Coding agents, run by the system.

A session, not a stray terminal

Type a in any terminal and Rime starts your agent in a terminal it owns. The agent itself is unchanged: the real claude or codex, in a real terminal. The difference is that Rime now knows it is there. It can tell you what the agent is doing, keep it running when the terminal window closes, and let you attach from another terminal, or from your phone.

Rime only tracks sessions it starts. Typing codex on its own still works exactly as it always did.

What needs you comes first

The Agents tab of the Dashboard is the Agent Center. A privilege request waiting for your decision sits at the top, then every session that is waiting for you or needs a permission, then the rest, most recently active first. Each row says which project and worktree the agent is in, how long it has been running, what it started, and, for Claude, the model, how much context is used, and how much of your five-hour and seven-day allowance is left.

A sandbox by default

Every session starts in a bubblewrap sandbox. The system is read-only, and your home directory is empty except for the project the agent was started in. Nothing else is there to read or to break. Your SSH keys, other projects, the camera and sound devices and every other process are outside it.

The environment is cleared too; only the variables the agent itself needs, such as its own API key, come through. If the sandbox cannot be built, the session does not start.

Never root. You decide, at the machine.

Inside a session sudo does not work: no process in it can gain privileges. When an agent needs something from the system, it asks, in a closed vocabulary of eight requests (install, remove, upgrade, rebuild or roll back packages, pin, roll back the system, update). There is no request that runs a command. The agent waits, the request appears at the top of the Agent Center, and you approve it with your own password.

Credentials an agent can use, but never read

An agent that deploys a site or pushes a branch needs a credential. On Rime it never gets one. The credential lives in rime-secretd, a root service, which does the operation itself and hands back only the result. It has no way to return a credential at all, so there is nothing for the agent to leak.

Parallel work you can take back

Give each agent its own git worktree and several can work on one project at once without touching each other. Rime tells you, per worktree, whether it has changes, whether it would merge cleanly, what happened to the tests it saw run, and whether it is ready to hand over. A checkpoint captures the project before the agent starts, so rime agent undo can put it back. When one agent gets stuck, a handoff writes down where it got to and starts another on it.

Close the lid. The work carries on.

While a session is running, closing a laptop's lid keeps it awake with the screen, keyboard light and Bluetooth off, and Wi-Fi power saving off so a VPN holds. If it gets too hot, or the battery reaches 20 %, Rime checkpoints the sessions and suspends anyway. With nothing running, the lid sleeps the laptop as it always did.

On the machine next door, too

Rime reaches your other machines over your own SSH configuration. Run a build on the desktop from the laptop, or start, list and attach to agent sessions on another Rime machine as if they were local. The Agent Center lists them under Remote devices.

Rime Remote, on your phone

Rime Remote is the Android app for your agents. It lists every session on each paired computer, needs-you first. You can watch a session's live terminal and reply when it is waiting, from the keyboard, by voice, or with a photo or file dropped into its inbox. You can also pause, resume, interrupt or stop it, and start a new one in any project, with its own worktree. Nothing runs on the phone: an agent started from it runs on the computer and keeps going when you put the phone away. By default it pauses while the computer's screen is locked; rime agent lock --remote continue keeps it running.

It cannot approve anything that needs root. By design, and with no setting to change that: the phone shows what is waiting at the machine, and can revoke permissions already given.