# Where your code runs

Source: https://cohalen.com/docs/architecture



By default, everything runs on your machine, and what crosses the boundary
crosses it under an account you hold. Agents call their model vendors under
your subscriptions. A pull request goes to GitHub when you [ship](/docs/ship).
On a [team](/docs/teams), the chat and the changeset diff sync so teammates can
review; that is the one rendering of your code that travels, and the worktree
itself never does.

One choice moves execution: pick a [box](/docs/cloud) for a workspace, and that
workspace's clone and agent run in your own sandbox vendor's account instead.
Yours, not Cohalen's. No Cohalen server sits in any of these paths or holds
your source, your keys, or your vendor credential.

## What runs where [#what-runs-where]

The desktop app prompts each agent and streams back what it's doing. Every agent
works in its own git worktree, on your machine or in that workspace's box.

<Mermaid
  chart="`flowchart TB
accTitle: What runs on your machine, and what leaves it
accDescr {
  You drive the Cohalen desktop app. By default every coding agent runs on
  your machine, each in its own git worktree. Four kinds of traffic cross the
  boundary, each under your own account. Model traffic goes from the agents to
  their vendors under your subscription. Push and pull-request traffic goes to
  GitHub. On a team only, chat and changeset diffs go to a sync backend. And a
  workspace you picked a box for runs its worktree and agent in your own
  sandbox vendor account instead of on your machine.
}
U[&#x22;You&#x22;]
subgraph M [&#x22;Your machine&#x22;]
  APP[&#x22;Cohalen desktop app&#x22;]
  subgraph AG [&#x22;Coding agents, one per workspace&#x22;]
    A1[&#x22;agent → git worktree&#x22;]
    A2[&#x22;agent → git worktree&#x22;]
  end
  APP -- &#x22;prompts, streams the turn&#x22; --> AG
end
subgraph V [&#x22;Your vendor account (per workspace, if you pick a box)&#x22;]
  BX[&#x22;box: agent → git worktree&#x22;]
end
U --> APP
APP -- &#x22;creates, drives, destroys&#x22; --> BX
AG -- &#x22;your subscription&#x22; --> API[&#x22;Model API&#x22;]
BX -- &#x22;your subscription&#x22; --> API
APP -- &#x22;push, pull request, merge&#x22; --> GH[&#x22;GitHub&#x22;]
APP -- &#x22;chat + changeset diff, team only&#x22; --> SB[&#x22;Sync backend&#x22;]`"
/>

## What stays on your machine [#what-stays-on-your-machine]

The working surface is local by default. Each workspace is a real git worktree
on disk. The agent that owns it, its terminal, the files it edits, and the
conversation itself all live there. Re-open a workspace and the chat rebuilds
from disk, not from a server.

A git worktree keeps parallel work apart, but it isn't a security boundary. So
whatever runs inside one runs under a [sandbox profile](/docs/sandbox). It
reaches only the files and hosts you allow, keeps secrets out of the agent's
way, and stops at a spend cap.

## What leaves, and when [#what-leaves-and-when]

Four things cross the machine boundary, each under an account you hold:

* **GitHub**, when you ship. The commit and push, the pull request, and the
  merge all run through your
  [GitHub connection](/docs/getting-started#connect-github), authored as you.
  Nothing pushes until you do that step.
* **The sync backend**, only on a team. Nothing syncs until a teammate joins,
  and then only the review surface, so they can follow a workspace live. The
  worktree never leaves its [owner](/docs/teams)'s custody.
* **The model API**, whenever an agent thinks. Each agent calls its own
  vendor's endpoint under your subscription or keys. Cohalen never proxies that
  traffic.
* **Your sandbox vendor**, only for a workspace you picked a
  [box](/docs/cloud) for. Its clone and agent run in your own vendor account,
  created and destroyed by your desktop, billed to you. The credential stays in
  your OS keychain, and Cohalen resells no compute.

## Why it's built this way [#why-its-built-this-way]

Whoever holds the code and the keys is who you have to trust. Cohalen's answer
is that it's you, in every case: your machine by default, your own vendor
account when you choose one, your GitHub identity when you ship. Cohalen is
never the party holding your source and promising to behave.

It also means Cohalen runs with no account and no network at all.