The sandbox
Each Workspace runs under a Sandbox profile: filesystem confinement, a network allowlist, secret hygiene, and a hard spend cap.
A git worktree isolates parallel work; it is not a security boundary. The Sandbox profile is: the per-Workspace posture the Coding agent, the Project scripts, and the Terminal run under. It has four independently switchable layers:
- Filesystem confinement: writes scoped to the Workspace's worktree.
- The Egress allowlist: default-deny network access.
- Secret hygiene: a minimized environment and redaction, so secrets on your machine stay out of the agent's reach and its output.
- Resource limits and the Spend kill-switch.
The four layers wrap what runs in a Workspace: the agent, the Project scripts, and the terminal all execute inside them.
Two presets name the common cases: Sandboxed, all four layers on, the default for every Workspace; and Trusted, all four off, the full-access escape hatch. Any custom mix in between is allowed. A Workspace inherits its Repository's default profile and may tighten layers silently, but loosening any layer is an explicit per-Workspace act.
The profile is stored in Cohalen-managed config, never committed to a Repository, so an agent cannot edit its own cage through the files it works on. It is edited only in Settings.
The Egress allowlist
With the network layer on, a Workspace reaches only the hosts on its allowlist; everything else is refused. Enforcement is a local egress proxy Cohalen runs, which chains through any upstream proxy you already use rather than replacing it. The default list covers the common package registries (npm, PyPI, crates.io, Maven, Go, RubyGems), GitHub, and certificate authorities, plus the active agent's own API endpoints, which are always allowed so the agent itself keeps working. You widen the list in Settings; a committed repo file never can.
The Spend kill-switch
The Spend kill-switch is the per-Workspace budget meter: when a Turn's token spend crosses the Workspace's cap, the Turn is hard-stopped, the same way a manual cancel stops it. It is on by default and no profile disables it silently, because runaway cost comes from accidents, not only from untrusted code. It is what makes leaving agents to work unattended a bounded decision: the worst case has a number on it.
Next: Connect your Runner, running Workspaces on a host you own.
Terminal and Project scripts
Run real shells inside a Workspace, and share the Setup, Run, and Archive scripts that give every Workspace the same workflow.
Connect your Runner
Pair a Linux host you own as a Runner, place your own agent credentials on it, and run a Workspace there: your agents, your infrastructure.