Architecture

The two tiers

The platform

A thin hub — a Vue SPA and a small API. It persists your account, your subscription, and your sandbox's public URL, which the daemon announces on boot. It never probes the sandbox, owns no infrastructure, and sits off the command path: a platform breach can read a URL and reaches nothing else.

The sandbox

One container per agent, on your PC or your server, run unprivileged by default. It runs the coding agent, holds your repos and credentials, and exposes its daemon over its own Cloudflare tunnel. This is the whole product surface — chat, terminals, files, panels, capabilities, and automations all come from here. Your keys ride straight into it and never reach the platform. Inside it the agent can run whatever a job needs — a database client, a headless browser, even a bundled deployment engine if you add that capability — but those are tools it invokes, not tiers of the product.

Ownership & trust

The trust root is your browser's Google sign-in. Your browser drives the daemon directly with a Google ID token; the daemon verifies it against Google's keys and binds you as owner on first use. The platform never holds that token, so it cannot drive your sandbox even if it were breached. Repos, credentials, and history live where the sandbox runs; capability secrets are stored inside the sandbox and echoed back to the UI only as "set" / "not set" booleans, never as values.

Reachability

Every connection is outbound-only. cloudflared dials out from your machine, so the sandbox is reachable from any browser with no inbound ports and no firewall changes. Bring your own Cloudflare zone and it absorbs the tunnel under your domain; bring nothing and intentic provisions one under its own domain and hands the sandbox a narrow per-tunnel token.

The lifecycle

1. 1
   Sign in + open Setup

   You authenticate with Google and name a sandbox. The platform reserves a private tunnel and hands you a connect one-liner.

2. 2
   Connect

   You run the one-liner on your machine. It starts the sandbox and a cloudflared sidecar; the daemon announces its URL to the platform on boot.

3. 3
   Bind on first use

   Your browser drives the daemon directly with your Google ID token. The daemon verifies it and binds you as owner on the first authenticated request.

4. 4
   Chat + plan

   You work over the tunnel — chat, files, editor, terminals. The agent runs in plan mode, proposing changes while you watch and steer.

5. 5
   Review + approve

   Every change comes back as a diff you commit or discard, and the agent can operate any connected system or tool from chat. You supervise; it does the work.