Checked. Approved.
Bounded. Recorded.
Then it runs.

TrueCoder is a terminal-native coding agent with an auditable execution plane. Every shell command passes through policy evaluation, an approval fingerprint, and a durable audit record before a single byte of your project changes.

terminal

$ curl -fsSL https://github.com/Shivam583-hue/TrueCoder/releases/latest/download/install.sh | sh

View source on GitHub →

42,214 src lines + 44,743 test lines·2,520 test scenarios·ruff check clean

auditadmitted

policyok· risk low

sha-256recorded

truecoder · zsh

TrueCoder terminal interface showing the composer, active model, and keyboard shortcuts

Local by default

Commands run with your own toolchain, your virtualenvs, and your caches, right where your project already lives.

Sandboxed on request

A digest-pinned, non-root, read-only, network-denied Docker profile, proven against real Docker.

Audited, always

Policy denial, approval rejection, and every run reach one durable row. There's are no routes that escape audit.

A command doesn't run until it has earned trust.

Shell execution is a security event and NOT a generic subprocess call. A total of six gates stand between a model deciding to run something and that thing actually executing.

ADMIT

Durably recorded in SQLite before anything is allowed to start.

CLASSIFY

Ordered policy rules score risk and cap the requested limits.

SELECT

Capability-matched backend: a local process group or the sandbox.

APPROVE

A fingerprinted scope you can see, and cannot be widened by the UI.

LAUNCH

Resource identity committed to audit before a byte executes.

RECORD

One arbitrated terminal outcome, hashed and made immutable.

Fifteen tools. One audit trail.

Every tool the model can call, from reading a file to running a shell command, goes through the same registry, approval fingerprint, and durable record.

~/terminal

Textual TUI with streaming responses and live tool cards
Turn-based history, so an incomplete turn never enters the record
Project-scoped SQLite sessions, one repo can't see another's
ctrl+d diffs the workspace against the pre-turn checkpoint
Undoable turns via git-plumbing checkpoints

~/tools

15 approval-gated tools, including read, write, edit, grep, glob, shell, and delegate
edit_file applies multi-site edits atomically, one approval
Durable memory through remember and forget, corrected in place with replaces
A task planner that survives context eviction
Language-server intelligence: symbols, defs, references, diagnostics

~/execution

Every shell call is policy-classified and capability-matched
Loop detection withdraws tools from a stalled model instead of burning turns
Rolling compaction summarizes evicted history instead of dropping it
Cross-platform: POSIX process groups, Windows Job Objects
Context budget enforced, so oversized results are shortened instead of silently dropped

~/audit

Immutable WAL SQLite log, trigger-protected rows
SHA-256 digests over the full raw output of every run
Crash recovery leases nonterminal runs and never trusts a bare PID
Retention compaction preserves every unresolved record
Mutation evidence: before/after digests for every write and edit

~/sandbox

Digest-pinned Docker image, launch never pulls
Non-root UID 65532, read-only root filesystem
All capabilities dropped, network denied by default
Memory and PID limits, best-effort CPU accounting
22 adversarial checks run against real Docker

~/providers

OpenAI, Anthropic, Google, OpenRouter, and the Models.dev catalog
Browser sign-in and headless device authorization
/models hot-swaps the active model without a restart
web_fetch is SSRF-resistant and only reaches public addresses
MCP servers treated as untrusted, namespaced, schema-bounded

Measured, not claimed

Engineering scorecard.

Physical source lines across 175 files

Automated test scenarios across unit, contract, integration, e2e, and sandbox

Test lines, roughly a 1.06:1 ratio to source

Of source is the execution & audit subsystem alone

3-platform CI

Linux, macOS, and Windows run the full matrix on every push

Adversarial sandbox checks run against real Docker

Default execution ceiling: 600s runtime · 1 MiB produced output · 64 KiB returned to the model. Requests can tighten these per call, never widen them.

The agent decides what to do while the execution plane decides whether it's allowed to happen.

The shell tool is the thin, model-facing bridge between them. It converts arguments and formats results, and holds none of the actual authority.

Agent plane

Owns the loop, context, tools, checkpoints, and presentation.

Turn lifecycleContext budgetTool registryCheckpointsMemorySessions

shell tool

Execution plane

Owns policy, approval, evidence, isolation, and process ownership.

Policy engineApproval gateAudit storeBackendsDiscoveryArbitration

execution lifecycle

admission (durable)
  → policy evaluation
  → backend selection and exact preparation
  → approval
  → active registration
  → resource-gated backend start
  → supervision, arbitration, drain
  → termination and cleanup
  → one immutable terminal finalization

Certified sandbox profile

When isolation matters, it's proven, not assumed.

Local execution is fast and already has your toolchain installed. When a command needs isolation instead, this is what it runs inside, and every claim below has been checked by an adversarial test against real Docker.

✓Linux · Docker certified✓22 adversarial checks passing✓Digest-pinned, --pull never

✓

IdentityFixed non-root UID/GID 65532, no-new-privileges active, all capabilities dropped.

✓

Root filesystemRead-only, with only approved tmpfs locations writable.

✓

Host filesystemA request for host-mode isolation is refused outright by the plan.

✓

NetworkDenied unless an isolated network is explicitly configured by an operator.

✓

Runtime socketNever mounted, never visible inside the container.

✓

Memory & PIDsHard limits, defaulting to 512 MiB and 64 processes.

✓

ImagePinned by content digest, verified for platform, user, and entrypoint labels.

✓

Critical commandsA command still permitted at critical risk is refused on the host and only allowed in the sandbox.

One line, and it's on your machine.