An agent that stops at the pull request.

You already build with an agent — it just lives on your laptop, and it only ever works while you're watching it. This turns any Ubuntu 24.04 machine you own into a persistent home for it: approve a spec, let it work overnight on hardware you own, and wake up to a pull request instead of a merged commit — a tool-level guard keeps it there, and your repo's branch protection makes that a lock rather than a promise. One command, ~15 minutes.

Everything those “I run Claude Code from my phone” blog posts walk you through — tmux, Tailscale, SSH hardening, a session that survives a dropped connection — plus the part they skip: a guard that keeps the agent at the pull request, and a check that your repo can hold it there.

If you already code with an agent, you've hit this:

• It's chained to your laptop. Close the lid and the run dies; you can't kick off a refactor from your phone on the train.
• Long jobs want a machine that's always on — a battery-and-heat tax on your laptop, a security project on a raw VPS.
• Going remote safely is a minefield. Open SSH, expose a port — that's exactly how 42,665 agent boxes ended up publicly reachable with auth bypass.
• Doing it right — a private network, sessions that survive a dropped connection, the agent, auth, hardening — is the yak-shave you keep postponing.

Here's what you get out of it:

• Your agent, wherever you are. Drive it from your phone or your laptop over your own private network — start a refactor on the train, check it at lunch, it's still running when you get home. Never chained to your desk.
• Work that doesn't stop when you do. Sessions persist on the box, so long runs stay alive across dropped connections and closed laptops. Kick it off, walk away, come back to the result.
• A senior workflow baked in — spec-driven development. The standout skill: instead of the agent diving straight into code, it writes a short spec you approve first — the problem, the plan, the edge cases — so you catch a misunderstanding in a paragraph instead of in a 400-line diff. That's how bigger features stay on the rails when you're steering from your phone. It comes with a full cast of review skills (code review, QA, UX, growth) that critique the work before you merge, plus GitHub wired up and a real pull-request flow — a way of working teams take years to build, on your box from minute one.
• It proposes; you merge. Approve a spec, and the optional night shift implements it unattended while you sleep — then stops at the pull request. A PreToolUse hook, loaded from the command line so the agent can't edit it out of its own settings, allows only a push to its own branch and gh pr create, and blocks merges, releases, pushes to main, the GitHub API, CI edits, root and eval — from the shell and the file tools alike, with MCP switched off. That's the brake. The lock is branch protection on your repo: with a required review the agent, acting as you, can't approve its own pull request — and a pass checks for it before spending anything.
• A practice that keeps itself honest. Unfinished specs are resurfaced every time you open a session, so long-running work never rots in a folder you forgot about, and an optional incident log turns each thing that breaks into a rule you won't trip over twice.
• Know exactly what your agent burns. A built-in usage coach reads your own session history and shows where your plan is going — by model and by project, on the status line and on demand (“how much have I burned this week?”). It nudges you off an expensive model for routine work, so an opaque bill turns into a decision instead of a surprise rate-limit at the worst moment.
• Give it eyes on the web — when you want them. One command (biab pack add browser) lets the agent read, click, fill and screenshot live pages. Off by default; when it's on it runs sandboxed under its own locked-down user that can't touch your keys or your code.
• Secure without thinking about it. Your box answers only on your own private network, never on the open internet — behind NAT nothing is ever exposed, and on a VPS it reaches the same private-only end state without locking you out. Structurally not one of the 42,665 exposed boxes.
• Works with the agent you already pay for. Claude Code or Google's Antigravity — you choose at setup, and the whole practice works the same either way. One command, ~15 minutes, on hardware you already own. Your box, your files, your credentials. Open source, MIT — no one can pull the rug.

New in v0.2: the usage coach, the opt-in web-browsing pack, and session-start reminders for unfinished specs — all included, nothing extra to sign up for. Wi-Fi first-boot and more capability packs are next.

Bring your own Ubuntu 24.04 box — a mini PC, a homelab VM, or a VPS — and the agent you already use: a paid Claude subscription (Pro or above) or a Google account for Antigravity. The private networking is free for personal use, and the installer walks you through it. Open source, MIT. No hardware yet? Try it in a VM first.

The README lists everything the installer changes and the security model; --uninstall removes it all.

Just want an agent working in the background? Hosted options like Anthropic's Cowork do that without a server. This is for when the agent needs your machine — your files, your local network, your credentials, your cron jobs.

Where this is going.Today this is for people who already build with an agent. But the box doesn't care who owns it — the same machine that runs your refactors can run a household. There's a USB “gift” edition that self-installs and hands a ready-to-go box to someone who'll never touch a terminal, so a technical friend can set one up for anyone. The road ahead: an old computer given a second life as a brain for your life — no engineering required. We're not there yet. That's the direction.

Launch news + release notes, a few emails a year. No spam, unsubscribe anytime.