Agent Safehouse Documentation

Agent Safehouse is a sandboxing tool for macOS designed to protect your system when running LLM coding agents. It uses macOS sandbox-exec with composable policy profiles to restrict an agent's access to only the paths it needs.

By default, Safehouse follows a strict 'deny-all' posture, explicitly allowing only necessary system, toolchain, and project paths. This reduces the blast radius of potential prompt injections or malicious commands that might otherwise attempt to access SSH keys, cloud credentials, or personal files.

Cline (published as claude-dev by saoudrizwan) is an AI coding assistant that operates in two primary modes:

1. VS Code Extension: The primary interface, rendered as a React-based sidebar webview. It integrates with the VS Code terminal to execute shell commands.
2. Standalone/CLI Mode: Runs outside of VS Code using a gRPC-based ProtoBus server on port 26040. Data for this mode is stored in ~/.cline/data/.

Requirements:

• VS Code engine ^1.84.0.

Gemini CLI is a terminal-based agentic coding assistant from Google powered by Gemini AI models. It is built as a TypeScript/Node.js monorepo (requires Node.js >= 20.0.0) and consists of several packages:

• @google/gemini-cli: The main CLI tool.
• @google/gemini-cli-core: The core logic library.
• @google/gemini-cli-a2a-server: An Agent-to-Agent (A2A) HTTP server.
• gemini-cli-vscode-ide-companion: A VS Code extension companion.

The CLI supports interactive terminal UIs, file editing, shell command execution, web fetching, code search, and browser automation. It uses sandbox mechanisms like macOS Seatbelt, Docker, or Podman to isolate AI-driven tool execution.

Auggie is a proprietary agentic CLI from Augment Computing. It is distributed via the @augmentcode/auggie npm package. Developers can interact with it directly via the CLI or programmatically using the Python SDK (auggie-sdk) or TypeScript SDK (@augmentcode/auggie-sdk).

Runtime Requirements:

• CLI Agent: Node.js 22+
• SDKs: Python 3.10+

Architecture Layers:

1. User Code: Python or TypeScript.
2. SDK/Protocol Layer: Uses the Auggie SDK or the AuggieACPClient protocol.
3. Augment CLI: The core augment.mjs engine, running in either subprocess mode or ACP mode.
4. Augment Cloud API: Hosted AI services.

Goose can be run in several different modes depending on your needs:

• CLI Interface: An interactive terminal REPL for direct agent interaction. It uses rustyline for history and cliclack for interactive prompts.
• Desktop Application: A full Electron-based UI (React/Vite/Tailwind) that communicates with the Rust backend via HTTP/WebSocket.
• Web UI Mode (goose web): Launches a local web server using axum that serves a bundled frontend and automatically opens your browser.
• Server Mode (goosed): A standalone HTTP/WebSocket server (goose-server) that provides a full REST API (OpenAPI spec) for remote or programmatic access. By default, it binds to 127.0.0.1:3000.

Cline's UI is implemented as a single-page React application built with Vite, Tailwind CSS, and components from @heroui/react and @radix-ui/.

Key architectural details:

• Registration: The UI is registered as a VS Code sidebar webview with the ID claude-dev.SidebarProvider.
• Communication: The webview communicates with the extension host via the VS Code postMessage API, utilizing a gRPC-like protobuf protocol.
• Browser Usage: The extension does not launch external browser windows for its main UI. It only uses the system browser (vscode.env.openExternal()) for OAuth authentication flows, opening documentation, or bug reports.

"views": {
    "claude-dev-ActivityBar": [
        {
            "type": "webview",
            "id": "claude-dev.SidebarProvider",
            "name": ""
        }
    ]
}

Cline supports several OAuth flows, some of which trigger a system browser redirect and others that use local servers:

• Browser Redirects: OpenRouter, Requesty, OCA, Hicap.
• PKCE Flow: OpenAI Codex OAuth uses a local HTTP server on a dynamic port to handle the callback.
• External Configs: Cline also reads credentials from specific external files like ~/.qwen/oauth_creds.json for Qwen Code and ~/.oca/config.json for Oracle Cloud.

Copilot CLI uses an application-level permission model. By default, the user must approve every tool call. You can manage these permissions using flags or slash commands:

• --allow-tool TOOL: Pre-approve a specific tool (e.g., shell(git status)).
• --deny-tool TOOL: Block a specific tool permanently.
• --allow-all-tools or /allow-all: Skip all individual tool prompts (enables Autopilot behavior).
• --dangerously-skip-permissions: Skip all permission checks entirely (highest risk).
• /add-dir PATH: Grant access to an additional directory.

Note: Copilot CLI does not implement OS-level sandboxing. It relies on 'Trusted Directories' (persisted in config.json) to restrict filesystem access. Only trusted directories and their subdirectories are accessible for read/write/exec operations.

OpenCode supports the Model Context Protocol (MCP) via github.com/mark3labs/mcp-go. You can configure user-defined MCP servers to connect using one of two methods:

• stdio: The server is run as a subprocess, and communication occurs via standard input/output.
• SSE: The server connects to an HTTP URL using Server-Sent Events.

Aider implements specialized flows for certain providers:

• OpenRouter OAuth: Uses a PKCE flow. Aider starts a temporary HTTP server on a local port (between 8484 and 8584), opens your browser to https://openrouter.ai/auth, and upon successful authentication, saves the resulting OPENROUTER_API_KEY to ~/.aider/oauth-keys.env.
• GitHub Copilot: Aider can exchange a GITHUB_COPILOT_TOKEN for an ephemeral OpenAI API key by making a request to the GitHub Copilot internal token endpoint.