Zero

You will notice this most on tasks that turn out harder than expected. The trait that decides it in daily use is the model picker: swapping to a stronger model in the middle of a session, or dropping to a cheap one for the boring half, takes a keystroke rather than a restart, and slash commands and image input mean the session is a workspace rather than a prompt box.

Pick it if you want control without ceremony. Pick Crush for the same terminal shape with more history behind it, or a desktop tool if you would rather see diffs in a window than a pane.

The trap is that two installs of the same version are not the same program. Install from the published package and the control helpers are present; build from source and they must already be on your path or configured, and the seccomp helper is a separate build step of its own. That means the protection an engineer thinks they have depends on a choice they made at install time and will not remember.

What it does right: writes are scoped to the workspace by default, so the ordinary case of an agent wandering out of the project directory is closed before any of this matters.

Two design decisions are worth naming. 1. Forking a session turns the usual complaint about non-determinism into an experiment: the same prefix, two continuations, compared directly, which is how one would actually study a prompt change rather than argue about it. 2. Output is available as structured data in three shapes, so the agent's result can be consumed by a program instead of read by a person.

No evaluation is published and the project is two months old, so the documentation is young. The architecture nonetheless assumes machine consumption, which is the assumption that ages best.

The competitive position is the problem, not the code. Terminal agents are the commodity layer of this market, differentiated by taste rather than by anything defensible, and this one arrives with no entity, no revenue and roughly sixteen hundred stars against competitors counting theirs in tens of thousands. Distribution is the moat in commodities and there is none here.

The realistic outcomes are enthusiast maintenance or absorption of its better ideas by a larger project, which permissive licensing invites. No acquirer buys a terminal agent in 2026; they hire the author. Position: adopt freely, expect no continuity, keep your configuration portable.

The automation story is what earns this a meeting. An unattended run returns exit codes my pipeline can branch on, and there is a documented recipe for wiring it into our forge's automation, which means it becomes a check rather than a habit. Licensing is zero across sixty engineers and the spend lands on provider keys we already issue and can already attribute.

Against that, the row records no single sign-on, no SCIM and no audit trail, and the vendor is one publisher with no support terms. Onboarding is under an hour. Approved with conditions: pinned version, keys issued centrally, and no production credentials in reach.

MIT, written in Go, installed from npm or a shell script, and the provider list ends where I want it to: local runtimes alongside the commercial endpoints, so inference stays on my machine when I want it there and my keys go straight to the provider when I do not. It consumes MCP servers and exposes its own tools over MCP, which is the direction most projects skip.

Skills, plugins and lifecycle hooks mean I extend it without patching it, and if I did have to patch it the source is right there. This is what ownership looks like without any ideology attached.