Skip to main content
There are three ways an agent can start inside TYBA, and they don’t give you the same protection:

​
Typing claude turns the gate on

On Linux, in a bash or zsh shell with shell integration on (the default), typing claude with no arguments doesn’t start a raw agent. TYBA intercepts the command before the process is born and starts claude with the approval hooks, a filtered env and, when the folder allows it, a jail. Everything happens in the same pane: no button, nothing ended, no new session. The agent runs as a child of your shell — when it exits, you’re back at the prompt you typed from. The first time, a toast explains the change:
TYBA now jails + gates when you run claude. To run without it, use command claude.
Intercepting first is what makes this possible. The approval hooks and the jail are only set up at the moment the process is born; a claude that already started raw can’t have them attached afterwards. To get there first, shell integration defines a shell function called claude — type claude shows what it does.

​
When the jail kicks in

The gate always applies: a risky command asks for approval in any folder. The jail, which limits what the agent reads and writes, only kicks in when the folder is inside a git repository whose root is a visible folder in your home: In the other cases there is no safe root for the jail. Without a repository there is no boundary to draw; and a repository at your home, under a hidden folder or outside your home would put within the agent’s reach exactly what the jail protects — keys, tokens, other programs’ config. TYBA doesn’t fake protection: it starts with a gate and no jail, and says so in an amber strip at the top of the session:
claude is gated, but not jailed — the folder isn’t under a repo visible under home.
The same strip shows up when the system won’t let the jail be set up — no user namespaces, for instance. The gate still applies.
Without a jail, the agent has your user’s reach. The gate keeps asking for approval on risky commands, but whatever goes through without approval isn’t confined to a folder.

​
Running it without TYBA

Two ways, and both start the agent with no gate, as in a plain terminal:
  • command claude skips the function and runs the binary directly.
  • claude with any argument — claude --resume, claude -p "…" — also starts raw. Only a bare claude goes through the gate: arguments change how the agent starts, and TYBA doesn’t pass them into the protected path.
If TYBA can’t prepare the session (the app isn’t responding, the folder no longer exists), claude starts raw instead of not starting at all: a terminal that refuses to run what you typed is broken. In all these cases TYBA notices the ungated agent and warns you, as described below.

​
Where it doesn’t apply

  • Windows and macOS — typing claude in a shell doesn’t go through the gate.
  • fish, PowerShell and cmd — the function only exists in bash and zsh.
  • Shell integration off — the function isn’t installed, in zsh or in bash.
  • codex — only claude goes through the gate when typed.

​
Ungated agent: TYBA notices and warns you

When a known agent (claude, codex) starts running with no gate inside a shell session, an amber strip appears at the top of that session:
⚠ claude running without TYBA’s gate — no approval inbox, no sandbox [Reopen managed] [Ignore]
The strip is per session, not per window: if you have a split with two shells, only the one running the agent shows the warning.
Detection watches the terminal’s processes — it does not depend on shell integration. It works with zsh, bash, fish, and with claude installed through any path.

​
Reopen managed

The button takes the only path that exists for gating an already-running agent: it ends the raw process and starts a new one, managed, in the same folder. There is no way to inject the protections into a process that already started — the hooks are read when the agent boots. That is why it asks first. What happens:
1

Confirmation

TYBA tells you it is about to end the current agent. Nothing happens without your ok.
2

Surgical shutdown

Only the agent dies — SIGTERM, a moment of grace, SIGKILL for whatever is left. Your shell survives and returns to the prompt.
3

Managed session

A new session starts in the same folder, with inbox, sandbox and subagent capture.
The new session starts with no history. The raw agent’s conversation is not carried over. The transcript stays on disk: inside the new agent, use /resume to pick up where you left off.

​
When it can’t

The folder has to be a git repository. A managed session is repo-centric — that is what gives you the git panel, the diff and the jail’s reach. claude running in a folder with no git shows a clear error, and the warning stays put.

​
Ignore

Hides the warning for that process. A new agent in the same shell warns again — and reloading the window brings the warning back, deliberately: the session is still ungated, and TYBA will not pretend otherwise. What does not go away is the no gate badge in the session panel. As long as that agent runs unprotected, the badge stays. A claude that TYBA started with a gate doesn’t get the badge — jailed or not.

​
The Agents panel works in both cases

Subagents of a claude typed into a shell show up in the Agents panel, gated or not. With a gate, they arrive through the hooks, as in an agent session. Without one, TYBA reads the transcript from disk — it is the one protection that survives the raw path, and it is read-only: it shows what is happening, it does not intercept anything.

​
See also