Current limitations

Commands and started programs run non-interactively (no stdin). Drive GUI apps with the screenshot and UI automation tools instead.
A program that detaches itself from its process tree (setsid, daemonising, or on Windows CREATE_BREAKAWAY_FROM_JOB) is beyond the reach of stop_process and run’s timeout.
Started programs belong to the agent: the connector and any paired bridge can see and stop them, and they stop when the agent stops.
Output is decoded as UTF-8. Non-ASCII output from Windows tools using a legacy code page may appear garbled.
read_file is for text. Binary content is returned with invalid bytes replaced.
write_file takes text only. There’s no way to send a binary file or a file from your own machine through the connector yet. In Direct mode, dashcat-bridge push does it: you run it yourself (or approve it when your AI client runs it), so the bridge never reads local files on an AI’s behalf.
A push larger than 4 MiB is written in pieces. When it creates or replaces a file, the pieces go to a hidden file beside it, which replaces the file in one step once the last piece lands. Appending in pieces adds to the file as each piece arrives.
Commands run with the permissions of the user running dashcat-agent, not as administrator or root. Use sudo where the node allows it without a password.
The dashboard doesn’t show what your AI did yet. Each node keeps its own activity log.
Permissions set to ask are answered from the tray icon’s menu, not a dialog. Without a tray icon (over SSH, --no-tray, a machine with no desktop), nobody can answer, so the request is refused.
On Windows, an agent started at login or by double-click has no console, so its own log (not the activity log) isn’t kept. Start it from a terminal to see it.