Skip to main content
There are two ways an agent can start inside TYBA, and they are not equivalent:
An agent typed into a shell runs with no gate: no approval for risky commands, no jail limiting what it reads and writes, no subagent capture. It has exactly the powers your shell has.
This is not a hole — it follows from where the protections live. The approval hooks and the jail are set up at the moment the process is born, and only TYBA knows how to set them up. A claude the shell started was already born without them.

​
TYBA notices and warns you

When a known agent (claude, codex) starts running inside a shell session, an amber strip appears at the top of that session:
⚠ Agent running without TYBA’s gate — no inbox, no sandbox, no subagent capture. [Reopen managed] [Ignore]
The strip is per session, not per window: if you have a split with two shells, only the one running the agent shows the warning.
Detection watches the terminal’s processes — it does not depend on shell integration. It works with zsh, bash, fish, and with claude installed through any path.

​
Reopen managed

The button takes the only path that exists for gating an already-running agent: it ends the raw process and starts a new one, managed, in the same folder. There is no way to inject the protections into a process that already started — the hooks are read when the agent boots. That is why it asks first. What happens:
1

Confirmation

TYBA tells you it is about to end the current agent. Nothing happens without your ok.
2

Surgical shutdown

Only the agent dies — SIGTERM, a moment of grace, SIGKILL for whatever is left. Your shell survives and returns to the prompt.
3

Managed session

A new session starts in the same folder, with inbox, sandbox and subagent capture.
The new session starts with no history. The raw agent’s conversation is not carried over. The transcript stays on disk: inside the new agent, use /resume to pick up where you left off.

​
When it can’t

The folder has to be a git repository. A managed session is repo-centric — that is what gives you the git panel, the diff and the jail’s reach. claude running in a folder with no git shows a clear error, and the warning stays put.

​
Ignore

Hides the warning for that process. A new agent in the same shell warns again — and reloading the window brings the warning back, deliberately: the session is still ungated, and TYBA will not pretend otherwise. What does not go away is the no gate badge in the session panel. As long as that agent runs unprotected, the badge stays.

​
The Agents panel works here too

Even with no gate, subagents of a claude typed into a shell show up in the Agents panel — TYBA reads the transcript from disk instead of relying on the hooks. It is the one protection that survives the raw path, and it is read-only: it shows what is happening, it does not intercept anything.

​
See also