# Let Your Employee Run Terminal Commands

Once you pair the Sista desktop app, your employee can run real shell commands on your machine: git, npm, brew, ls, grep, and anything else you'd type yourself. Commands run as your own user with no privilege escalation, and a hard-coded blocklist rejects destructive patterns like rm -rf /, disk formatting, or piping a remote script into a shell before they ever execute.

Terminal execution lets your AI employee run real shell commands on your machine: git, npm, brew, grep, and the rest of the toolchain you live in. Describe the outcome, and the employee handles the commands, flags, and order of operations, running through the same shell you would (/bin/sh on Mac and Linux, cmd on Windows), as your own user account, in your home directory by default.

It is a developer's delegation channel. Clone and set up a repo, chase a failing build, batch-process files, or audit disk usage without typing a single command yourself, and read back exactly what ran, its exit code, and its output.

Safety is structural, not contractual, and that is what separates it from an AI that merely suggests commands for you to paste. Destructive patterns like rm -rf on root or home paths, disk formatting, service tampering, and fork bombs are hard-blocked inside the desktop companion app itself, before the shell ever sees them, so the dangerous category of mistake is mechanically unavailable rather than merely discouraged by a prompt.

All of this runs through the desktop companion app, which you install once and pair with your account. Commands travel from your employee to that app and execute there, on your machine, with your tools and your configuration. If the app is closed or the laptop is asleep, the employee tells you it cannot reach your computer and asks you to open it, rather than reporting work that never happened.

The companion's file access is bounded to your home directory. Every path is resolved before anything is read or written, and one that lands outside home is refused, including a path that tries to climb out through a parent folder or a symlink. Reads and writes are size limited and directory listings are capped, so one stray command cannot pull your entire disk into a conversation.

Nothing runs with elevated privileges. Commands execute as your own user account, and sudo or su is rejected outright instead of being attempted and failing somewhere awkward. Between that, the blocked patterns, and the home directory boundary, the shape of the limit is easy to hold in your head: your files, your user, your machine, and a short list of things that will never run at all.

## Can AI Run Terminal Commands Safely?

Yes, with the right boundaries, and the boundaries here are enforced in the companion app rather than promised in a prompt. Commands matching a blocked pattern are refused before execution regardless of how the request was phrased or what the model intended, and sudo or su is rejected outright: elevated commands are never run automatically, full stop.

Everything else runs in the open. Each command, its exit code, and its output are part of the visible work record, so reviewing the employee's terminal work is the same as reading a shell session line by line.

## Your Toolchain, Operated for You

The employee works with the tools already installed on your machine, in your environment, with your configuration. That means real git history, real package installs, and results identical to what you would get typing the commands yourself.

Multi-step operations hold together: check out a branch, install dependencies, run the tests, summarize the failures. You ask for the outcome; the employee walks the steps and reports back with the evidence.

## The Limits: Timeouts, Output Size, and What's Blocked

Each command gets 30 seconds by default, extendable up to a 120-second ceiling the employee can request but never exceed; a command still running past that is killed and reported as timed out, with a nudge to break the task into smaller steps. Output is capped at 100KB per stream, so a runaway log dump gets truncated rather than flooding the conversation.

The block list targets specific, unambiguous patterns rather than broad categories: recursive deletes at root or home, disk-format and block-device commands (mkfs, dd, diskutil erase), fork bombs, power-state changes (shutdown, reboot, halt), piping a remote script into a shell (curl | sh and its variants), tampering with SSH keys or AWS credentials, stopping system services, opening a listening network socket, and force-pushing over git history. Everything else your normal shell would allow, it allows too.

## From Chore to Sentence

A surprising amount of technical friction is command-line errands: the dependency upgrade, the log file to grep, the disk space mystery. Each is a small interruption that costs context. Delegating them as plain-language requests keeps you in your actual work.

For non-developers, the terminal stops being a wall. The power of the command line becomes available through conversation, with the blocked-pattern layer standing between enthusiasm and disaster.

