The agent
An agent with real hands.
Plan, propose, wait, execute, record. Every dangerous verb behind one approval gate.
The loop
Plan. Call. Watch. Adjust.
Plan
@ file, # snippet, / command. Agent reads, proposes, waits at gate.
Call
Approve → execute one tool call. Verb matches the approval card.
Watch
Output streams back. Append-only. Hash-chained to previous entry.
Adjust
Reject. Edit diff. Re-prompt. Nothing irreversible without your OK.
server.ts:42 + shell buffer…Real verbs
Tools the agent calls.
Shell · PTY
Real zsh / bash / pwsh. OSC 7/133. Per-command approval.
Filesystem
Read with secret-screen. Write through per-hunk diffs.
Git
Stage hunks, commit, open PRs via gh CLI.
kubectl
Reads auto. Mutating verbs gated.
AWS · gcloud
Existing creds. Service-by-service approval.
Databases
Postgres · MySQL · Redis · Mongo via MCP.
Honest limits
What the agent doesn't do.
Self-approve
Every write, shell call, destructive verb pauses at the gate.
Phone home
AI calls go direct to your chosen provider. We can't see prompts.
Silently chain
Sub-agent invocation is visible. Tool fan-out is visible.