The containment cell

The containment cell

The containment cell is Tome's safety boundary. It's what stops a coding agent from exfiltrating data or doing damage on your behalf.

It is not a true air gap — it's an OS sandbox plus an allowlisted loopback proxy. (Earlier releases called it the "air gap"; the name was corrected in v0.3.0.)

What it does

• Agent panes run sandboxed. On macOS via sandbox-exec (Seatbelt); on Linux via bubblewrap network namespaces.
• Direct egress is denied. The only way out is a per-pane loopback CONNECT proxy that enforces a provider allowlist.
• Unlocking is explicit. A gapped pane stays contained until you unlock it; unlocking flips its proxy to "open" (still through the sandbox).
• Repo consents. Egress hosts a repo requests are added only after you consent, and the backend re-validates the request.

In practice

• New agent panes start gapped (no network).
• The assistant's own chat call is separate — the assistant runs in the main process, not inside a gapped pane.
• A security event log records unlocks, blocked hosts, and assistant actions.

The full invariants live in docs/THREATMODEL.md in the repository.