,4995],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":4934,"searchDepth":4997,"depth":4997,"links":4998},2,[4999,5000,5001,5002,5003,5004,5017,5018,5019],{"id":1861,"depth":4997,"text":1862},{"id":1877,"depth":4997,"text":1878},{"id":1918,"depth":4997,"text":1919},{"id":2225,"depth":4997,"text":2226},{"id":2425,"depth":4997,"text":2426},{"id":2636,"depth":4997,"text":2637,"children":5005},[5006,5008,5009,5010,5011,5012,5013,5014,5015,5016],{"id":2644,"depth":5007,"text":2645},3,{"id":2708,"depth":5007,"text":2709},{"id":2851,"depth":5007,"text":2852},{"id":3063,"depth":5007,"text":3064},{"id":3097,"depth":5007,"text":3098},{"id":3258,"depth":5007,"text":3259},{"id":3283,"depth":5007,"text":3284},{"id":3337,"depth":5007,"text":3338},{"id":3408,"depth":5007,"text":3409},{"id":4836,"depth":5007,"text":4837},{"id":4866,"depth":4997,"text":4867},{"id":4883,"depth":4997,"text":4884},{"id":4922,"depth":4997,"text":4923},"What the command reader understands for tenant admins and governance reviewers.","md",null,{"audience":5024,"doc_type":5025},"tenant admins and governance reviewers","reference",true,{"title":1219,"description":5020},"PymOL1szUv3KkYbDCQ6LUuk0Xzj5lLBAF_loUoYa3us",[5030,5032],{"title":1215,"path":1216,"stem":1217,"description":5031,"children":-1},"Command rule patterns for tenant admins and governance reviewers.",{"title":1223,"path":1224,"stem":1225,"description":5033,"children":-1},"Create a command rule from an approval for tenant admins and governance reviewers.",1794442965331]