Efrit

The deciding trait is the session buffer. A long run stops being a scroll of text and becomes a thing you can read: elapsed time at the top, progress the model maintains, tool calls you expand only when you want the detail, and a place to type while it is still working.

That is the difference between watching an agent and supervising one, and almost nothing else in this category offers it. What you give up is portability, because this lives where you already live and nowhere else. Pick it if Emacs is home. Pick a terminal agent if it is not.

The dealbreaker is written in the documentation. The design principle is that the client holds no intelligence: the model decides everything and this executes it, which means there is no local layer that can refuse. Both a shell tool and an evaluator for arbitrary editor code are exposed.

An editor is not a container. It holds open buffers, credentials in the environment and a process that can reach anything the user can, and a mistaken evaluation there is not undone by pressing undo. What it does right is admitting the exposure in plain language rather than burying it three pages down.

1. Read access to history without write access is a principled boundary. The model can establish why a line exists and cannot rewrite the record of it, which keeps history outside the set of things a bad turn can damage. 2. Editing goes through a path with undo, so file changes stay reversible.

2. Nothing is measured. There is no evaluation, no benchmark and no capability claim that would require one, which is at least internally consistent. The design is stated as a principle and the principle is followed, and that is the entirety of the evidence available to a reader.

There is nothing to value here, and that is the point. No entity, no revenue, no hosted service, so the eighteen-month question becomes a question about one engineer's interest. What sharpens it is the single-vendor binding: this speaks to one provider, so a change of terms upstream is a change of terms here.

Moat: none, and none is available to a package living inside somebody else's editor. Likely path is that it remains a personal project or it stops. Position: enjoy it, and put nothing on a roadmap that assumes it is still here next year.

The population is a problem before the price is. This installs into a personal editor configuration, which means the group inside my organisation is small and self-selecting, and the rollout is a conversation with four people who each configured their editor differently over fifteen years.

Everything a security review asks for is absent: no directory integration, no provisioning, no retention policy and no log I could produce afterwards. It does not run in delivery either, so it yields nothing I can report on. Not yet, and that is less a rejection than an absence of anything to approve.

This is the one that annoys me. Thirty-five tools written in the editor's own language, all of them readable and editable by me, sitting on top of a model choice I do not get to make. The provider is fixed, no local weights, and no protocol for attaching servers I already run.

Worse, there is no licence file, so I do not know what I am permitted to do with code I can plainly read. Grudging respect for the tool surface, which is the most extensible half of any agent on this board, and a firm no to depending on it.