Capability Map
| Capability ID | Label | Description | Commands | Platforms | Risk levels present | Maturity/status | Direct support | Direct flag policy | Network | Notes |
|---|---|---|---|---|---|---|---|---|---|---|
| archive_inspection | Archive operations | Inspect archives, extract them only to explicit destinations, and create tar.gz/zip archives only from explicit source paths. | tar, unzip, zip | all | safe, write | structured (normal executable support) | yes | explicit | no | Extraction without -d, overwrite flags, password handling, and arbitrary unzip options are not supported. Only tar -czf <archive_path> <source_paths...> is supported for tar.gz creation; broad roots, home roots, wildcards, path transforms, extraction without -C, and arbitrary tar options are not supported. Only zip -r <archive_path> <source_paths...> is supported; broad roots, home roots, wildcards, encryption, passwords, split archives, append/update flags, deleting sources, network destinations, and arbitrary zip options are not supported. Supports guarded zip archive creation from explicit source paths. Supports read-only tar archive listing, guarded extraction with an explicit destination, and guarded tar.gz creation from explicit source paths. Supports read-only zip archive listing and guarded extraction with an explicit destination. Tar archive creation is write-risk and may overwrite an existing archive path depending on the underlying tar implementation. Tar extraction is write-risk and can write or overwrite files in the destination. Zip archive creation is write-risk and may overwrite or update an existing archive path depending on the underlying zip implementation. Zip extraction is write-risk and can write or overwrite files in the destination. |
| destructive_operations | Destructive operations | High-risk operations that can remove data or escalate privileges. | rm, sudo | all | dangerous | blocked (unavailable) experimental-only (constrained executable fallback) | mixed | explicit | no | — |
| filesystem_inspection | Filesystem inspection | Inspect local files, folders, and metadata safely. | cd, du, file, find, ls, pwd, stat, tree | all | safe | direct-only (direct executable support only) structured (normal executable support) | yes | explicit safe_inspection_passthrough | no | Changes the oterminus working directory for the current REPL session. Requires the optional external tree executable.Supports one local path, hidden entries, directories-only output, and bounded depth. Supports read-only predicates: -name <pattern>, -type f |
| filesystem_mutation | Filesystem mutation | Create, copy, move, or modify files and directory state. | chmod, chown, cp, mkdir, mv, touch | all | dangerous, write | experimental-only (constrained executable fallback) structured (normal executable support) | yes | explicit | no | Creates a missing file or updates timestamps when the target already exists. |
| git_inspection | Git inspection | Read-only inspection of local Git repository state. | git | all | safe | structured (normal executable support) | yes | explicit | no | Only read-only Git inspection operations are supported in curated mode. |
| macos_desktop | macOS desktop integration | Open local paths in Finder or default macOS apps. | open | darwin | safe | structured (normal executable support) | yes | explicit | no | Opens a local file or folder via macOS LaunchServices. |
| network_diagnostics | Network diagnostics | Run constrained read-only diagnostics that contact external hosts. | curl, dig, nslookup, ping | all | safe | structured (normal executable support) | yes | explicit | yes | Only ping with a fixed count, HTTP HEAD requests, dig lookups, and nslookup lookups are supported. POST/PUT/PATCH/DELETE, request bodies, arbitrary or secret-bearing headers, authorization, cookies, downloads, redirects that write files, scanning, traceroute, SSH/SCP, netcat, nmap, wget, sudo network commands, and arbitrary network shell commands are not supported. This command contacts external hosts and may reveal your IP address, DNS query, target host, or network metadata. |
| process_inspection | Process inspection | Inspect running processes and open files. | lsof, pgrep, ps | all | safe | structured (normal executable support) | yes | explicit | no | Lists open files and sockets; output can expose sensitive process or path information. |
| project_health | Project health | Curated project maintenance checks for tests, lint, format checks, docs builds, and evals. | project_health | all | write | structured (normal executable support) | no | explicit | no | Always preview and require explicit user confirmation before execution. Arbitrary 'poetry run ...', install/update/deploy/publish commands, write-formatting, and arbitrary shell execution are not supported. Only curated operations are in scope: run_tests, lint_check, format_check, build_docs, run_evals. Project health operations may execute local project code or tooling (for example via test suites, docs builds, and eval workflows). |
| system_inspection | System inspection | Inspect local environment, identity, and system properties. | clear, df, env, man, uname, which, whoami | all | safe | structured (normal executable support) | yes | explicit | no | Clears the current terminal screen for a clean session view. Opens local manual documentation through the system pager. Printing the full environment may include sensitive values; curated mode only allows single-variable lookups. |
| text_inspection | Text inspection | Inspect, filter, and transform file text content. | cat, grep, head, sort, tail, uniq, wc | all | safe | structured (normal executable support) | yes | explicit | no | — |