Execution Isolation & Security
Local-first safety and ephemeral cloud container isolation in BhaiCode.
BhaiCode implements multi-layered isolation across both Desktop and Cloud Studio.
Desktop Process Isolation
- Path Denylist: Agents are prevented from accessing sensitive system directories (
/etc,~/.ssh,~/.aws,C:\Windows\System32). - Process Boundaries: Shell commands run in dedicated PTY child processes under your user account with standard OS permission boundaries.
- Approval Interceptions: Commands requiring network access or external scripts are gated by the Transparency Dock.
Cloud Studio Ephemeral Isolation
- In-Browser WebAssembly: Frontend applications compile in-browser via WebAssembly, isolating execution within your browser sandbox.
- Ephemeral Build Containers: Heavy compilation tasks run in single-use, isolated micro-containers with strict CPU, memory, and timeout limits.
- Immediate Cleanup: Build environments are destroyed immediately upon task completion.