Creates isolated workspaces, runs shells in them, reports what is running and lets an assistant kill or wait on it. Because it executes arbitrary commands for remote callers, the sandbox tiers, path containment and PID-ownership checks are the feature, not polish.
What stands out
- Sandbox tiers reported by /ready
- Path containment and PID ownership checks
- Authenticates against keyring; per-person settings