What it guarantees
The system enforces the jail
The jail is enforced by the kernel, not asked for in a prompt. A
bash -c the agent spawns inherits the same jail.Many at once, no trampling
One worktree per session. Agent A can’t see or clobber B’s tree, and neither touches your working copy.
Review before anything leaves
The diff is built from local
.git alone. The button that approves a push lives inside it.An inbox, not N terminals
You answer whoever is blocked, without babysitting whoever isn’t.
Where to start
Installation
macOS, Linux and Windows — plus the two things you install yourself: an agent and a git repo.
First session
What happens between describing the task and the code existing.
Risk classification
Exactly what goes through on its own and what waits for you.
Platforms
What the sandbox guarantees on each system — and where it guarantees less.