From 87a9fb06cd0f647728f96b5d08f1ec53f282c803 Mon Sep 17 00:00:00 2001 From: piero-83 Date: Sun, 11 Oct 2026 11:18:49 +0200 Subject: [PATCH] docs: explain strict automation root arguments --- docs/control-protocol.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/control-protocol.md b/docs/control-protocol.md index 3c564457..39b02ce4 100644 --- a/docs/control-protocol.md +++ b/docs/control-protocol.md @@ -36,6 +36,11 @@ nowhere and Windows device names are refused. A root left out grants none of its existing folders, or the app doesn't start; without `--control` they are ignored. See `docs/mcp.md` › Confining file access for the details. +Each root flag may be given once; a command-line root overrides its environment default. Missing or +empty values, another option used as a value, and duplicate flags stop the desktop before it starts +any services, even without `--control`. For a folder name starting with `-`, use `--flag=-folder` +or the relative path `./-folder`. + What is confined: the requests themselves, the frames that carry input they inject (`ui.click`, `ui.key`, `ui.text`…, so a menu item an agent clicks is confined too), the background saves and exports they start, and window captures. The person at the keyboard is not: files opened from the command line, Finder or a