Safety and limits

The local model never runs anything. It only returns edit blocks, and localexec decides whether they are allowed to touch your files.

Paths

Every path is resolved and must stay inside the project root. Symlinks that escape it are rejected.
allowed_paths limits what can be edited. ignore hides paths such as node_modules, .venv, build output, lockfiles and .env files: they cannot be read or edited.
Windows device names such as NUL and CON are rejected as task ids on every operating system, so behaviour is the same everywhere.

Nothing is deleted except files a task created, and only by revert_task.
If a file changes on disk while the model is working, the write is refused with changed on disk while the model was working and nothing is overwritten.
A failed multi-file write is rolled back, including directories it created. File permissions are kept.
Text goes through one reader: a BOM is stripped and restored, line endings are kept, and files that are not valid UTF-8 are refused rather than rewritten.
Task ids are limited to [A-Za-z0-9._-], 64 characters, so they cannot escape the state directory.

Only checks from your config run. They are argument lists with no shell, a timeout and stdin closed.
Treat .localexec.json like code you trust: its checks run on your machine. For that reason the project file cannot point at a non-local Ollama server.

implement_task, run_checks and revert_task are serialised by a lock. Read-only tools never wait.
Logs go to stderr, never stdout, which carries the MCP protocol.
A crashing tool returns a short JSON error, not a traceback.
The server never commits, amends or pushes. It reads git status and committed file contents only.

JavaScript and TypeScript line counting does not understand comment markers inside template literals.
Reverting a task that created a file leaves empty directories behind.
Task ids that differ only by case, such as T1 and t1, depend on whether the filesystem is case-sensitive.