Your coding agent here. Its project in a sandbox.
A persistent, sandboxed workspace on any Linux machine, reached over an outbound-only, end-to-end encrypted link. Your harness keeps its login and UI; nothing it runs touches your machine.
Then, in a repo, pond claude — or pond claude me@server: for a sandbox on a Linux machine you can SSH to.
Your harness here, the project there
pond claude (or pond codex) runs it on your machine with its own login and keys; the project's files live only in the node's sandbox, and every command runs there.
A sandbox with its own network
Bubblewrap over a read-only image: uid 10002, no capabilities, a seccomp filter, bounded resources. Services you start meet on its localhost; HTTPS goes only to hosts you allow.
The harness jailed too
On your machine the harness reads and writes only its own state and the node's files, reaches only TCP 443, and runs only itself and the shims.
Batch is one command
pond run PROMPT runs the harness headless against the node and prints the patch; --temp --git URL throws the whole node away afterwards.
Only outbound connections
The node and your machine each dial one relay. Neither listens; the relay only pairs two tickets and forwards opaque frames.
Blind, end-to-end encrypted
Mutually pinned Noise KK protects every stream independently of the relay's TLS. Run the tiny stateless relay yourself.