xbin: a workspace you own, and rewrite from inside it

apps/dashboard — terminal

# scaffold a tile, edit it live, ship it
$ bx new apps/dashboard --runtime go
$ bx term apps/dashboard        # a shell, in the browser
  ~/apps/dashboard $ vim backend/main.go
  ~/apps/dashboard $ git commit -am ship

$ bx grant apps/dashboard res:apps/db reader
✓ live in the workspace · sandboxed · versioned · backed up

agent · llmhttp:llmtiles/llm-gw

one key, every model; swap the gateway and the agent code stays put

agent · mcp ×2http:mcpgithub-mcp + search-mcp

agent · archivehttp:archivetiles/s3-archivers3://backups

agent · netnettiles/wg-vpninternet

all egress rides the VPN tile—the agent can't bypass it

Claude CodeOpenCodeCodexHermesaider…or just vim

The terminal is where tiles get built, and it is a sandbox with a job to do. It can ship this tile; it can't wander the box. A rogue agent's blast radius is one tile's directory, and its apt installs land in a throwaway overlay, never in the base image.

Your $HOME follows you: one per-user homedir across all your terminals. Dotfiles, harness config, and keys are set up once.

apps/dashboard agent+ >_{ }⇋ net: internet ▾ api ✓

# any harness—the workspace doesn't care ~/apps/dashboard $ head -1 $XBIN_WORKSPACE/AGENTS.md # AGENTS.md—building in this xbin workspace ~/apps/dashboard $ claude "wire the archive slot to S3" ● read AGENTS.md · edit backend/main.go +24 −3 · build ✓ ~/apps/dashboard $ sudo apt install ripgrep → lands in this terminal's overlay—the base image stays read-only ~/apps/dashboard $ cat ../billing/backend/main.go → read-only (and only because you can read that tile) ~/apps/dashboard $

Read-only base imageEach terminal stacks a throwaway overlay on the shared base. apt install anything; the image never changes.

One home, all your terminals$HOME is your per-user directory: persistent, shared across your sessions, and separate from the host's home.

This tile read-write, the rest read-onlyOnly the tile the terminal was opened on is writable. Sibling tiles are readable for patterns and APIs, and only the ones your account can read.

Network is a switchPer-terminal scope: none, internet, or host. Flip it in the titlebar; offline agents are a first-class mode.

Tile API access is a toggleThe terminal's token acts as this tile and never as the owner. You can switch API access off entirely, so an agent can edit code without reaching the live app.

Runtime state stays with the backendThe tile's live resources (its database, its resource filesystem) are not mounted in the terminal. State is reached through the tile's API, on its terms.

Homelab & self-hosters

Everything in one place on your box

Dashboards, notes, a calendar, a media tool, an agent: one binary with backups built in, reachable over Tailscale. No docker-compose sprawl.

Linux enthusiasts

Real isolation you can inspect

Rootless user namespaces, cgroups v2, seccomp, and landlock with no container wrapper in between. Buildless frontend (no npm); the shell itself is a tile you can hack.

IT admins

Multi-user with real RBAC

Users, orgs, per-tile ownership and access levels, approvals delegated to org admins. An audit log records who approved what. Least privilege by default.

Small teams

Own your internal tools

No per-seat SaaS, no vendor lock-in. Agents build the dashboards and integrations; they run on your infrastructure, versioned and auditable.

Accounts

Accounts by invitation only

Admins hand out single-use invite links; the invitee sets their own password. Pause an account without losing a grant. Hit a tile you can't read and the page itself offers request access; the owner approves at a level and that's it.

Orgs

Roles that mean what they say

Flat orgs with per-member viewer / developer / admin presets. Org admins manage members, sharing, lifecycle, and wiring, with real authority inside the org and none outside it.

Ownership

Tiles move like property

Transfer a tile to an org and its governance moves with it. Every transfer shows a preview first: your remaining access, which bindings die under the new owner's policy, who gains control. No silent surprises.

Delegation

The 2am loop without the admin

Workspace admins grant orgs allowances as precise as "internet, but only *.stripe.com". Org admins approve inside those bounds; requests outside them wait, visibly, for you.

Per-tile rootless sandboxesUser, mount, pid, IPC, UTS and net namespaces per backend, mapped to a delegated sub-uid range with no host root.

seccomp + landlockA syscall block-list and a filesystem allow-list on every tile; the mount family and friends are denied unless a tile is explicitly a container host.

Default-deny grantsAn element principal reaches no other tile, resource, or network until the owner approves an explicit grant. Inbound identity headers are stripped.

Encrypted vaultPer-component secrets and stateful resources are encrypted at rest; the workspace can start sealed and be unsealed after login. A tile's secrets are read only by its own running backend.

Git per component + backupsEvery tile is its own repo; scheduled backups and one-click restore are built in.

Bound network egressTiles have zero IP egress until you bind a net interface: internet, host, a LAN CIDR, or through another tile (a firewall/VPN).

Tiles & screensA snappable grid of apps; drag, pin, float, or full-page any of them.

Browser terminalsA real sandboxed shell on any tile, with a code + diff review pane.

Git per componentVersion, diff, and restore every tile independently.

Optional ingressPublish HTTP or raw TCP/UDP behind your TLS with the Traefik tile; off unless you bind it.

ContainersAn opt-in cap:containers tile runs rootless podman for dev boxes.

Backups & restoreScheduled, encrypted, one-click restore of any tile or the whole workspace.

bx CLI + Go SDKZero-dependency SDK; a bx CLI for everything the UI does.

Agent-readyAn AGENTS.md contract, per-tile terminals, and a status channel agents drive.