Install
Menu

opencode · Hermes Agent · Cline Desktop · Claude Code

AI agents that can’t wander off.

CoreDesktop installs four AI coding agents and runs them in a sandbox. They can change your project, and not much else.

Sign in your agents Sandbox rules
~/Projects/site $ opencode Running
  1. Sandbox Write access: ~/Projects/site only
  2. Read Reading content/_index.md and hugo.toml
  3. Write Edited layouts/partials/header.html
  4. Agent Trying to read ~/.ssh/id_ed25519
  5. Blocked ~/.ssh is hidden from the sandbox
  6. Net github.com, npm and PyPI: allowed
  7. Blocked pastebin.example: not on the allow list
  8. Done Done. 1 file changed, nothing else touched.

In the sandbox

What an agent can and can’t do.

It can

  • Change files only in the directory you start it from, plus its own settings and a few package caches. So start it from a project directory.
  • Reach AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org.

It can't

  • Read your SSH keys, password stores or browser profiles
  • Read Flatpak apps’ data: browsers, Signal, Telegram and the rest
  • Read your Nextcloud password, cloud and Git credentials
  • Read the other agents’ logins

The agents

Four agents, one sandbox.

  • opencode

    Sandboxed when you type it

    Typing opencode runs it in the sandbox. To run it without, type unsandboxed opencode.

  • Hermes Agent

    Talk to it over Matrix

    hermes or hermes-agent runs in the sandbox, and so does its gateway, which lets you talk to Hermes through Matrix and other messaging apps. Its sandbox allows local sockets but hides your D-Bus session, SSH agent, Docker, Tailscale, X11, tmux and browsers.

  • Cline Desktop

    Your projects in ~/Projects

    Opened from the app menu. It can change files in ~/Projects, open projects elsewhere only to read them, and reach cline.bot. It draws through Wayland without the GPU, D-Bus or the keyring. unsandboxed cline-desktop runs it without the sandbox.

  • Claude Code

    Its own built-in sandbox

    Claude Code uses its own built-in sandbox for every command it runs. See /sandbox inside Claude.

Allow more

When an agent needs a site or folder.

Add it in ~/.config/coredesktop/sandbox/base.json for every agent, or in ~/.config/coredesktop/sandbox/opencode.json (and so on) for one agent:

{
  "network": { "allowedDomains": ["docs.example.com"] },
  "filesystem": { "allowWrite": ["~/notes"] }
}

For Hermes’ gateway to reach messaging services other than the Matrix server in its settings, add their domains the same way.

The sandbox is Anthropic’s sandbox runtime, which uses bubblewrap and socat. The default rules are in sandbox/config/.