Type what you want. Only what you installed can run.

What can run is the list you installed.

evoke show lists every reflex you installed, with its effect and the program it runs. A sentence is matched against that list, and «none of these» is always one of the answers. When nothing fits, nothing runs, and evoke prints the ranking so you can see why.

$ evoke "what time is it"
  none 0.70 · timer 0.20 · awake 0.05 · lock 0.05
  note, open and visit are inactive  →  evoke show
[2]

These lines are what evoke printed in its tests, replayed here. The classifier's answers were written for those tests, so your own numbers will differ.

Each input takes its value from one source.

The source is an option the author listed, or a word from your own list. It can also be a piece of what you typed, such as a number or a quoted phrase. Code finds that piece in the sentence, word for word. A number is also checked against its range, and a value outside it is asked for again.

$ evoke "set the volume to 150 percent"
  How loud, in percent?  150 percent is outside 0–100  > 40
  volume level="40"  0.93
volume set to 40%

A program runs with its arguments, never through a shell.

A reflex that wraps a command lists the program and its arguments. evoke starts that program directly, so no shell reads the values. A value that would start with a dash is refused before the program starts.

$ evoke run shout word=-n
  shout word="-n"
  running shout: word is "-n", which starts with -; an argv cannot carry it  →  evoke run shout word=-n
[1]

Reads and writes clear a bar. What cannot be undone always asks.

A decision's confidence is its least sure answer. A read runs at 0.6 or more, and a write at 0.8 or more. A read or a write under its bar asks first. A destructive reflex always asks, however sure, and no flag skips that question.

$ evoke "restart the computer"
  power action="restart" · destructive · weakest: route 0.97
  Really restart now?  [y]es [n]o [t]each > n
[2]

A sentence runs whole, or not at all.

A sentence can ask for two things. If one part matches no reflex, evoke refuses the sentence before anything runs. The part that did match does not run either. Once the steps start, one you decline or one that fails skips the steps after it. What already ran is not undone.

$ evoke "kill the lights in the den and feed the cat"
  1  lights room="den" state="off"  0.85
  2  "feed the cat" · no reflex
[2]

Only your sentence and its questions leave your machine.

For each decision, evoke sends one request to the classifier, with your own key. The request carries your sentence and the questions built from your installed manifests and your word lists. The values behind your words stay on your machine. Nothing else of yours is sent, and nothing goes to evoke.build.

What leaves your machine, in the privacy policy →

What this does not protect you from.

• A wrong reading. The classifier can pick the wrong reflex or the wrong option. evoke guarantees that every value is one the reflex allows. It cannot guarantee that it read you right. That is why the bar is set by what the program changes.
• What a program does. A reflex runs as you, and there is no sandbox yet. Read what you install.
• Exact text. A URL or a quoted phrase passes to the program as you typed it. What the program does with it is its author's promise.
• Programs nobody wrote. evoke runs only what someone wrote a reflex for.
• The network. Every new decision needs a request to the classifier and a key.

The security manual →

When a tool that writes commands fits better.

Sometimes you need a command you have never run, for a program nobody has wrapped. evoke cannot help there, because it only runs what is installed. A tool that writes the command for you to read fits that job. evoke fits the commands you run again and again, and the ones a teammate should run without guessing.