v2.0.0 · MIT · macOS and Linux · Podman
Lyngvi is a hardened, agent-agnostic sandbox for running autonomous coding agents against your own repositories. You drive it from a desktop app — the conversation, the diff and the delivery in one window — or from the command line, which is the same product without the window. The agent gets a working copy, a toolchain and a controlled way out. It never gets your credentials, your git history or a route to the internet.
Everything the app does is also a command. The CLI ships inside the app and in a package of its own, and both call the same core:
./setup.sh --sandbox ~/sandboxes/shop init --repo ~/src/shop✔ sandbox created · profile "default" · 1 repository./setup.sh build && ./setup.sh up✔ localhost/lyngvi-base:2.0.0✔ proxy and gateway up on 10.89.3.0/24 (internal)./setup.sh session new --title "Fix the login redirect" --preset dev✔ session 7f3a2c · container lyngvi-shop-7f3a2c · 8g / 4.0 cpusecho "Find and fix the login redirect bug" | ./setup.sh session ask 7f3a2c … reading src/auth.ts, running the test suite ✗ DENIED api.telemetry.example → not on the allowlist 3 files changed, tests green./setup.sh session review 7f3a2c apply src/auth.ts +12 −3 apply tests/auth.spec.ts +58 −0 hold bin/run.sh EXECUTABLE reject ../secrets.env PATH_TRAVERSAL./setup.sh session apply 7f3a2c --branch agent/fix-login✔ 2 files committed on agent/fix-login
Named after the island in Norse mythology where the wolf Fenrir was bound: a place where great power is kept within defined boundaries.
The desktop app
Making a sandbox, talking to the agent, reading the diff and delivering what you approve are all in the app, and none of it needs the terminal. Every screen below is the real JavaFX app, run against a sandbox with one repository, three conversations and a change waiting to be reviewed. No mock-ups, no retouching.
Every reply shows what the agent read, searched, ran and edited — with +/− counts on each edit — and what the turn cost in tokens and dollars. The strip above the composer says what is waiting for delivery, and that one file is held back.
Lyngvi 2.0.0 · dark theme · sandbox «shop»
The four premises
Everything else in Lyngvi is shell around these four. They are the reason an agent can run unattended in a repository you care about.
The session container sits on an internal network with no default route. Every outbound connection goes through a Squid proxy with an allowlist, and an explicit blocklist of known exfiltration endpoints is evaluated first.
squid · allowlist + blocklistThe agent works in a copy with a fresh .git — no hooks, no config, no remotes, no credential helper. The whole git attack surface is removed structurally, not by policy.
copied working treeInternal systems are reached through a read-only, allowlisted API that holds the token. The agent only ever sees a hostname. A plugin cannot read the secret: the runtime injects it into a locked upstream object.
never a token in the containerChanges come back as a patch, classified on the host file by file, reviewed by you, and committed to a working branch. Never to main, never silently.
apply · hold · rejectArchitecture
All logic lives in a Java core that both the CLI and the JavaFX GUI call in-process. The core is the only thing that talks to git and Podman. Select a part of the diagram to see what it guarantees.
internal network · no default route
Inside the sandbox
The agent gets a real development environment — git, a toolchain, a package registry through the proxy — with a strictly bounded view of the world.
Mounted into the container, and nothing else from the host:
/work/<repo> a working copy with a fresh .git, one mount per repository/work/output files meant for you, outside the repositories/work/_attachments files you sent with a message, read-only/work/AGENTS.md the house rules, generated from the sandbox configHTTP_PROXY, HTTPS_PROXY the only way out, to the allowlist<SYSTEM>_GATEWAY_URL a hostname per configured internal systemStructurally out of reach, not merely discouraged:
Claude Code and OpenCode ship as reference adapters, with subscription login or a token. An adapter is an agent.json plus a command contract, so a third agent is a config file, not a fork. Models running on your own machine (Ollama, LM Studio, MLX) are reached through the proxy on the ports your profile names.
Egress control
The blocklist is evaluated first, then the allowlist; anything that matches neither is denied. Try a hostname and see what the proxy would answer.
registry.npmjs.org profileAllowed by the profile your organisation ships.
./setup.sh domain add registry.npmjs.org ./setup.sh domain blocked --follow
Delivery
A delivery is measured from a baseline — the session start, the last delivery, or any delivery in between — built into a patch inside the container, and then classified on the host. Classification is yours, not the agent’s.
Pick where the diff starts: session start, the last delivery, or an earlier one.
Built with a throwaway index, so uncommitted, unstaged and agent-committed work all come along.
