One page, every capability, stated as it actually behaves in the current release. Where something is not supported yet, that is stated too. AQORIN is a desktop console: it runs commands on the machine it is installed on, and only while it is open.
Whatever the mode, a command reaches the machine only through the same path: parsed, inspected, risk-scored locally, put to policy, and confirmed when policy says so. The mode in use is named on the main screen.
Describe what you want. The provider proposes one plan; AQORIN shows it as a card with the command, the explanation, the expected effect and its own risk calculation. You Run, Preview, Copy or Save it. Nothing runs on the provider's say-so.
Exact PowerShell, analysed before it runs: syntax, command availability, parameter checks, risk and policy. Read-only commands can be set to run without a prompt. Streaming output, cancellation, timeouts and output limits apply.
Plan, act, observe, repeat, within a step budget and a replan budget (12 and 2 by default). Every action is a tool call through the same inspection path. A goal that names a saved Operation or a module command outright is routed to it directly.
A command blocked only because it could not be inspected - a dynamic invocation such as & $tool - earns the Agent one rewrite attempt outside its budget, with the reason stated. A goal about AQORIN's own setup starts by reading what exists rather than guessing. A goal about timing - remind me in two minutes, every weekday at nine - becomes an Operation plus an AQORIN schedule; the Agent is told never to reach for Task Scheduler, cron or a background job for it.
AI risk labels are informational. Everything below happens locally, on the actual command text, whether it came from a provider, from the Agent or from your keyboard.
| Layer | What it does |
|---|---|
| AST analysis | Parses PowerShell into its syntax tree. Names every command, resolves aliases against the runtime that will run it, finds redirections, dynamic invocation, encoded commands, hidden windows and download-then-execute shapes. |
| Preflight | Refuses what cannot run before it runs: parse errors, missing commands, invalid parameters, and commands written for another platform - PowerShell 7 syntax on Windows PowerShell 5.1, Unix paths on Windows, Windows habits on Linux - with the line and the fix named. |
| Policy engine | Calculates risk (read-only, creates or copies data, modifies system, destructive, critical, blocked) and applies the configured decision per category: allow, confirm, strong-confirm or block. Three profiles - Cautious, Balanced, Generous - set a dozen knobs at once. |
| Provenance | Every command carries where it came from: typed by you, AI-generated, an AI repair, Agent-generated. Execution bridges from generated text to a running process can be confirmed or blocked separately. |
| Authorization gate | Every tool call passes one boundary that fails closed: a tool that does not declare itself read-only is approved before it changes anything. Only the command path may claim to authorize downstream, and a test names the files allowed to. |
| Destructive mismatch | A request to delete one kind of thing that would delete another - an Operation named "Trigger Notepad" versus its trigger - is refused before anyone is asked to approve it. |
| Secret redaction | API keys, tokens and credentials are redacted from provider context, saved sessions, history and notifications. Sensitive Operation parameters are stored as fingerprints, never as plaintext. |
| Execution controls | Real PowerShell process per command, streaming output, cancellation, per-class timeouts, output limits, and a lifetime guard that ends child processes with the application. |
| Audit trail | Every Agent run is recorded step by step: tool, command, provenance, calculated risk, policy decision, authorization outcome, observation and duration. Review Run shows it; interrupted runs are reported on the next start. |
An Operation is a saved goal or a saved command with a name, a description, parameters and budgets of its own. It can be run by hand, by a schedule, by a trigger, or by another Operation - and every run takes the same inspection path.
An agentic Operation works its goal out afresh each run. A locked Operation reruns the exact command a person reviewed, needs no provider, and is what lets work happen when nobody is watching. Parameters are declared, typed and filled in at run time.
One time, daily, weekdays, selected days, or every N minutes. Schedules that came due while AQORIN was closed do not fire a backlog at launch.
File created, changed or deleted in a folder; process started or exited; service state changed; free disk space below a percentage; CPU or memory above a percentage; a module watch above a value.
An unattended run that hits a confirmation stops - unless a person delegated authority in advance for exactly that Operation at exactly that revision. Change the Operation and the grant no longer covers it.
