Safety & control
Parallel agents are only useful if you can trust what they're doing while you're not looking. These are the guardrails.
The approval inbox
Agents → Approvals collects every session that stopped to ask something — permission prompts, questions, choices — with the recent output shown as the question and quick-answer buttons (y, n, custom text) that type straight into the session. Waiting sessions badge the rail; toasts fire when AIOAT isn't focused (mutable per workspace). The same pane shows live CPU/memory per session, runaway warnings, and Kill / Pause-&-hand-off / Export actions.
Checkpoints — time travel per agent
AIOAT snapshots each agent's worktree automatically at meaningful moments (and on demand). Code → Checkpoints lists them per session; you can diff any two, restore a single file, or roll the whole tree back — a safety checkpoint of the current state is taken first, so rollback is always undoable. Checkpoints live outside the branch history (refs/aioat/…) and never dirty the agent's commits.
Secrets scanner
Committing from Source control scans the staged diff for credentials — AWS/GitHub/Slack/Anthropic/OpenAI keys, JWTs, private keys, connection strings — and blocks the commit with masked snippets when it finds any. False positive? Allow-list that fingerprint or path and commit again. Agents committing on their own branches are caught at the review gate instead.
Prompt-injection scanner
Text entering the shared context store — published notes, imported instruction files — is scanned for instruction-like phrasing (“ignore previous instructions”, “don't tell the user”, hidden zero-width characters, exfiltration patterns). Flagged items are marked ⚠ in the UI and labelled as untrusted in agents' context digests; you decide whether they belong.
Stall, context & cost meters
- Stalled: an idle session silent past the threshold (Settings, default 10 min) is flagged and toasted — no more discovering at 5 pm that an agent quietly died at lunch.
- Context meter: Claude Code sessions report context-window usage; the session row shows ctx % turning amber → red as it fills (thresholds in Settings).
- Cost: per-session running cost, with today/this-week totals on the dashboard.
Pause & hand off
When a session's context is nearly full (or you just want a fresh head), Pause & hand off asks the agent to write a HANDOFF.md, checkpoints the worktree, ends the session, and starts a fresh one that begins by reading the note — same branch, clean context.
Automation rules
Per workspace (Settings → Automation): when an event fires → then act, with {title}/{branch}/{repo} templating.
| When | Then |
|---|---|
| agent done · agent waiting · agent stalled · tests passed · tests failed · checkpoint created | notify · run tests · publish output to context · send a prompt to the session · spawn a follow-up agent |
Typical: agent done → run tests, then tests failed → send prompt “the tests are red, fix them”. Rules ship inside workspace exports.