Fixed programs and parameters

Workflow

Prefer a native connector when it expresses the task. For a local program, specify an absolute executable path and separate arguments, constrain ordinary parameters and declare credential slots. Secrets may be injected by stdin, a temporary environment, a separate argument or a managed temporary file; each has distinct exposure risks.

Boundary and checks

The approval UI shows the exact operation snapshot. Output filtering handles bound secret values and supported encodings, but is neither universal secret detection nor a sandbox; arbitrary code under the same OS account may bypass application controls.

One-off drafts and reusable templates

A one-off command does not need a saved template. The AI reads the non-secret catalog, selects an existing secure terminal and submits an absolute program path, separate arguments, working directory and {{secret:slot}} placeholders. A draft accepts one approval request and becomes inactive after completion, rejection, expiry or revocation. A user may explicitly save a stable operation as a template; future uses require fresh authorization.

Templates can also define ordinary string, integer or boolean parameters, with {{param:name}} occupying a complete argument item. Ordinary values and defaults are stored in SQLite and the approval snapshot, so they must not contain secrets. The broker does not recursively expand parameters or invoke a shell for them. A user-chosen shell or interpreter can interpret its own inputs and needs careful review.

Choose the injection method

Method	Consideration
Standard input	Generally preferred; one stdin secret slot per command
Child environment	Limited to this invocation but observable to same-user debugging tools
Separate argument	May be visible through process inspection; never concatenate it into ordinary text
Managed temporary file	Program receives a private path; broker attempts cleanup after success, failure or cancellation

Longer non-secret input may use stdin_content up to 32 KiB UTF-8, but not together with a stdin credential slot. The approval page displays the full content for review. A run returns state, exit code, filtered output and truncation information. Exit code zero alone does not prove the business goal was met. After uncertain cleanup, timeout or connectivity, check existing records and the target before repeating.

Next: secure terminals · authorization.