In-app notices and optional email on completed, failed, blocked or needs-authorization, and on a trigger firing when you ask. A new Operation reports every outcome of a run by default, so a scheduled check that says nothing cannot be mistaken for one that never ran. Runs you start yourself are not announced; you are watching them. What the command printed travels with the notice, bounded and redacted.
Manual, scheduled, triggered and nested runs in one tree with outcome, duration, steps and the audit record behind each.
A module is a folder with a module.json and the programs it names, dropped into AQORIN's modules directory. Nothing is loaded into the process: a module's commands run as ordinary child processes through the same inspection and policy as a typed command.
| Part | Behaviour |
|---|---|
| Manifest | An id, a name, commands and watches. A command names a literal program, its arguments one per entry with {placeholders}, and typed parameters with a pattern each value must match. The reader refuses anything malformed and lists every problem at once. |
| Approval | A person approves a module in Settings at exactly its content - a hash of every file in the folder. Change any file and it waits for approval again. Nothing in an unapproved module runs. |
| Commands | Offered to Agent Mode as capabilities named module-id/command. Each call becomes one literal, quoted PowerShell line, shown and confirmed like anything else. A value that fails its pattern is refused before anything runs. |
| Watches | A program whose last printed line is a number or a yes/no. A trigger of kind Module watch runs it on the module's interval and fires when the reading rises above the threshold. |
| Sample | samples/modules/weather.open-meteo ships with the program: one Python script, one command (current weather for a place), two watches (temperature, raining). Copy it in, approve it, ask for the weather. |
Modules are how AQORIN grows beyond PowerShell - an Arduino module wrapping the Arduino CLI, a router module wrapping a vendor API - without any change to AQORIN itself.
The provider is chosen in settings and applies to the next request, as do its key and model. Keys live in your local settings file, protected at rest, or in an environment variable. AQORIN bundles no AI credits.
| Provider | Environment variable | Notes |
|---|---|---|
| Mistral | MISTRAL_API_KEY | The shipped default. European hosting. |
| Groq | GROQ_API_KEY | Fast open-weight models. |
| Anthropic (Claude) | ANTHROPIC_API_KEY | Structured plan replies enforced through the tool schema. |
| Google Gemini | GEMINI_API_KEY | Free tier with rate limits. |
| OpenAI | OPENAI_API_KEY | Structured plan replies enforced through the tool schema. |
Every provider gets the same decision contract, the same capability list and the same one timeout - the configured one. Usage and estimated cost are recorded per run. A missing key is marked on the main screen before you type anything, with where to set it.
Headings, lists, tables, task lists, links, quotes and fenced code with syntax colouring for PowerShell, Python, JSON, Bash, C# and YAML. HTML is never rendered. Every card has a raw view and every code block a Copy button that copies the exact text.
Every card carries its date and time. Agent runs collapse to one card with their steps behind Expand; what a saved command printed appears in its notice. The mode badge says which mode was on. A command that exits cleanly but wrote errors is reported as completed with errors, not warnings, and AI Mode offers a diagnosis. A saved command run by hand says completed, failed or blocked, as it was.
Provider, model, run id, duration, budgets, and per step the command, provenance, calculated risk, policy decision, authorization outcome and observation. Where the answer and the record disagree, the record is shown beside it.
Cautious, Balanced and Generous set the agent budgets and policy decisions together; a search box finds any setting by name or by what it does, and every setting has a description. Changes go to your user override file; a retired setting leaves it on the next save.
Settings, Operations, schedules, triggers, runs, sessions, logs, modules and approvals under one folder in your local application data. AQORIN_DATA_DIRECTORY points the whole application elsewhere, for a portable copy or a clean first run.
Every write is atomic and keeps the previous file as .bak. A damaged store is refused rather than emptied, named on screen, and repaired with one press that restores the last good copy or sets the damaged file aside - never deletes it. Daily log and a crash log beside the data.
Skins: Neon, Arctic Pulse, Hazard Amber and others. Saved sessions are local and redacted, and can be reloaded on the next launch.