---
title: "Verified file execution"
description: "Run a script whose exact contents are reviewed before execution. Choose a local or server copy, check size and path limits, and understand standing approvals."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# Verified file execution

Use `alpacon exec --file PATH` when a reviewer needs to see the script you intend to run. The agent on the server checks the file against the reviewed contents before execution and refuses it if they differ.

## Run a script

`--file` names an absolute path on the server. Choose where the CLI reads the contents:

| Source | Example | What to prepare |
| --- | --- | --- |
| Same path on your machine | `alpacon exec --file /opt/check.sh my-server` | Matching local and server files |
| A different local path | `alpacon exec --file /opt/check.sh --file-from ./check.sh my-server` | A local copy matching the server file |
| Upload a local file first | `alpacon exec --file /opt/check.sh --file-from ./check.sh --upload my-server` | The local file; add `--overwrite` only to replace an existing server file |
| Read the server file | `alpacon exec --file /opt/check.sh --from-server my-server` | A readable file on the server |

The default interpreter is `/bin/bash`. Use `--interpreter` with an absolute path to choose another. Put script arguments after the server and `--`:

```bash
alpacon exec --file /opt/check.sh --file-from ./check.sh --interpreter /bin/sh my-server -- --summary
```

Do not put credentials in the script or its arguments. Have the script read them from an environment variable or a file already on the server. `--file` does not accept `--env`. See the [CLI reference](/reference/cli/exec/#verified-file-execution) for flag combinations and upload behavior.

## Limits

| Input | Limit |
| --- | --- |
| Script contents | Non-empty UTF-8, at most 65,536 bytes (64 KB) |
| Generated command line | 2048 characters for the interpreter, path, and arguments together |
| Script path | 1024 characters; absolute path |
| Interpreter | 256 characters; absolute path |
| Each argument | 1024 characters |
| Argument count | 64 |
| Proposed reuse duration | 1–366 days, within the workspace's ceiling |

See [file execution refusals](/use/work-sessions/commands/troubleshooting/#file-execution-refusals) if submission fails.

<span id="standing-approvals" />

See [approved file executions](/use/audit/approved-file-executions/) to review or revoke a standing approval.

## What file execution needs

The workspace must have AI review enabled, and the server must support checking the file before execution. Ask your administrator if either requirement is refused. With browser login, include `command` in the work session; `--upload` and `--from-server` also require file transfer (`webftp`). See [verified file execution](/reference/cli/exec/#verified-file-execution) for details.

Source: https://docs.alpacax.com/use/work-sessions/commands/file-execution/