Run agents with their permission checks off.

The whole terminal runs inside the sandbox, so the agent, its file tools, MCP servers and hooks are all held to the task's worktree. The rest of your machine is out of reach.

sandbox Seatbelt · Landlock read · write · commit asks you to run it · stages review comments on the host claude worktree T-119 ~/.ssh, ~/.aws other repositories Ouijit dev server, push
The agent gets its worktree and nothing else. Anything that needs the rest of your machine, it asks you to run.

Choose what runs where

A default per project, with an override for any one lifecycle hook, script or terminal. Sandbox the agent. Keep the dev server and the push on the host, where the credentials are.

Default
Where terminals, hooks and scripts run
Host
StartRuns when a task moves to In Progress
claude --dangerously-skip-permissions "$OUIJIT_TASK_DESCRIPTION"Sandbox
DoneRuns when a task moves to Done
git push -u origin HEAD
Dev servernpm run dev

The agent still drives Ouijit

The ouijit command works inside, on a token scoped to the project. When the agent needs the host, for a push or a signed build, it asks. You see the exact command and press Run or Decline. How much of Ouijit it may drive is a project setting: read only, its own task, or everything.

Ouijit CLI access
Read only
Its task, the notes on its diff, drafts, and asking you
Its own task
Also move, rename and describe it
Everything
What a host terminal can

Bring your own launcher

A Custom launcher runs every sandboxed command through a script your team maintains. The script owns the boundary. Ouijit passes it the worktree, git directories and ports as hints. 

$ ~/.local/bin/team-sandbox -- zsh
OUIJIT_SANDBOX_WORKTREE=~/Ouijit/worktrees/horizon/T-119
OUIJIT_SANDBOX_GIT_DIR=~/Code/horizon/.git
OUIJIT_SANDBOX_HOOK_PORT=52341

Turn it on

Set the project's default to Sandbox in Project settings, and every task terminal, hook and script runs inside it. Or sandbox one command from any terminal: 

ouijit sandbox -- claude --dangerously-skip-permissions

How it works

Kernel-enforcedSeatbelt on macOS, Landlock on Linux, applied by nono, an open-source sandbox runner that ships inside Ouijit. The limits are an OS policy on the process, not a prompt or a classifier.

In placeThe agent runs in the real worktree as a normal process, with your tools on PATH and its own login intact. No VM, no file sync, no second environment.

Policy outside the repositoryEach project's profile lives in your config directory, and .git hooks and config are read-only inside. The agent can't grant itself access or plant a hook that runs on the host. Edit the profile to grant folders or change the network rules.

Questions

Does this replace Claude Code's own sandbox?

It covers more. Claude Code's sandbox wraps the shell commands it runs, and its file tools, MCP servers and hooks run outside it. Ouijit's wraps the whole terminal. The two can run together.

Which agents does it work with?

Any command. Claude Code, Codex, Pi and OpenCode sign in and run with nothing to configure. Anything else needs its paths granted in the project's profile.

Can the agent reach the network?

By default, yes. Block it or allow specific ports in the project's profile. Ouijit's own status port stays reachable, so the card still shows what the agent is doing.

Does it slow anything down?

No. There is nothing to boot and nothing to sync. A sandboxed terminal opens as fast as any other.

What does it need?

macOS, or Linux with kernel 5.13 or newer. Nothing to install.

Sandbox documentation