RunorySee the exact command
Review the full command, why it is needed, and the risk and mutability assigned by Rust before execution.
AI TERMINAL AND AGENT RUNTIME
Let AI help investigate without taking over your server.
The conversational Agent iterates on real terminal results: understand the problem, propose one command, wait for your approval, execute in the bound session, review a sanitized result, and then decide what comes next. Skills and read-only MCP extend context; Incident, ChangeSet and Fleet stay on the structured safety chain. You choose Run or Cancel for every command.
01
ReasonOne command at a time
02
ExtendSkills / read-only MCP
03
EvidenceReal execution results
01
Core capabilities
Skills do not raise permissions
Skills such as Nginx Doctor and Website Troubleshooter only orchestrate existing tools; they cannot bypass Policy or approval.
Verify after a write
After a write or unknown command, a separately approved read-only verification must succeed before the Agent can finish.
02
In detail
01
Handle one explicit action at a time
Agent Runtime follows a Reason → Command Proposal → Approval → Terminal → Observation → Reason loop. The model proposes at most one non-interactive Linux command per turn, so a pre-generated queue cannot hide what intermediate results mean.
A failed command, policy block or user cancellation becomes another Observation. The Agent can explain it or seek an alternative without misrepresenting cancellation as infrastructure failure.
02
Rust decides risk and permission
A model's risk claim grants no authority. Rust classifies commands conservatively and blocks Critical commands. Approval binds the exact command hash, run, target, session and policy snapshot; changing any one invalidates the old approval.
React renders AgentEvent and sends user actions such as Run or Cancel. It does not own orchestration, shell execution, SSH handles, PTY injection or resume behavior.
03
Answer from evidence and keep structured capabilities bounded
Raw terminal output stays in the main Terminal. The Agent receives a bounded, sanitized Observation produced inside Rust, and a command card can carry no more than an 8 KiB preview. Read-only MCP extends external context; Incident, Operations Packs, ChangeSet, Verification and Rollback continue to use Native Typed Tools rather than a general shell IPC.
The interface shows concise progress, actions, evidence, diagnosis and a final answer. It does not expose or persist private chain-of-thought. Credentials, keys, passphrases and vault secrets never enter model context or audit data.
Frequently asked questions
Controlled AI
Does AI automatically run read-only commands?+
No. In Runtime V2, every command, including read-only commands, requires explicit approval.
Can I approve an entire command plan at once?+
The conversation loop does not use a fixed future queue. Each new command is proposed after reviewing the previous real result.
Is terminal output uploaded to the website?+
No. The web portal never receives SSH streams; the client Agent sees only a bounded, sanitized Observation from Rust.