Execution Isolation & Security
How Desktop and Cloud Studio keep agent execution contained.
BhaiCode applies isolation on both surfaces, with different mechanisms for each.
Desktop process isolation
- Path denylist: agents cannot access sensitive system directories (
/etc,~/.ssh,~/.aws,C:\Windows\System32). - Process boundaries: shell commands run in dedicated PTY child processes under your user account, within standard OS permission boundaries.
- Approval interceptions: commands that need network access or run external scripts are gated by the Transparency Dock.
Cloud Studio isolation
- In-browser WebAssembly: frontend applications compile in-browser, inside your browser’s sandbox.
- Ephemeral build containers: heavy compilation runs in single-use containers with strict CPU, memory, and timeout limits.
- Immediate cleanup: the build environment is destroyed as soon as the task finishes.
Was this page helpful?