Skip to main content
Each session runs its commands, files, and tools on one of two targets.

​
Managed sandboxes

Opengeni provisions a fresh sandbox for the session. Backends include Docker (the local default), Modal, local, and several cloud sandbox providers. The stock images include Terraform, Checkov, GitHub CLI, git, psql, a Python toolchain, common shell tools, and a Chromium-based browser. The headless image adds Azure CLI; the desktop image adds a graphical desktop and FFmpeg. A session’s files can be recovered from a snapshot after its sandbox is gone. A session can also run with no compute when it needs only model and tool calls.

​
Connected Machines

A Connected Machine is a computer you enroll: a laptop, workstation, build server, or GPU box. The agent runs on it directly.
  • Your credentials. The machine uses its own SSH keys, gh login, and Git setup.
  • Your files. Each session works in a folder on the machine.
  • Outbound only. The machine connects to Opengeni; it doesn’t need to be reachable from the internet.
  • Explicit consent. Enrollment asks for machine access, screen control is a separate consent, and you can revoke access in one click.
Self-hosted deployments must enable Connected Machines first. See Connect a machine.

​
Choosing a target

Pick a machine and working directory when you create a session, or switch the session’s target later. Child sessions use their parent’s machine unless told otherwise. You can move a running chat to your personal machine. Your click allows the current turn to use it, even if someone else started that turn. The next tool call runs there; work already running stays where it started. Recovery and retries of the same turn keep your consent, but it does not let someone else start future turns on your machine. When you own and initiate the consenting session, its agent-created children and further descendants can use the same personal machine in the same workspace. They keep using the original consent: revoking or expiring its grant, or invalidating the parent’s machine authorization, stops their access too. This does not cover unrelated chats, siblings of the consenting session, or turns initiated by another person.