byt Code: what it can touch

Each session has its own branch and its own worktree, in the Llamabyt app’s folder on your Mac. Your own checkout, your other sessions and the rest of your Mac aren’t its to change. Your harness reads your repo’s own instructions (CLAUDE.md, AGENTS.md), but never your repo’s harness settings, hooks or MCP servers: a repo you cloned can’t make anything run by itself.

Your harness’s commands run in your Mac’s sandbox: they can change files only in the session’s worktree and the temporary folder, and they have no network. Claude Code’s sandbox needs Claude Code 2.1.318 or later; with an older one, every command asks, even in Auto.

Whatever the session’s mode, these wait for your Allow:

Pushing, publishing and deploying

git push, npm publish, vercel, railway and the like. Better still, push with byt Code’s own Push.

Anything outside the worktree.

Everything after the web

once a session searched the web or opened a page, every command and edit asks, because a page’s words can steer your harness into something you didn’t ask for.

In Auto, a web search or a new page asks too.

Your harness searches the web with its own search, and opens pages only through Llamabyt, at addresses a search found, a page linked or you wrote: never one it made up or read in a file. The same limits apply as for llamas.

Before a step reaches Llamabyt, your Mac removes what looks like a secret: keys, tokens, passwords, private keys. The diffs you open are read from your Mac and never kept. Before Commit, your Mac checks the changes for secrets and .env files, and commits nothing until you say so. Never put secrets in what you write to your harness.

A loop takes turns without you sending each one, so it keeps the same walls and adds its own:

• A reviewer only reads: Claude Code gets no edits, commands or web; Codex’s commands run in a sandbox that can’t change a file.
• The repo’s check runs on your Mac, never through your harness, in every mode, in its own sandbox that allows only what a test needs: it reads the system’s and your toolchains’ folders and the worktree, never your home folder, keys, browsers, the app’s data or other repos; it changes files only in the worktree; it reaches nothing beyond your Mac (only localhost, for a test’s own database or server, and no lookups of outside addresses); and it can’t start background jobs, other apps, or reach your keychain. What it leaves running is stopped when it ends.
• What a reviewer wrote, a check printed or Dex said reaches your harness quoted, as their words, never yours.
• Every question still comes to you, and one nobody answers makes the loop wait. A loop never runs after its session read the web.
• Dex conducts only the loop you started for him, from your own request: he starts turns, never answers questions, and his tools stop when the loop does.

A session is yours alone. Nobody else in the workspace can start a turn on your Mac or answer its questions, and a guest never sees byt Code at all. Your subscription works only for your own sessions.

Others see a session only when you Share it with them, and then only to read: its turns, steps and changes, with the secrets already taken out. When you Ask a llama, your question goes as your own message in your DM with it, with the session’s words quoted, so a page or a file the session read can’t speak for you.