Files, tools, plugins and voice

A request is not a permission, and a successful-looking reply is not always evidence of an effect. Start with a small, named task, check the available tools, and ask the identity to report what actually happened. Features depend on this host and its installed components, not on what an example happens to mention.

Give files a bounded home

Use Settings → Sandbox to review HOME ROOT and EXTRA ROOTS. To widen access, enter an absolute directory under ADD A ROOT (ABSOLUTE PATH) and choose Add. Existing extra roots have a remove control. Wait for Sandbox roots saved. A disconnected request is not confirmation: after reconnecting, review the current list before retrying. Adding a root also widens the file world of plugins granted sandbox files.

Sources: sandbox-controls

Home-relative paths resolve under the identity's home; granted external folders need absolute paths. The filesystem tools still check protected substrate paths. A root grant does not authorize reading the private key or editing operator configuration. Built-in shell screening is best-effort, not a universal operating-system isolation guarantee.

Sources: file-and-shell-admission; protected-names

Illustrative, source-checked request—not an executed test: “Read the draft in the project folder I granted. Suggest changes first; do not edit it yet.” If access is refused, inspect the requested path and the saved roots. Do not treat a refusal as an invitation to bypass the boundary.

Distinguish tools from connections

Settings → Tools shows tool names, descriptions and enable switches. Disabling a tool is a human control, not something an identity can undo merely by asking.

Sources: tool-controls; tool-toggle

Plugin operations are discovered dynamically. An identity can inspect and offer an installed operation into its callable set; the release limits this set to eight. Offering is not installing, granting an account, or authorizing network access. Read the operation's effect class and receipt rule before relying on its answer. A plugin can disappear or become unavailable between discovery and dispatch.

Sources: discovery metadata and seat limit; receipt rules; model-facing schema; operation-admission

On the Plugins page, inspect the relevant card's GRANTED BY YOU section. Only declared capabilities have corresponding grant rows; read only restricts operations that write or execute. Save grants applies to the plugin's next call. Unless standing confirmation already applies, a confirmation-required operation proposes its exact arguments under AWAITING YOUR CONFIRMATION on the Plugins page. Confirm authorizes that proposed call once; Deny refuses it. Always runs it now and allows future calls of that operation without asking until you use revoke under GRANTED BY YOU. A proposal saying nothing has run is not completion; do not reissue it while awaiting confirmation.

Sources: plugin-grants-ui; operation-admission

Choose how conversation sounds

Before saving settings or enabling listening: saving can test the configured speech service with silence or “Ready.”, potentially making a network request and incurring charges. Obtain everyone’s consent before capturing room speech or using Meeting. Who is heard filters ordinary delivery; it does not stop microphone capture or delete withheld text, which can remain available through explicit recall. Off is not erasure. Review audio routes and privacy first. These are source findings, not observations of a running microphone.

Sources: Save-time checks

Settings → Speech contains Conversation, Who is heard, and engine settings. Save speech settings saves the form. The composer mode and settings describe the same identity-wide pair. Listening rules apply immediately; engine and echo changes apply to the next voice session.

Sources: speech-settings

The named pairs are explicit choices. An unset configuration instead resolves to interactive listening and automatic speaking; automatic is not the same as forcing spoken output. A mode value alone does not prove microphone capture is active.

Sources: voice-pairs; voice-default

Voice also needs an available engine or speech service, browser/device access and a working session. The browser requests microphone access; this documentation did not open one. Installed active engines may provide the default when no service is explicitly selected. Review the in-force readback rather than assuming every installation ships the same engine.

Sources: browser-capture-request; engine-selection; voice-availability

Next: Privacy and permissions explains what can leave the machine and which controls belong to you.

Confirmation controls: Confirm/Always/Deny, standing authorization and revoke.

Back to section overview · Documentation home