Skip to main content
Opsh inspects every generated command and assigns it a risk level before displaying it to you. The risk level is shown alongside the command explanation and controls whether Opsh asks you to confirm, blocks execution entirely, or proceeds automatically in warp mode.

​
Safe

A command is classified as safe when no concerning patterns are detected. It contains no pipes, redirects, chaining, subshells, privileged execution, or destructive operations. In warp mode, Opsh auto-runs safe commands without pausing for confirmation.

​
Caution

A command is classified as caution when it contains one or more of the following:
  • A pipe (|)
  • Output redirection (> or >>)
  • Command chaining (&& or ||)
  • A subshell ($(...) or backtick substitution)
  • sudo (privileged execution)
  • mv (moves or renames files)
  • A package manager install (brew install, apt install, apt-get install, yum install, dnf install, pacman install, or apk install)
  • chmod or chown without the -R flag
Caution commands require confirmation before Opsh runs them. In warp mode, caution commands are auto-run without confirmation (the same as safe commands).

​
Dangerous

A command is classified as dangerous when it contains one or more of the following:
  • Any rm command (file removal)
  • Recursive permission change: chmod -R
  • Recursive ownership change: chown -R
  • Network output piped directly to a shell (e.g., curl ... | sh or wget ... | bash)
  • git reset --hard (discards uncommitted local work)
Dangerous commands require confirmation and are never auto-run by warp mode. Opsh prints a warning if warp mode is active and the command is dangerous.

​
Hard-blocked

A small set of commands are hard-blocked and cannot be executed under any circumstances, regardless of confirmation:
  • rm -rf / variants, including rm -rf --no-preserve-root
  • Fork bombs: :(){ :|:& };:
  • Filesystem format commands: mkfs.*
  • Direct disk writes via dd: dd ... of=/dev/sd* or of=/dev/disk*
Opsh prints an error and exits without executing when a hard-blocked pattern is detected.

​
Summary

If you want to review every command before it runs — regardless of risk level — type !print on in the REPL to enable print-only mode. Opsh will generate and display commands but never execute them.