Your coding agent here. Its commands in a box.
A persistent, sandboxed workspace on any Linux machine, reached over an outbound-only, end-to-end encrypted link. Your harness keeps its login and UI; nothing it runs touches your machine.
Then, in a repo, pond attach — or pond attach me@server: for a box on a Linux machine you can SSH to.
Your harness, its commands boxed
pond attach runs Claude Code or Codex on your machine with its own login; every shell command it runs runs in the node's box, the workspace synced both ways.
A box with no network
Bubblewrap over a read-only image: uid 10002, no capabilities, its own namespaces, a seccomp filter, bounded memory, CPU and processes.
The harness jailed too
On your machine the harness reads and writes only the mirror and its own state, reaches only TCP 443, and runs only itself and the shim.
Batch is one command
pond run PROMPT runs the harness headless against the box and prints the patch. Pond never pushes it.
Only outbound connections
The node and your machine each dial one relay. Neither listens; the relay only pairs two tickets and forwards opaque frames.
Blind, end-to-end encrypted
Mutually pinned Noise KK protects every stream independently of the relay's TLS. Run the tiny stateless relay yourself.