## How It Works

**Plain-language requests become shell commands, with destructive patterns hard-blocked.**

Delegate an outcome and the employee composes and runs the commands on your machine through the companion app: git, package managers, build tools, file utilities. Each command and its output is recorded in the visible work log.

The companion enforces the safety boundary mechanically. Destructive patterns, rm -rf on root paths, sudo, dd, reboots, and fork bombs, are refused before execution no matter how the request was phrased.

The app has to be running and paired for any of this to happen, which is the practical on and off switch: close it and the employee simply reports that your machine is not reachable. Pairing belongs to your account and is shared across your employees, while the capability itself is enabled per employee, so the one doing technical work can have it while the rest do not. The desktop app runs on macOS, Windows, and Linux.

## Use Cases

### Repo setup while you get coffee

Clone, install, configure, and verify, reported back with the output to prove it.

### Build failures get chased

The employee reruns, reads the logs, and reports the failing step with context.

### Disk space mysteries solved

The usual hunt through disk usage output becomes a delegated question.

### Non-developers run safe commands

The command line becomes available through conversation, with the dangerous category walled off.

### Given to one employee, withheld from the rest

The capability is enabled per employee, so the one doing technical work has it and nobody else does.

## Comparison

| Before | After |
|---|---|
| Terminal errands interrupt deep work. | Errands are delegated in plain language. |
| AI suggests commands for you to paste. | The employee runs them and shows the output. |
| One wrong flag can be catastrophic. | Destructive patterns are blocked mechanically. |
| The terminal is for developers only. | The toolchain answers to conversation. |

## FAQ

### What commands can the AI employee run?

Standard shell commands available on your machine, including git, package managers, and file utilities. It composes the right commands from your plain-language request, running in your home directory unless it specifies another folder that already exists.

### What stops it from running something destructive?

The companion app hard-blocks specific destructive patterns, such as rm -rf on root or home paths, disk-format commands, fork bombs, and shutdown/reboot, before execution. Sudo and su are rejected outright regardless of the command. The block is mechanical, not model judgment, so it holds even if the request was phrased to disguise intent.

### Is there a time or output limit?

Yes. Commands get 30 seconds by default and can run up to 120 seconds if the employee asks for more time; anything longer is killed and reported as timed out. Output is capped at 100KB per stream, with anything beyond that truncated rather than dropped.

### Can I see what was executed?

Yes. Every command, its exit code, and its output are visible in the work record, so you can audit a session like reading a shell transcript.

### Do I need to be a developer to use terminal execution?

No. You describe outcomes in plain language and the employee handles the commands, though developers will recognize and appreciate exactly what it ran.

### Which plan includes terminal execution?

It requires the Founder plan or higher; it is not included on Free or Builder. The same requirement applies to file access and screen vision, since all three route through the same paired desktop companion app.

### Do I need to keep an app open on my computer for this to work?

Yes. Terminal commands run through the Sistava desktop companion app, so it has to be installed, paired, and running on the machine where you want the work to happen. If the app is closed or the machine is asleep, the employee tells you it cannot reach your computer instead of quietly skipping the task.

### Can the AI employee read or change files outside my home folder?

No. File access is bounded to your home directory. Every path is resolved before anything is read or written, and one that lands outside home is refused, including a path that tries to climb out through a parent folder or a symlink. Reads and writes are size limited and directory listings are capped as well.

## Where Let Your Employee Run Terminal Commands fits

Let Your Employee Run Terminal Commands is part of Where their work lives.

Your AI agents manage their own workspace. Scheduled tasks run daily, weekly, or on custom cron cadences. A built-in kanban board tracks what is in progress. Every document lands in a personal Drive. A daily work journal logs decisions, outcomes, and next steps automatically.

- [Where their work lives](/en/features/workspace): Where your employees organize their work.

