The agent runs on hardware you own.
A sandbox is a Docker container on your laptop, workstation or VPS. Read its image, change what is installed, watch what it spends.
- 2 fieldsall the platform stores about a sandbox: a name and its URL
- MITthe sandbox and CLI that run on your machine are open source
- No portsnothing inbound is opened; the tunnel dials out
The image is a file you approve
Everything past the base image is an overlay Dockerfile. The agent can propose a line and then waits: you read the diff and approve before a rebuild applies it.
Your browser reaches it directly
The sandbox dials out over a private Cloudflare tunnel and your browser talks to that address. The platform never relays a file, a keystroke or a credential.
Chat, files, editor, terminal
Sandboxes, repos, credentials, capabilities
Identity + sandbox URL only. Off the command path.
The bill is measured where it is spent
Every turn's tokens and cost land in the sandbox's own ledger, by day, provider and model. It is your subscription, so the platform never meters it.
What the platform actually holds
Identity, the sandbox's URL, billing state, and the grants that let a teammate reach it. Not your code, not your keys, not your transcripts.
Stays inside your sandbox
- Your code and repos
- Every credential and token
- The agent's transcripts
- The container and its image
All the platform holds
- Your identity (Google sign-in)
- The sandbox's name and URL
- Billing state
- Grants to invited teammates
What it stores is AES-256-GCM encrypted, with no decrypt path in the product.
Everyone else lets you edit the prompt
The prompt is the one layer you can change anywhere. A sandbox opens the rest: the image, the systems it reaches, the skills it loads every turn. You can't make the model smarter, only better equipped.
A prompt
a system prompt and a few .md files- Describes your tools. None are installed.
- No reach into your codebase, data, or services.
- Starts from the same blank context every run.
- Hands you generic output you finish by hand.
The whole environment
a sandbox you can open and change- Its dev-tools and libraries are really installed.
- Wired to your repos, databases, and services.
- Curated context loads every single run.
- Does the job end to end, shows its work as diffs.
One sandbox, several people
The owner installs the tools; invited teammates share that same sandbox, each over their own private tunnel. Setup stays owner-gated.
- Invite by email; grants are enforced by the daemon, fail-closed.
- Teammates chat, drive and review, and mirror the sandbox's ports.
- Sharing is a Pro feature; revoking or leaving never is.