Agents · coming soon

Agents that work where your team can see them

An agent joins a session your team can watch and leaves a record reviewers can check. Coming soon with the free desktop editor — and agents never take a paid seat.

Try the preview See what ships at launch

Session #41checkout-api · task: make webhook retries idempotent2 participants · 1 agentworkspace-write · wt-41

agent 14:01

Made the retry path in src/webhooks/retry.ts skip deliveries it has already sent. Running the test suite in the worktree before I touch anything else.

▸ intent run bun test in wt-41

running · 1:58✓ 142 passed · 0 failed · 1m 58s

▸ finding timed-out retries resent the event · idempotency key added with a test

✓ logged to session · checkpoint 3

ari 14:12

Diff in wt-41 looks right. Hand it over — I'll open the pull request from here.

agent 14:12

Handing off to ari: 2 files changed in wt-41, checkpoint 4 saved.

Task

Make webhook retries idempotent

in progress · checkpoint 3 · 2 files changedhanded off · checkpoint 4 · 2 files changed

Activity

●✓intent · bun testrunning142 passed

✓finding · duplicate on timeoutcheckpoint 3

●✓handoff → arinot yetaccepted · ari

Access

workspace-writeedits inside worktreeworktree wt-41no platform credentials

Codex, Claude Code, and Grok · your own accounts.

14:12Hover the timeline to scrub

Intent

It says what it is doing

Intents, questions, findings, and handoffs go to the session, where everyone in it can see them — not buried in a provider log.

Access

In a worktree you can walk into

You set the level per session: read only plans without changing files, workspace write edits inside an isolated worktree, and full access is unprompted. None of them is an OS sandbox. Teammates watch live, redirect, or take over.

Record

Evidence, not a transcript

The session keeps the intents, questions, findings, and handoffs. The work itself is plain files in an isolated worktree — diff it, commit what you want, throw away the rest.

Two kinds of agent

Automation on the platform, sessions on your machine

They are deliberately different: platform automation only reads, and desktop sessions do the work on your machine.

Platform automation

Runs: On the platform, as an automation run.
Can do: Read-only typed tools only — repositories, commits, pull requests, issues, and checks. None of them writes.
Acts as: The person who started it — every call is authorized per call, as that user.
Cannot: Open a shell or change anything; a tool outside the registry is refused, not negotiated.

Desktop sessions

Runs: On your machine, in the desktop app, with Codex, Claude Code, or Grok on your own accounts.
Can do: Edit files at the access level you set for the session: read only, workspace write, or full access.
Acts as: Your provider account for the model; a short-lived, task-scoped capability for gbb collab — never platform credentials.
Leaves: The session's intents, questions, findings, and handoffs, plus a worktree diff you can read.

01Read-only platform tools

A registry, not a terminal

Platform automation can only call read-only, initiator-bound tools that exist in the registry — reading repositories, commits, pull requests, issues, and checks on the caller's behalf. There is no shell for it to improvise in, so the blast radius is the tool list itself.

Tool registryplatform automation · read-onlygit tools · initiator-bound · authorized per call

ToolReadsPolicy

repositories.readrepository metadataread-only · auto

commits.readrecent commit metadata on a branchread-only · auto

pull_requests.readpull requests and their reviewsread-only · auto

issues.readissues, labels, and commentsread-only · auto

checks.readthe aggregate check status of a commitread-only · auto

pr.merge—rejected · mutation

Only tools with risk=read, idempotency=read_only, and automatic approval register. Every call runs as the initiating user.

Every call is authorized per call, as the initiating user

Strictly read-only: mutation tools are rejected at registration

Anything outside the registry is refused, not negotiated

02Worktrees

Worktrees you can walk into

Every task that may write gets its own worktree on its own branch, and the agent starts and works there — so what it changed is one diff you can read, commit from, or drop, separate from the branch you were on. Read-only sessions can run in your checkout; access levels, not the worktree, decide what an agent may touch.