Three buckets on the host, by rule: apply, hold, reject.
File by file, as hunks or whole files, in the GUI or the CLI.
Commit or stage on a working branch. Protected branches are refused.
| File | Bucket |
|---|---|
src/auth.ts | apply |
src/session/cookie.ts | apply |
tests/auth.spec.ts | apply |
bin/run.sh EXECUTABLE | hold |
docs/screenshot.png BINARY | hold |
../secrets.env PATH_TRAVERSAL | reject |
Ordinary text changes, applied when you approve them.
Executables, symlinks, binaries and oversized files. Delivered only when named explicitly.
Path traversal, absolute paths, .git segments, invalid UTF-8, unparseable patches. Never delivered, whatever you click.
The gateway
Some work needs the wiki, the issue tracker or an internal API. The gateway is a sidecar that holds the credential and exposes a narrow, read-only, allowlisted view of the system. The agent gets a hostname and a 403 when it asks for something you have not allowed.
GET https://wiki.gateway.local/page/48219200 · text/markdownallowed: space OPS is on the listGET https://wiki.gateway.local/space/FINANCE403 · not allowednot allowed yet — the human must add itthe gateway answers before any upstream call
./setup.sh gateway instance add wiki --plugin confluence \
--hostname wiki.gateway.local
printf '%s\n' "$TOKEN" | ./setup.sh gateway secret set wiki \
--url https://wiki.example.com --token-stdin
./setup.sh gateway allow wiki add space:OPShttp is built in and covers any REST API behind a static secret. confluence and jira ship as jars. Your own is a class implementing GatewayPlugin plus a service entry, dropped in with gateway plugin install. The codebase ships with no systems configured — a profile pack adds what your organisation needs.
The rest of it
The boundaries are the point, but a sandbox you avoid is a sandbox that protects nothing.
Sessions cannot see or edit each other’s work, and resource limits mean something. Start, stop, shell in, garbage-collect the idle ones.
Hostnames, allowlists, mirrors, CA names, protected branches, toolchains and language live in profile.json and a profile pack. No organisation is baked into the source.
A slim Debian base plus the fragments you pick: Java 17/21/25, Node 22, Python 3.12, Go, .NET 8, Maven, Gradle, Kotlin.
review (2g, 1 cpu), dev (8g, 4), build (16g, 6) — or one derived from your machine. Chosen per session, by what the session is about to do.
One JSON document on stdout, documented exit codes, and a line-delimited event stream from session ask. The CLI contract is the public, language-independent API.
Nav rail, streaming chat with tool calls and usage, a file pane, a diff viewer with whole-file mode, and the same review and apply flow as the CLI — the flow itself living in the core both of them call.
Base image, Squid and the gateway base are pinned by digest; the agent CLI version is pinned in its fragment. doctor --deep proves the egress rules from a throwaway container.
Drop files or paste an image into the composer. Point the sandbox at Ollama, LM Studio or an MLX server on your own machine; the proxy opens just those ports.
Every user-visible string comes from a resource bundle, in the CLI and the GUI alike. --lang picks one per command.
Hardening, in one table
Install
The app ships as a jpackage build with the CLI inside it, and the CLI on its own as a jlink image with its own runtime. You do not install Java.
Requirements: macOS or Linux · Podman 5+ · Java 25 only if you build from source
Install the app, and the «New sandbox» wizard takes you from nothing to a sandbox you can start a conversation in. There is nothing else to install: the CLI ships inside the app, and a sandbox made here links its own cli/ to it — so the same folder is yours to work in from the terminal whenever you want to.
macOS: a .dmg, opened the first time with right-click → Open, since the app is not notarised yet. Linux: a .deb or the unpacked app image. Then the conversation, the diff and the delivery are the windows above.
The app, screen by screenCreate a folder, drop setup.sh in it, and let it fetch the runtime for your platform. The download is checksum-verified.
mkdir -p ~/sandboxes/shop && cd ~/sandboxes/shop# setup.sh: github.com/joachimhs/lyngvi/releases./setup.sh --downloadPoint it at a repository. init writes the sandbox its own launcher and a copy of the CLI.
./setup.sh init --repo ~/src/shopRender the config, build the image, bring up the proxy and gateway, and let doctor check the result.
./setup.sh rebuild-config./setup.sh build./setup.sh up./setup.sh doctorA conversation gets a container. Ask, read the diff, deliver what you approve.
./setup.sh agent login claude-code./setup.sh session new --title "Fix the login redirect"./setup.sh session ask 7f3a2c./setup.sh session review 7f3a2c./setup.sh session apply 7f3a2c --branch agent/fix-login