Risk levels
Every command Opsh generates is assigned one of three risk levels: safe, caution, or dangerous. The level determines whether Opsh requires your confirmation before running the command and how warp mode behaves. See Command risk levels for a full breakdown of what triggers each level.Hard-blocked commands
Some commands are never executed, regardless of what you confirm. These match patterns that could cause irreversible, system-wide damage:
If a generated command matches one of these patterns, Opsh prints a warning and exits without executing anything. Confirming at the prompt has no effect.
Confirmation flow
By default (confirmByDefault: true), Opsh asks for your confirmation before running every command. If you set confirmByDefault: false, Opsh skips the prompt for safe commands but still confirms for caution and dangerous ones. Dangerous commands always require confirmation regardless of settings — they are never auto-run, even in warp mode. At the confirmation prompt you can:
- Press Enter or y to run the command
- Press n to cancel
- Press e to edit the command manually before running
- Press r to ask Opsh to regenerate a safer or simpler version
Print-only mode
To prevent Opsh from executing anything at all, enable print-only mode. Opsh will generate and display the command but stop before running it.- In the REPL, type
!print onto toggle print-only mode on - In one-shot mode, pass the
--print-onlyflag:opsh --print-only "list open ports"