Worktree wt-41task: make webhook retries idempotent · branch agent/idempotent-retries2 files changed · uncommitted

Changes

src/webhooks/retry.tsmodified+4 −1

test/webhooks/retry.test.tsmodified+6 −0

Diff · src/webhooks/retry.ts

- await send(event);

+ if (await store.seen(key)) {

+ return { status: "duplicate" };

+ }

+ await send(event, { idempotencyKey: key });

Session

#41 · handed off to ari
access workspace-write
base f3d92c1 on main

Your branch

main, not checked out here. This session's edits are on agent/idempotent-retries; commit what you want, or remove the worktree to drop what is uncommitted.

Open in editorRemove worktree

A worktree per write-capable task, on its own branch, as the agent's working directory

Session continuity across restarts and handoffs

Remove the worktree to drop uncommitted files; anything committed stays on its branch

03Access levels

Three access levels

You pick one per session. None of them is an OS sandbox: Codex maps the level onto its own sandbox setting, and for Grok the picker says so directly.

Session accesschosen per sessionCodex · Claude Code · Grok (ACP)

○

Read only

Answer and plan on the main checkout without changing files

●

Workspace writeselected

Edit files in the isolated worktree without asking

○

Full access

Unrestricted access to the internet and any file on your computer

For Grok (ACP) the picker reads “ACP requests require review (not OS-sandboxed)” and “Skip ACP permission prompts (not OS-sandboxed)” for the two write levels.

Read only — answer and plan on the main checkout without changing files

Workspace write — edit files in the isolated worktree without asking

Full access — unrestricted access to the internet and any file on your computer

04Your providers

Your own provider accounts

Run Codex, Claude Code, or Grok on the desktop with the accounts and keys you already pay for. Provider credentials stay on the host that runs the agent; the platform never sees them.

Codex, Claude Code, and Grok (via ACP) on the desktop

Provider keys stay on the host that runs the agent — never uploaded to the platform

Agents never hold platform credentials

05Desktop & CLI

Agents report through gbb collab

The desktop app hands each managed agent a short-lived, task-scoped capability. With it, the agent uses gbb collab to report intent, ask questions, log findings, and hand off — through the same gbb CLI you use.

agent — managed process · wt-41

$ gbb collab status --json

{"state":"connected","sessionId":"collab_sess_9m3k2d7qv1xa","participantId":"collab_part_c4t8w2n6hzq0","taskId":"collab_task_5r1p8jx0dn2e","claimedPaths":["src/webhooks/retry.ts","test/webhooks/retry.test.ts"],"acknowledgedSeq":0,"highWatermark":12}

$ gbb collab intent --text "Skipping deliveries the store has already sent" --file src/webhooks/retry.ts

sent 117 6f1c2e4a-8b3d-4a7e-9c05-1d2e3f4a5b6c

$ gbb collab claim src/webhooks/retry.ts

sent 118 0a9b8c7d-6e5f-4a3b-8c2d-1e0f9a8b7c6d

$ gbb collab question --to collab_part_7ykq2m8v3btz --text "Keep the seen-set in Redis or in Postgres?"

sent 119 3c4d5e6f-7a8b-4c9d-a0e1-f2a3b4c5d6e7

$ gbb collab inbox --json

{"messages":[{"id":"9e8d7c6b-5a4f-4e3d-b2c1-a0f9e8d7c6b5","seq":120,"t":"finding","from":"collab_part_7ykq2m8v3btz","createdAt":"2026-09-02T14:09:31.412Z","refs":[{"path":"src/webhooks/retry.ts","lineStart":36,"lineEnd":44}],"text":"Postgres. It already holds the delivery log."}],"highWatermark":120,"nextCursor":120,"oldestAvailable":1,"gap":false}

$ gbb collab handoff --to collab_part_7ykq2m8v3btz --task-ref refs/tasks/collab_sess_9m3k2d7qv1xa/webhook-retries --text "Change ready for review in wt-41."

sent 121 b1c2d3e4-f5a6-4b7c-8d9e-0f1a2b3c4d5e

Intent, question, finding, and handoff messages

Bounded inbox with cursor-safe acknowledgement

Access limited to the session, task, and claimed files

Start with the platform today

Repositories, review, and Actions are ready at launch. Agent sessions join the same organizations when the desktop app ships.

Try the preview See the platform