Managed sandboxes
A managed sandbox is a fresh box OpenGeni provisions for the session. Backends are pluggable: Docker (the local default), Modal, an in-process local provider, and several cloud sandbox providers. The stock image ships Terraform, Checkov, the Azure and GitHub CLIs, git, and common shell tools, and opt-in preparation profiles can pre-authenticate those CLIs. Sandboxes are swappable within a session, and a session’s files can be recovered from a snapshot or archive after the box is gone. A session can also run with no compute attached when the task needs only model and tool calls.Connected Machines
A Connected Machine is a computer you enroll: a laptop, a workstation, a build server, a GPU box. When a session targets it, the agent runs there directly. There is no cloud box behind it.- Your credentials stay yours. No platform-minted token, Git credential, or setup hook crosses to the machine. It uses its own SSH,
gh, or credential helper. - Your files stay in place. Repositories are never cloned onto the machine. Each session works in a folder you choose under the agent’s root.
- Dial-out only. The enrolled agent connects out to OpenGeni’s control plane and stream relay. Nothing on the machine needs to be reachable from the internet.
- Loud consent, one-click revocation. Enrollment asks for whole-machine access explicitly, screen control is a separate consent, and revoking a machine invalidates every grant at once.
- Never cold-created or killed. An offline machine is offline, not missing. OpenGeni never provisions a replacement box for it and never stops it.