Security

Change tracking

One call returns a command's exit code, its output and every file it changed.

What it is

One call returns a command's exit code, its output and every file it changed.

flash exec --changes runs a command and reports every file it added, deleted, renamed or modified. An agent learns what happened on disk without a second look.

Why it matters

An agent that runs a command wants three answers: did it work, what did it print, what did it change. One call delivers all three, so every step is accountable.

  • One round trip. Exit code, output and changes together.
  • Nothing hidden. Adds, deletes, renames and edits, all listed.
  • Built for agents. Structured JSON over CLI and MCP alike.

Runs on

  • Linux x86_64
  • Linux arm64
  • macOS
  • Windows x64
  • Windows arm64

How it works

Add one flag to any exec.

CLI

flash exec agent-1 --json --changes -- sh -c 'cd /work && sh build.sh'

MCP

flash_exec(vm_id: "agent-1", argv: ["sh", "-c", "cd /work && sh build.sh"], changes: true)

API

POST /v1/flashvm/guest/execs {"argv": ["sh", "-c", "cd /work && sh build.sh"]}
flash exec agent-1 --json --changes  →  {exit_code, stdout, stderr, changes}

The result

Did it work, what it printed, and what it changed: one call.

Every step an agent takes comes back as a complete, auditable record.

How it works

Related

See it live: flash demo run 4