## Read the guide

- [Guide: Let Your Employee Run Terminal Commands](/en/guide/equip/tools)

## More in Workspace

- [Move a Team Member to the Bench](/en/features/workspace/bench_team): Every workspace has one Bench: a holding area for employees who are not currently on a working team. Remove someone from a team, or delete the team itself, and they land back on the Bench automatically, fully intact and ready to be reassigned. Nothing about them is deleted; only their team membership changes.
- [Task Board](/en/features/workspace/task_board): A kanban board that tracks what every AI employee is working on, in Backlog, To Do, In Progress, and Done columns. Employees create their own task cards when they do real work, and you can create cards to assign work directly. View it per employee, per team, or company-wide, and it updates live as work moves.
- [Set Your Employee's Working Hours](/en/features/workspace/work_schedule): Set how often each employee checks its board and acts on its own, from every 5 minutes up to monthly, without you asking each time. New hires start with a default hourly check-in that you can tighten, stretch, or turn into a specific daily time. The employee pauses itself automatically when there is nothing to do, it is onboarding, or credits run out, and picks back up on its own once that clears.
- [Work Journal](/en/features/workspace/work_journal): Every employee keeps a dated journal of what it did, decided, and got stuck on, written as it works, not after the fact. Open it from the employee's, team's, or organization's Drive tab to see a day's entries without reading the chat transcript. Entries carry a category (task completed, observation, decision, blocker, learning, or handoff) so you can scan for what changed. It starts on hire with nothing to configure.
- [Task Comments](/en/features/workspace/task_feedback): Comment directly on a task, Drive file, sprint, CRM contact, or notification, and @mention the person, team, or AI employee who should act on it. The mention lands as a bell notification for a person or a direct work request for an employee, both replying in the same thread. Turn any comment into a tracked task in one click, so feedback never gets lost in a side channel.
- [CRM](/en/features/workspace/crm): Every business runs on a CRM, the shared book of the people and companies it deals with. Sistava builds one in, and your AI employees run it for you. They add a prospect the moment one comes up, keep contacts current, open deals and move them down the pipeline as they progress, and write notes so nothing is forgotten. You get one clean place to see who you know, what's in flight, and what it's worth, without paying for a separate CRM.
- [Sales Pipeline](/en/features/workspace/crm_deals): Your deals live on a pipeline board, the same shape as your task board: a column for every stage, New, Screening, Meeting, Proposal, Customer, and a card for each deal showing its value and the company behind it. As a deal gets closer to won, it moves down the board. Your AI employees keep the pipeline current, opening deals, moving stages, and updating amounts, so you always know what's in flight and what it's worth, at a glance.
- [Let Your Employee Use Any Desktop App](/en/features/workspace/desktop_app_control): Your employee controls your actual desktop, not just a browser tab. It clicks, types, manages files, and runs terminal commands in real applications on your machine, the same way you would sitting at the keyboard. It works through the free Desktop Companion app and covers native software, file management, and shell tasks in one capability.
- [Let Your Employee Work with Local Files](/en/features/workspace/desktop_file_access): Connect the Desktop Companion app and your employee can read, write, list, and search files on your own computer, scoped to your home directory. Ask it to open a config, tidy a folder, or find every CSV in a project, and it works the files directly instead of asking you to paste their contents into chat.
- [Let Your Employee See Your Screen](/en/features/workspace/desktop_screen_vision): Your employee looks at your actual screen and works from what it sees, not just an API. It captures your desktop through the Sista desktop app, reads the pixels the same way you would, and can click, type, and scroll based on what it finds. That covers any app you have open, including native software, dashboards, and design tools that never had an integration.
- [Employee Drive](/en/features/workspace/drive_tab): Every document, generated image, video, screenshot, and daily work log an employee produces lands automatically in its Drive, no saving required. Browse it per employee, per team, or company-wide, as a searchable flat grid or as folders. Files preview inline, from PDFs and spreadsheets to code and video, so you rarely need to download something just to read it. Every update becomes a numbered version that you can preview or restore without losing the original file.
- [Company Drive](/en/features/workspace/company_drive): Every employee keeps its own Drive, but you shouldn't have to open ten employees to find one file. Company Drive rolls every employee's Drive into one company-wide view: every document, transcript, and deliverable your whole workforce has produced, browsable and searchable from one tab.

## Explore

- [Every feature](/en/features)
- [Hire an AI employee](/en/market)
- [Pricing](/en/pricing)