Run any coding-agent CLI (claude, codex, aider, ...) behind two boundaries it can't ignore: a logging/enforcing egress proxy and a zero-install, kernel-enforced filesystem jail. - View it on GitHub