Security & limitations
Understand preview limitations, permissions, credentials, and data flow.
Development preview
v0.1.1 is intended for supervised evaluation, not unattended production operations. Use an isolated environment and non-sensitive sample data. Validate outcomes before acting on them.
Known limitations
| Area | v0.1.1 behavior |
|---|---|
| Protected-file search | Recursive search_text can bypass restrictions that direct file reads enforce. Disable it for evaluations that depend on protected-file boundaries. |
| Stream completion | An early EOF can be treated as a completed answer in the three provider adapters. Verify task output; do not equate model completion text with success. |
| Remote background completion | A headless client attached to a running engine may report completion while background work remains. |
| Upload persistence | Same-name uploads can overwrite earlier upload paths after restart. Use unique names and preserve original inputs. |
| Usage totals | Child-agent usage is not durably included in parent totals across restart. Counters are not a billing ledger. |
| Manual compaction | Stop does not cancel a manually started compaction; cancellation is tied to its caller. |
| Transcript viewing | The show command opens the store through a repair-capable path. Use the control API to observe active sessions. |
| Platform validation | All six targets build; native Linux/macOS behavior and interactive UI operation require environment-specific evaluation. |
Tool execution
run_command and external programs run with your operating-system user's permissions. File path checks are not a process sandbox. A command can read files or contact services your user can access.
permissions.run_command defaults to ask. Normal headless, terminal, and browser agent interfaces do not implement interactive approval yet, so ask refuses execution. Setting allow enables commands without per-call confirmation. The developer command tools run automatically grants approval callbacks; use it only for tools you intend to execute.
A small evaluation profile
{
"tools": { "enabled": ["view_file", "list_dir", "find_files"] },
"permissions": {
"run_command": "deny",
"read_outside_workspace": false,
"write_outside_workspace": false
}
}Use a dedicated workspace and user/container. Keep the agent home outside the workspace. This profile limits available tools but does not replace OS access controls.
Credentials and data flow
Use ZAGENT_API_KEY when keeping the engine key out of .env is appropriate. Engine-owned ZAGENT_* credential variables are scrubbed from child environments. Other inherited environment variables, files, tool configuration, and output may still contain credentials.
Model requests contain prompt content, tool results, and enabled attachments. These are sent to the endpoint you configure. Tools can send data to other services. Never enter provider credentials into this documentation website.
Local API
The control API binds to loopback and uses a process token with Host/Origin checks. Do not publish it directly to the internet. Its token is not a multi-user identity or client-tenant authorization system.
Release integrity
Verify package SHA-256 values before running the executable. Checksums detect differences from the published package; they are not code signing. Windows and macOS builds are unsigned; the macOS build is not notarized. No enterprise certification or uptime guarantee is claimed.