Bromure Agentic Coding runs each coding agent in its own Linux VM on your Mac, with your credentials kept outside it. Version 5.4 adds three things: policies you can write once and enforce in the VM, less noise in what the agent reads, and a way to bring a Mac into the fleet.

OpenShell policies, a kernel sentry and lineage

A workspace can now take an NVIDIA OpenShell policy, the open YAML format that says which files an agent may touch, which user it runs as and which hosts and requests it may reach. Bromure makes the same allow and deny decisions OpenShell does: we checked our engine against NVIDIA's on 125,666 generated cases, and they agreed on all of them.

Enforced on both sides. Landlock, seccomp and a privilege drop confine the agent inside the VM. The network rules run on your Mac, down to the HTTP method and path, where root in the VM can't switch them off.
A kernel sentry. A Bromure kernel module in the VM records program starts, connections, privilege changes and every refused file access or system call, and streams them to your Mac. If anything tries to silence it, that counts as tampering, and Bromure can cut the workspace's network and pause it.
Lineage. Every connection is traced back through the processes that opened it to the agent's tool call and the reasoning the model gave for it. When a package's install script phones home, you see which install it came from and why the agent ran it.

It is off by default. Turn it on per workspace under Settings ▸ Sandbox Policy by setting Sandbox engine to OpenShell + Sentry, then write a policy or import an existing OpenShell file.

How it works, from Landlock rulesets to the sentry's heartbeat →

Squelch: less noise, fewer tokens

Most of what a coding agent reads is command output, and most command output is noise: hundreds of passing tests around the one that failed, a progress bar for every package an install downloads, a line for every file a build compiles. The model reads all of it, every turn.

Squelch cuts that noise out before the model sees it. It recognises test runners, package installs, builds, git, logs and search, and keeps what the agent acts on: errors, failures, warnings and summaries. A line that mentions an error or a failure is never dropped. Output the agent reads as the thing itself, such as cat, git diff or curl, is never touched.

It works for every agent with nothing installed in the VM: Bromure's proxy trims the command results on their way to the model. A Sidecar Mac's agents talk to their provider directly, so Squelch doesn't apply there.
A trimmed output ends with a note saying what was left out. If the agent needs everything, it reruns the command with BROMURE_FULL_OUTPUT=1 in front.
The same output is always trimmed the same way, so the model provider's prompt cache keeps working.
Each session's header shows the tokens saved, with a breakdown by command and by day.

Squelch is off by default. Turn it on from the session header, or for a machine under Models ▸ Squelch in its settings. It is modelled on rtk, the open source Rust Token Killer: the idea and its per-command strategies come from rtk, and Bromure's filters run in the proxy so they reach every agent without hooks.

Bromure Sidecar: a Mac in your fleet

Most agent work belongs in a sandboxed Linux VM. Some needs a real Mac: Xcode, the iOS Simulator, code signing. Bromure Sidecar is a small menu-bar app for those cases. Install it on a Mac, sign in, and once you allow it in, Bromure Agentic Coding lists that Mac next to your VMs.

Claude Code, Codex, Grok Build, Kimi Code and Oh My Pi run natively on the Mac, and its sessions work with everything else in Bromure: @-mentions across machines, the Switchboard, the task board and automations.
Sidecar always connects out, through bromure.io or to Bromure Agentic Coding on the same Mac, and nothing joins your fleet without your approval.
A Sidecar is not a sandbox. Its agents run with the access of the account they run in, and Bromure's gateway protections don't cover them. We recommend a Mac set aside for it, with only the accounts and keys its work needs.

Sidecar is free and open source, for macOS 14 or later. Windows and Linux versions are on the way. Learn more and download Sidecar →

Watch it

Two new tutorial series show these features at work. In three episodes, Claudia writes an OpenShell policy, tunes it while an agent works, and traces a 2 AM supply-chain attack back to the agent's reasoning. Hans gives his agents a Mac of their own with Sidecar, and ships an iPhone game and its Linux server from one fleet.

Bromure Agentic Coding 5.4 is free and open source, on Apple Silicon. Get it from the downloads page, or see everything it does →